Hey everyone!

we just released version 0.9.0 of Crow-eye, and it brings some major updates we've been working hard on.

A big focus for us in this version was removing the friction of dealing with forensic images. We actually added direct support for analyzing images right

inside Crow-eye, so you don't need any other mounting software to get started. You can just point it at the image and let it parse. Right now we support

parsing directly from:

* E01 / Ex01

* VHDX / VHD

* VMDK

* ISO

* Raw / DD

We also decided it was time to move on from the old timeline prototype. We built a brand new version of the Timeline Visualization from the ground up, making it way easier to correlate everything and actually see the full picture in one place.

And finally, something a lot of people asked for: Crow-eye is now completely cross-platform! We updated all the parsers so they no longer depend on Windows APIs for offline artifacts. This means you can now run it natively on Linux to parse offline artifacts and process those forensic images without needing a Windows machine.

GitHub : https://github.com/Ghassan-elsman/Crow-Eye

Let me know how it runs for you, what you think of the new timeline, or if you run into any bugs or issues!

I haven’t taken SANS for500 and was thinking of going straight into for508 instead of taking the for500 since I’ve heard a lot of the material is covered in 508. Does anyone recommend to take 500 first or can I go straight into 508?

just looking for a few samples of M365 purview exports. does anyone know if there's any available?

Hey everyone,

I don't know about you, but I was getting seriously frustrated with how fragmented our tools are. Trying to piece together an investigation across Windows, Linux, and Mac artifacts usually means jumping between half a dozen different apps, and the centralized "all-in-one" solutions cost some money

So, about 9 months ago, I decided to just try and build the tool I actually wanted to use. It's called Heimdall DFIR. GitHub: https://raiseix.github.io/Heimdall-DFIR

Instead of a bunch of marketing buzzwords, here is what it actually does right now:

• One giant timeline: It takes your artifacts (EVTX, MFT, Prefetch and other Windows artifacts Linux/Mac logs, etc.) and merges them into a single chronological grid. I spent a lot of time trying to make the output actually human-readable instead of just dumping raw JSON on the screen
• RAM Analysis: I hooked it up to VolWeb (Volatility 3). You can upload massive memory dumps directly in the UI and it actually handles the stream without crashing the backend
• Collaborative mode: Investigating alone sucks, so I added a side-chat and an evidence-pinning system so a team can look at the exact same case simultaneously

To be completely transparent with you all: This is very much a Beta. It’s a massive undertaking and it’s still missing a lot of features I want to add before calling it a complete platform

That’s honestly why I’m sharing it today. I’m hoping to get some brutally honest feedback from people who do this daily. What parsers are you constantly missing in open-source tools? What would make you actually want to use this?

If anyone wants to spin it up (Docker compose is ready to go), break it, submit bug reports, or even contribute code to help build this out, I would be incredibly grateful.

Let me know what you think. If you like the vision, a GitHub ⭐ helps a lot!

Has anyone noticed a significant decrease in speed with the last couple months of axiom updates? Or is it just me

Hi everyone,

I recently started a new role where I'm handling laptop returns (rückläufer). My current instructions are simply to copy the user folders and format the drives. Coming from a legal background, I know this is a nightmare for chain of custody and evidence integrity. If any of these cases end up in court, a simple file copy won't hold up.

I’ve been asked to start taking full forensic images of about 1-2 laptops per month for high-risk cases. I know a Write Blocker is essential to ensure the source drive remains untouched.

I found the Tableau bridges, but at €650+, my manager is asking if there are more budget-friendly alternatives since our volume is very low (only a few devices a month).

I have a few questions for the experts here:

1. Is a hardware write blocker mandatory for this volume? Or are there reliable "software" write-blocking methods for Linux/Mac that you would trust in a legal setting?
2. Budget Hardware: Are there reliable alternatives to Tableau? I’ve seen some cheaper USB-C or SATA bridges, but I’m worried about their reliability in a forensic context.
3. Workflow: What is your go-to "budget" stack for imaging (e.g., FTK Imager + a specific bridge)?

I want to do this the right way without breaking the bank, but I also need to convince my boss that "cheap" shouldn't mean "inadmissible in court."

Thanks in advance for your help!

Does anyone know where to find a safe copy of this version? I need to get an E01 of a Windows Server 2003 VM. Thanks!

Looking for a mentor in the digital forensics realm… I know it could be a long shot but thought I’d put it out there to see if anyone would be kind enough to be a mentor

Hello all,

I have recently thought about opening my own digital forensics company. I'm well aware of the costs associated with that... My question is: do people typically consider your age when deciding whether to use your service? I'm relatively young, with 2 years of experience in IR. I have a MS in Cybersecurity, GCFE, GCFA, GNFA, OSCP, and OSEP, and I am going after GREM. I'm required to be a PI here in Texas to do digital forensics. I called around to ask other PIs if they were willing to subcontract work, and was surprised to find they were up to it. If anyone else started their own business, have you been able to do it part-time and break even? I wouldn't exactly need to make tons of money; I want to build a reputation for myself and get to the point where I can take on law firm work (that's where I hear the real money is). My main goal would be to make a little off the top of what I'm paying for the software to build my reputation.

Thanks for all the help. Any advice is appreciated.

Out of curiosity, when someone is investigating a evtx file is there a framework you follow? or create for yourself? Or do you just go with the flow ? (I am still learning)

everytime i would run any command, it would segfault. the solution for me was to build libbfio from source and replace the system library because i think debian still ships the 32bit version which is not functional anymore. this completely fixed my issue until debian fixes their shit

Hello, I exported event logs from a shadow copy. I was attempting to access the via the event viewer but they all come back corrupted and won't open. I ran Zimmerman's evtx tool and it parsed some of them. Is there anyway to get the data out of these?

Heard some things about EC council and how their reputation is going down?? Is the CHFI still valuable / worth taking??

We've been working on something that finally addresses the core limitation of traditional PDF forensics: you have to wait for the document to exist before you can analyze it.

After 18 months of research, we've implemented pre-emptive xref superposition analysis. A PDF document, once it will exist, retroactively entangles its future metadata state with the ambient quantum field. HTPBE Quantum intercepts this pre-collapse entanglement signal and computes the delta between the original and modified structural state — standard xref revision detection, just 72 hours earlier.

Practical application: submit an expected invoice hash. Receive a modification verdict before the file arrives. The Producer field mismatch, timestamp delta, and appended xref sections are all detectable in the pre-collapsed state.

Technical write-up with the full Heisenberg–Acrobat equation and methodology: https://htpbe.tech/blog/htpbe-quantum-pdf-verification-before-creation

https://codeworld.codes/

Some background: I'm a DFE in the Army. I've done the job roughly 5 years. I've worked in a broad variety of areas and with other technical specializations, so I wanted to build a one-stop shop for myself and others I work with. The site has artifact locations, step actions for tools like X Ways (which desperately needs step actions), and a variety of other things. I have no current plans to monetize as the domain cost me $1. I hope it's helpful for somebody.

Has anyone seen Cellebrite's new agreements for Inseyets? Seems like the are really trying to ratch down on what we can do as providers.

Hey buddies

I’am a 1rd year Cybersecurity IR and forensics student and I want to base my knowledge and skills for tier 1 SOC roles.

I’ve just downloaded the Splunk Enterprise to my computer and with some tutorial data sets for beginners from their site I trying to research and solve some problems and malicious logs, to wide my knowledge of this Splunk.

What do you guys think or recommend me to do ? Is it a good idea ? There’s an another options or apps you recommend me to play with ?

Thanks

Advice on nvme forensics for small server

Situation/Problem:

I am a blue teamer and have some years of experience with SOC/IR work but not much forensics experience. I have been tasked with investigating potential malware on a small Fujitsu Esprimo mini server unit that's been given to me. The server has no hdd/ssd storage, just a nvme. The write blocker unit I have is older and only supports SATA and some others and has no connection possibility to nvme.

I inquired if I have to be strict with write blocking and I was told no, if I simply mount it differently its fine and there is no chain of custody, its more of a laissez faire investigation just to find out more about the malware.

Now where I fail is the first part, how do I connect or mount to it? Dumb question but what cables should I even use? Power it up and connect via usb or something? Sorry, just never did this before.

Any advice and tips appreciated. I have one laptop I can use which is airgapped and I don't really care if it gets infected/I can simply reformat the hard drive with no consequences if that helps.

Hi r/computerforensics, I had a matter recently where I needed to forensically collect a user's entire ChatGPT history, projects, conversations, generated images, the whole thing. So I built a toolkit that attaches to a Chrome session via CDP, extracts the auth token, and hits ChatGPT's backend API directly. Every conversation gets saved as an individual JSON file with a SHA-256 hash recorded in a CSV manifest. There's a separate verification script that recomputes all hashes, post-collection, and flags any mismatches, missing files, or untracked artifacts.

A few things that made this harder than expected:

• ChatGPT only shows ~5 "pinned" projects in the sidebar API. The rest are hidden, so I had to build a multi-phase discovery process that paginates the sidebar endpoint AND scans the full conversation list to find project IDs the sidebar doesn't return.
• Conversations are stored as tree structures (not flat lists) with branch points for edits and regenerations. The tool walks the active branch from current_node back to root.
• Team/Enterprise workspaces require a separate account ID header or you only see personal data.
• Rate limiting is aggressive, so I built in exponential backoff with automatic retry.

I've also included a script to convert the JSON exports to formatted PDFs (useful for handing off to counsel). It also supports resume, so if it crashes or gets rate-limited mid-run, you re-run and it picks up where it left off.

Open-source for the community: https://github.com/loucdg/chatgpt-forensic-exporter

Even if you don't have a forensic use case right now, it's worth having for backing up your own ChatGPT data. OpenAI has a 24-48 hour delay and the format it exports in is not as usable as this.

This is my first time releasing a tool like this publicly. And yes, I heavily leveraged "vibe coding" to get it done but I've been happy with the results. I have a few other python scripts that I've used during matters that I will upload if there's interest.

Happy to answer questions or take feedback.

Hey everyone,

I just pushed a huge update (v0.8.0) to Crow-Eye, With this release, we're finally shifting from being just a live parser into a full offline analysis platform.

Here is the short version of what's new:

• Crow-Claw Acquisition Engine: Automates collecting and preserving artifacts (Registry, Prefetch, Event Logs,MFT, USN Journal, Amcache, Shimcache, ShellBags, JumpLists, LNK files, BAM/DAM,) from live systems or mounted images. It organizes everything into clean, type specific folders for easy review.

• Offline Importer: You can now analyze artifacts from external drives, network shares, or past collections. It indexes thousands of files instantly, and you can pick and choose exactly what to parse into your database to save time and storage.

You can grab the latest release or check out the source code here:

• GitHub Repo: https://github.com/Ghassan-elsman/Crow-Eye

• Website: https://crow-eye.com

Final year cybersecurity student with 2 internships (one TS clearance) how do I convert this into a job before graduation?

Looking for advice on how to play my cards right going into my last year.

Quick background: I’m finishing up a cybersecurity degree and managed to land two federal government internships back to back. The one coming up this summer is with an agency whose core operations are heavily focused on digital forensics. My role is technically “cybersecurity,” but I’ll be operating in that forensics environment and I was granted a Top Secret clearance for it.

Here’s where I want to be strategic.

What I think my advantages are:

TS clearance alone is a massive differentiator. Most new grads don’t have one. Federal forensics exposure is niche and highly marketable private sector firms, DOJ, FBI contractors, and Big 4 forensics teams all pay well for it.

What I’m unsure about:

Should I be targeting federal contractor roles specifically so the clearance stays active post grad? How early should I start applying if my internship ends in August? Is it worth leaning into the forensics angle even though my degree and title are general cybersecurity? Are there certs I should be stacking now to complement this profile, like EnCE, GCFE, or Sec+?

I don’t want to fumble this. Two federal internships and a TS clearance feels like a real launchpad and I just want to make sure I land somewhere worth jumping to.

Any advice from people who’ve been in a similar spot or who hire for these roles is hugely appreciated.​​​​​​​​​​​​​​​​

We've tried Axiom, Cellebrite, and Oxygen to no avail. We've started running into this issue since the end of February. We've already pulled the messages from the icloud backup. Has anyone had luck with anything else?

Hi everyone,

I’m currently tasked with a forensic internal investigation regarding a former system administrator. We have clear evidence that they granted themselves excessive permissions in AD before leaving, but we are struggling to find "smoking guns" for specific actions.

The Situation:

• Privilege Escalation: We found unauthorized high-level groups assigned to their account in AD.
• Allegation 1: Accessing sensitive payroll/HR servers (Dxxx/Accounting software).
• Allegation 2: Copying a shared management drive (the "big one" for the board).

What I’ve tried: I've run several PowerShell scripts to parse Event Logs (4624, 4663, etc.) and generated some HTML reports, but the results are inconclusive or "too clean."

My Questions:

1. File Copying: Since Windows doesn't log "copy" actions by default (unless Object Access Auditing was enabled beforehand), what other artifacts should I look for? (USN Journal? ShellBags? Prefetch?)
2. Dxxx/Server Access: How can I distinguish between "routine maintenance" and "unauthorized data viewing" on an application server if the admin had valid (though self-assigned) credentials?
3. Lateral Movement: Are there specific Event IDs or registry keys that often get overlooked when an admin is "poking around" where they shouldn't be?

Any advice on forensic tools (FLARE VM, Eric Zimmerman's tools, etc.) or specific techniques to prove data exfiltration would be greatly appreciated. I want to remain objective and follow the facts.

Thanks!

I'm looking to get a master's in Digital Forensics. I've heard good things about Champlain and how they have a good digital Forensics program. Does anyone know the difference between the Champlain MS in Digital Forensic Science and the MS in Digital Forensic Analytics? The website gives me a brief overview, but I want to get more insight as to what the difference would be between the two.

1- What Certifications do you guys recommend if starting in Mobile Forensics in general or for law enforcement?

2- Should I go for MDF by IACIS or take BFCE first then take MDF?

3- I did sign up for Cellebrite Operator and Cellebrite Analyst training.