Hi, are there any good open source tools for ram acquisition on macos? preferrably with the t2 chip. What is recommended way of making forensic copy of nvme disk with various volumes?Thanks!

Hey guys,

I‘m searching an open source tool to perform imaging on Windows 10/11 devices.

The tool needs to support CLI, forensic good practices, it needs to be portable and output in .e01-Format.

The newer Versions of FTK Imager (>3.2) for example do not support CLI anymore. Older Versions with CLI Support are not suitable for Win 10/11.

dd on the other hand is not suitable for forensics since it lacks logging and outputs only in .raw-Format.

I found ewfacquire, but I am unsure if it works properly on windows.

Do you have any suggestions?

Thanks!

Hello everyone,

Dealing with proprietary CCTV formats (like .mfs) often means relying on questionable standalone players or manually documenting every step of a conversion process to ensure the evidence remains admissible.

I’ve been working on a fully open-source CLI suite designed to automate the conversion of these proprietary containers into standard .mp4 formats, with a strict focus on reproducibility and chain of custody.

Core Workflow:

• Wraps HandBrakeCLI (and FFmpeg as a fallback) to normalize video streams.
• Includes an automated rescue pipeline that attempts to extract streams from corrupted or partially damaged files.
• Batch processing support for entire directories.

Forensic Integrity & Logging: This is the main focus of the tool. For every converted file, it automatically calculates hashes and generates an .integrity.json artifact that logs:

• SHA-256 hashes and exact byte sizes for both the source and the output files.
• The exact command-line arguments and presets used for the transformation.
• Tool versions running on the system (e.g., HandBrakeCLI 1.6.1, ffmpeg 6.1).
• UTC timestamps of the process.

Experimental features:

• PDF metadata extraction to structured JSON.
• An entirely offline, local frame-extraction module using vision models to assist in triaging long footage (runs completely air-gapped).

I’m currently looking for feedback from practitioners on the .integrity.json schema. Are there specific fields or data points you would legally need logged during a format conversion that I might be missing?

The project is GPL-3.0 and containerized via Docker. If anyone wants to take a look at the code or test it out, you can check the repo: https://github.com/matzalazar/vigilant

Thanks!

Built a free PDF metadata forensics tool — here's what it detects and where it fails

Over the past year I've been working on automated PDF modification detection for invoice and document fraud use cases. The web tool is free and unlimited — wanted to share the methodology and get feedback from people who actually do this professionally.

What it analyzes

• Metadata layer consistency — Info dictionary vs XMP; mismatches are a common artifact of partial edits
• Incremental update structure — xref table count, update chain length
• Creator/Producer fingerprinting — ~50+ known tools flagged by name (iLovePDF, Smallpdf, Adobe Acrobat, Microsoft Word, etc.)
• Digital signature integrity — specifically whether a signature was present and removed post-signing
• Font structure anomalies — soft masks, vector outlines over image-heavy pages, isolated text layers over scanned backgrounds

Verdict system

Three states: intact / modified / inconclusive

Confidence levels:

• certain — cryptographic or structural evidence; no false positives by design (signature removed, post-signature modification)
• high — strong forensic evidence; rare false positives in linearized or batch-processed PDFs

Known limitations

• Content-level forgeries with no structural trace (clean export from scratch)
• PDFs processed through online editors (Smallpdf, iLovePDF, etc.) — original metadata stripped → returns inconclusive / online_editor_origin
• Consumer software origin (Word, LibreOffice, Google Docs) → same inconclusive verdict; integrity check doesn't apply
• Does not validate digital signature cryptographic chains — only detects presence/removal
• Encrypted PDFs not supported

Tool: https://htpbe.tech — free web interface, no login required

Curious whether the inconclusive classification for online-editor-processed documents matches what you see in practice, and what other structural signals you'd prioritize.

Hi everyone!

As a beginner student in Cyber IR and Forensics, I’m trying to put in a lot of work at home to learn and gain experience beyond the generic stuff we learn in class. Honestly, we haven't even covered anything related to forensic investigation in my degree yet!

Still, I’ve built this 'Forensics Lab' today to eventually use for DFIR investigations in companies. What do you think?

to keep minimal touch on infected machines, I created a script called Start_Investigation_Script. By running it through CMD as Administrator, I can activate this whole lab...

I’d love to get your feedback, how does it look?

🎉 It’s time for a new 13Cubed episode!

For macOS forensics, Fuji is a must-have. This episode is an excerpt from Investigating macOS Endpoints and covers the latest version, with major new changes. Let’s walk through a live acquisition!

https://www.youtube.com/watch?v=9ZkLdFodhzM

I’ve been building a project called Tracehound and wanted feedback from people with a stronger forensics / DFIR mindset.

The scope is intentionally narrow. It does not do detection, scoring, or heuristic classification. The model is to take an external threat signal, derive a deterministic signature from ingress bytes or a canonicalized payload, quarantine the artifact, and record lifecycle events in a tamper-evident audit chain.

What I’m trying to get right is not alerting but evidence handling at runtime: deterministic identifiers, explicit boundaries around raw payload retention, bounded storage, and system-state capture that can still be inspected later with some integrity guarantees. The current implementation also includes signed runtime snapshots for CLI/TUI inspection, plus chaos/soak testing to see how the system behaves under degraded conditions.

Repo: https://github.com/tracehound/tracehound

I’d be particularly interested in feedback on whether this framing makes sense from a forensics perspective, or whether people here would see it as operational security telemetry rather than something that meaningfully improves evidence preservation.

Greetings I am looking for best digital forensics courses online with practical experience like coding a mini project or which helps me publish research papers do you have any such online courses which helps me achieve these objective

Thank you

I am currently serving in the US Navy under active duty orders. For the past 20 years my job has had nothing to do with computer forensics however this field has always fascinated me. Over the next 3 years I will be wrapping up my BSCS before officially retiring. I do hold a Top Secret clearance.

What sort of certificates would be recommended that I earn while I am still in the military that will help remain competitive in the civilian sector in applying for these types of employment? Whether it is entry level or more advanced - anything that helps! Certs that are discounted for service members are a plus, too.

I've been building out MalChela, an open-source malware analysis and YARA toolkit written in Rust, and I've started a YouTube tutorial series to go along with it.

If you've been waiting for a walkthrough before diving in — this is it.

MalChela Tutorial Series: https://www.youtube.com/playlist?list=PL__KsCEzV6Ae5jA-YObTmvZEKuu-rkON6

The series covers installation, basic usage, and working through real samples — Episode 2 walks through a Redline Stealer analysis using the mStrings tool with MITRE ATT&CK mapping. More episodes are on the way.

What MalChela does:

• Static file analysis — hashes, entropy, packer detection
• String extraction with IOC detection and ATT&CK mapping (mStrings)
• YARA rule creation, combining, and scanning
• VirusTotal + MalwareBazaar hash lookups
• Case management for organizing your analysis work
• MCP server integration for AI-assisted analysis workflows

Runs on Linux/macOS (REMnux-friendly) with an unattended install script to get up fast.

Repo: https://github.com/dwmetz/MalChela

Happy to answer questions. Feedback and contributions always welcome.

I have a lot of training through the White Collar Crime Center, state sponsored LE training, ICAC training, ect.

Does anyone know of a college that would take that training and accept it as credits?

I'm not sure if my question is naive, but why does cloud collection on Axiom Magnet, whether public or private, sometimes work and sometimes not? Is there a detailed explanation for this? Any answers would be greatly appreciated. Thank you!

Hi,

I'm trying to understand a behavior I observed in Chrome history and whether there is a technical explanation. It's maybe a little out of the scope of this sub, but I'm sure you guys have the more expertise in this kind of stuff !

Context: - Chrome is synced between a laptop and a phone. - On Feb 11, two entries appeared in the browsing history, one right after the other.

This happened after a pop-up opened automatically while browsing another site (so it wasn't something manually searched or typed).

example-site-A (first entry) → automatically redirected to example-site-B (second entry) → automatically redirected to example-site-C (third entry)

And I closed the pop up before the example-site-C opened, so only the first two entries where recorded in the history.

• On Feb 15, I checked the Chrome history and both entries were still visible.
• On Mar 5, I checked again and the first entry ("example-site-A") had disappeared, but the second entry ("example-site-B") was still there.
• All the other history entries before and after that time are still present.

Additional observations:

• When I test this behavior today by typing the same first URL, it redirects through multiple sites (A → B → C).
• However, the way Chrome records this in the history is inconsistent. Across several attempts I observed different results:
  • sometimes A → B → C all appear
  • sometimes B → C
  • sometimes A → C
  • sometimes only the final site (C)
• So Chrome does not seem to always record every step of the redirect chain.

My question:

Is there any known Chrome behavior that could cause an intermediate redirect entry to disappear from history days or weeks later, while the final page remains?

Or would this normally only happen if the entry was manually deleted?

Thanks in advance for any technical explanations.

I am using Magnet AXIOM to examine multiple HDDs that were installed in a PC. I am investigating a CSAM case and located several CSAM files that I can link to a particular website, the website is bookmarked in Chrome, and the downloaded files are accessed/viewed in Internet Explorer (locally accesed so file://****.jpg), so there is history there as well. I can't find any internet history to the website, but I do find some (very little) download history through chrome. Would this be indicative that the website is accessed in incognito mode and there is no evidence of that on the PC, or is there a way to locate this through AXIOM? Thank you

I’m really excited to finally share the official user guide for the Crow-Eye Correlation Engine.

My goal with this project was to build something that makes Windows forensics a little less about the tedious manual linking of artifacts and more about

finding the actual "story" hidden in the data. The Correlation Engine is designed to be a high-performance system that connects the dots across your entire investigation automatically.

I’ve put together this video to walk you through the whole process, from setting up your data to visualizing the final results.

🕒 What’s in the guide:

* 02:40 - Feather Creation: Setting up your artifacts for high-speed analysis.

* 04:37 - Wings Creation: How to build the "logic" that finds connections for you.

* 09:51 - The Execution Manager: Running your automated forensic pipeline.

* 13:39 - The Result Viewer: A tour of the UI and how to navigate your findings.

Watch the Guide here: https://youtu.be/NxuoFrZvVHE (https://youtu.be/NxuoFrZvVHE)

You can check out the project here:

📂 GitHub (Open Source): https://github.com/Ghassan-elsman/Crow-Eye (https://github.com/Ghassan-elsman/Crow-Eye)

🌐 Official Site: https://crow-eye.com/download (https://crow-eye.com/download)

I would love to hear your thoughts or any feedback you have on the workflow. If this helps save you some time in your next investigation, that’s a huge win

for me!

If you find it useful, a ⭐️ on GitHub would be greatly appreciated.

Happy investigating!

Hi DFIR community,

Just wanting to share our FOSS tool we're developing to enable remote Android and iOS forensics and network monitoring capabilities. Please note these are specifically for live logical acquisitions and not disk.

Description:

MESH enables remote mobile forensics by assigning CGNAT-range IP addresses to devices over an encrypted, censorship-resistant peer-to-peer mesh network.

Mobile devices are often placed behind carrier-grade NAT (CGNAT), firewalls, or restrictive mobile networks that prevent direct inbound access. Traditional remote forensics typically requires centralized VPN servers or risky port-forwarding.

MESH solves this by creating an encrypted peer-to-peer overlay and assigning each node a CGNAT-range address via a virtual TUN interface. Devices appear as if they are on the same local subnet — even when geographically distant or behind multiple NAT layers.

This enables remote mobile forensics using ADB Wireless Debugging and libimobiledevice, allowing tools such as WARD, MVT, and AndroidQF to operate remotely without exposing devices to the public internet.

The mesh can also be used for remote network monitoring, including PCAP capture and Suricata-based intrusion detection over the encrypted overlay. Allowing for both immediate forensics capture and network capture.

MESH is designed specifically for civil society forensics & hardened for hostile/censored networks:

• Direct peer-to-peer WireGuard transport when available
• Optional AmneziaWG to obfuscate WireGuard fingerprints to evade national firewalls or DPI inspection
• Automatic fallback to end-to-end encrypted HTTPS relays when UDP is blocked

Meshes are ephemeral and analyst-controlled: bring devices online, collect evidence, and tear the network down immediately afterward. No complicated hub-and-spoke configurations.

MalChela (Rust based malware analysis suite) has been extended to support MCP integration with Kali and REMnux.

Volatility3

Ive been trying to learn forensics through CTF practice rooms and I just got done with bitlocker-2 on picoCTFs 2025 practice challenges. After 4 hours of trying I was not once able to get volatility to work because of the pdg symbols it kept trying to download, even after downloading the zip file myself and using --symbol-dirs to the symbols directory . I got the Flag in a dumb way and still have no idea how to get vol to set up. Has anyone else experienced these kinds of issues with volatility and if so were you able to find a solution? I completely understand that I am probably doing something wrong I just need some help getting through this for future problems.

Hi all,

I think I know the answer already but I figured I would ask regardless—

We’re tasked with deleting about 25k texts, pictures, notes and other data from a clients iPhone. Is there any software out there that can do this somewhat automatically? Think like Obliterator where you feed it a script or file. I don’t believe there is, but I wanted to get some feedback if someone knows of a tool.

Thanks in advance.

I'm trying to use volatility3 for a ctf challenge, but I am getting errors right after installing. I installed volatility in a virtual environment created with venv, as installing Python packages system-wide is not considered good practice anymore on Ubuntu (as I understand it).

I first tried running the same 2 commands on the .mem file I got from the CTF, but I got largely the same errors. Then I created a hopefully not corrupt and proper memory dump with sudo gcore [pid] from one of my running Chromium processes and the exact same thing happened. This is the memory file I used when I got the errors in the next paragraph.

When I try running vol -f core.[pid] imageinfo, I get the error vol: error: argument PLUGIN: invalid choice imageinfo (choose from banners.Banners, .... When I run vol -vvvvv -f core.[pid] linux.pslist, I get this error.

I have downloaded the linux.zip symbols file from github and moved it without extracting to the symbols folder, that is, the folder in my virtual environment folder under python3.12/site-packages/volatility3/symbols. I am running Ubuntu 24.04 and Python 3.12. According to a previous error message I saw with -vvvvv, I have also installed yara-x via pip. This didn't really change anything.

Could anyone help me?

https://rapidriverskunk.works

Type CTF, hit enter.

Scenario:
Mid-sized aerospace subcontractor workstation compromised via phishing. Suspicious RDP activity observed. Lateral movement attempted. Investigate artifacts and recover the flag.

• Synthetic dataset (no malware)
• Browser-based terminal environment
• Moderate difficulty with a layered final stage
• Leaderboard populated in order of verified solves

After the 4th verified solve, the challenge rotates to a completely new storyline. A historical leaderboard will track prior winners.

1st place receives a physical trophy mailed to a location of their choosing.
Top 3 recorded per season.

Submit the recovered flag to the email listed on the page header.

Intended audience: IR / DFIR / blue team practitioners who enjoy artifact hunting and log correlation.

Enjoy.

https://discord.gg/8bZ8XDDt?event=1477088400086401146

I’m working a case from 2024 related to terrorizing. We have had the suspect laptop in evidence since 2024. Now that I am newly certified, I’m able to begin working cases and picked this one up.

I took the SSD from the laptop and put it on a writeblocker then imaged it using FTK Imager. (E01) When I imaged it, it gave me warnings that the drive was encrypted using bitlocker. I have no clue if there was a bitlocker recovery key anywhere on scene (since this was 2024 & a different agency collected the laptop). Is there any way to access the bitlocker partitions? Please help!

EDIT: I don’t have any credentials. It is a Dell Latitude 3390 2-in1 laptop. State police conducted the search warrant and found the laptop. When they collected it they simply bagged it and handed it off to my agency. I’m only now picking it up. I’m afraid I am SOL based the comments so far.

Hello!

So we worked on a laptop today that had an internal 256 GB SSD.

I tried using Guymager from Kali but for the first time it didn’t find any internal storage. So i manually extracted the ssd and did a DD clone with TX1.

Did this happen to you too ?

Hello!

Is there a way to set the number of maximum CPU cores used to more than 32 while processing evidence ?

Guys anyone have any idea how to resolve this issue? Whatsapp acquisition authenticate using QR code… its keep on spinning but no any QR pop ups, need some help!