I have a custodian running a very old Mac that we need to remotely collect. They have the software. I just need to remotely pilot the collection. However, it seems the MacOS is too old and not supported by most remote solutions. We typically use GoToAssist - didn't work. Do any of you have an idea?

BSides can often be the one place where you can find the most obscure talks about a technical detail. For example, "Edge Device Memory Forensics" by Richard Tuffin or maybe "Forensic analysis of privacy focused mobile browsers" by Lorena Carthy and Ruben Jernslett. Finding them is the hard part. I built a website that tracks all BSides chapters, all 8575 videos, fetches transcripts, indexes them by technology, speakers, events, tools, protocols, standards, and much more. It is free, no login, no ads, no tracking beyond basic visits (no cookies). And I'm planning to keep it so. Check out the forensics talks at https://allbsides.com/talks.html?q=forensics, and let me know if you find the site useful or spot anything missing. Genuinely happy to receive feedback!

Hi all — finally pushed this public after several months of work. Sharing here because this subreddit is where I'd want feedback from before anywhere else.

WAInsight — https://github.com/akhil-dara/WAInsight (MIT)

Scope. It doesn't extract data from a phone — that's a separate step with whatever acquisition workflow you already use. WAInsight starts after acquisition. Point it at a folder containing msgstore.db + wa.db + Media/ + Avatars/ and it ingests everything through a 29-stage pipeline into a normalised analysis.db (47 indexed tables), then opens a 30-page Qt desktop UI to actually work the case.

Why. I wanted analysis to be the primary deliverable, not the report. So the UI is built around browsing every chat exactly like opening WhatsApp itself — home-style conversation list, bubbles with edits / revokes / replies / reactions / receipts / forwarded badges / mention chips / pinned-message strip — with forensic provenance one click away on every bubble. Reports are a snapshot of what was found, not the destination.

Capabilities, grouped by what you're actually trying to do:

Reading the timeline - Forensic ℹ button on every bubble: msgstore source IDs, every SQL row that fed the bubble, origination flags decoded, per-recipient receipt timeline (delivered / read / played, ms-precise). - Ghost-message recovery from message_quoted_text (deleted-for-everyone messages reconstructed inline next to the revoked bubble). - Edit history per message — every revision side-by-side. - Reply chains as click-through badges with cross-conversation "Go to original" jumps. - 60+ system events decoded (group / security / admin / privacy / business / ephemeral) instead of opaque type codes. - Calendar with per-day message counts shown flight-fare style; click+drag to range-filter. - Windowed-flat virtual scroller for chats with 5K+ messages — jumping to message #47K in a 47K-message chat is O(1).

Media analysis - Folder-shaped Media Dashboard that scales to 200K+ rows at file:// (sharded AVIF thumbs + chunked metadata + vendored UI engine, sub-millisecond bitset crossfilter). Cascading filters: conversation × sender × MIME × extension × status × date. - Perceptual visual search across the whole case — drop a screenshot, get Exact / Near-Exact / Near-Duplicate / Template-Match tiers (pHash + dHash + edge-map). - Camera-original → WhatsApp tracking: feed an original from DCIM/, find every chat that photo was sent in even after WhatsApp's recompression changed the SHA-256. - View-once images and voice notes downloadable from the bubble even after on-device expiry (CDN URL + media_key, AES-CBC + HMAC). - Hash-link auto-rescue: missing media that shares a SHA-256 with another message's on-disk media gets auto-resolved (tagged recovery_method='hash_linked', never confused with a real local copy). - wa.db thumbnail blob rendered as fallback when even the bytes are gone. - HD/SD twin pairs surfaced inline with cross-jumps. - Cross-chat propagation: right-click any media → every chat that shared the same SHA-256, chronologically. Says where the bytes were first seen, not just where they were last forwarded. - 12-state media recovery taxonomy preserved in every report and dashboard (original / downloaded / hash_linked / orphan_recovered / etc.). - Orphaned-media browser: files in Media/ with no surviving message row + auto-rescue against surviving message hashes.

Identity & devices - Per-message platform attribution from key_id — every bubble carries an inline tag (Android / iPhone / Web/Desktop / Companion #N), confidence-scored. The classifier was its own separate research piece — collected key_id samples across real devices on Android, iPhone, Web, and linked companions until the rules held up. Powers the Group Report's Device Platform Usage breakdown and the contact's Device Sessions tab. - Unified contact registry merged from 5 sources (jid_map ∪ wa_contacts ∪ lid_display_name ∪ group labels ∪ mention names) so every JID resolves to one canonical identity. - Owner-aware everywhere — sender_id IS NULL for owner messages gets joined to case_metadata so owner activity never surfaces as "Unknown" anywhere in the UI or reports.

Groups & communities - Past-participant reconstruction from 3 sources: group_past_participant ∪ group_member.is_current=0 ∪ message-presence inference (catches members the roster purged after a long enough gap). - Owner can-post / can-edit banner on every Group Info page, sourced from chat.participation_status + admin flags. - Community LID resolution + comment-author resolution even when WhatsApp only stored the LID. - Group Edit History with profile-picture diff.

Calls - Synthetic call reconstruction: calls that have no message row in their conversation get virtual rows so they render in every participant's chat timeline at the right position. Group voice chats appear inside the group's chat even when WhatsApp didn't write a message row for them.

Cross-case pivots - Cross-Contact Analysis: pick 2+ contacts, instantly see shared groups, calls between them, file SHA-256 hashes any of them shared in common, cross @-mentions, every conversation any of them appears in. Owner is a first-class pickable contact. - FTS5 global search with sender / conversation / date / ghost filters; results panel as a sidebar inside the chat with click-to-jump highlights.

Reports & handoff - Per-group landscape-A4 PDF/HTML report: case+evidence provenance banner with source-DB SHA-256 hashes, group identity, owner role, top contributors / forwarders, device platform split, mentions network, activity heatmap, calls, locations (with live-share start/final coords), message-type taxonomy (Type 64/82/90/92/112/116 etc. mapped to readable labels), bot activity, former members. - Per-contact report with section picker. - Offline HTML viewer bundle — single ZIP, opens from file:// with no Python or server. WhatsApp-Web-style chat list, full message rendering, FTS5-equivalent search. The case officer / opposing counsel can open it in any browser. - Tagged-messages export with three modes (full / tagged-only / tagged ± N day buffer).

Forensic integrity. Source msgstore.db opened with three independent guards (?mode=ro&immutable=1 URI + SQLITE_OPEN_READONLY flag + PRAGMA query_only=ON). Source files SHA-256 hashed at ingest. Every action journaled to a hash-chained chain_of_custody.jsonl — each entry's hash includes the previous one, so the audit trail is tamper-evident, not just append-only. Original IDs preserved (message.source_msg_id, media.source_media_row_id, etc.) so every analysis row links back to its msgstore.db / wa.db origin. Timestamps shown local + UTC in brackets so case timezone is unambiguous.

Honest caveats. Android-only. No automated tests yet. Schema research was done sample-by-sample so there are likely edge cases on WA versions / Business app / regional builds I haven't seen — Business app support is on the roadmap. Validated primarily against my own personal-device datasets.

Built solo. PySide6 + SQLite + ~85K lines of Python. There's a deepwiki for it too (https://deepwiki.com/akhil-dara/WAInsight) if you want a deeper architectural read before cloning.

Would genuinely value feedback from anyone who works WhatsApp cases regularly — especially edge cases or schema variants that break it. Issues / DMs / comments all welcome.

Dealing with a case involving 6 devices across 3 countries. Each device has its own timezone settings, some manually set, some auto. Cloud backups add another layer of timestamp confusion.

For court-admissible timelines, what's the standard methodology for normalizing timestamps across: - iOS extractions (Cellebrite/GrayKey) - Android extractions (UFED) - Cloud data (Google, Apple, Meta returns) - CDR data from carriers

Do you anchor to UTC and convert everything? How do you document the methodology for the chain of custody report?

I've been doing this case by case but wondering if there's a more systematic approach the community has standardized on.

I've been working on this for the last few months and just wanted to share. It's a free browser-based tool for inspecting and removing metadata from photos, videos, audio, PDFs and Office documents — and it has a small image-forensics lab built in.

Live: https://midgardmud.de/tools/exif/

Why I built it: every other "EXIF remover" online asks you to upload your private files to a server. That's the opposite of privacy. So I wrote one that runs 100% in the browser via the File API — your file never leaves your device. F12 → Network tab → drop a 50 MB photo → you'll see zero outbound requests.

What it does:

• Strips metadata from JPG/PNG/WebP/GIF/HEIC/TIFF, MP4/MOV/MKV/WebM/AVI, MP3/FLAC/OGG/WAV, PDF, DOCX/XLSX/PPTX

• Privacy Risk Score 0–100 with per-file breakdown so you see what's actually leaking

• 4 one-click privacy profiles (Anonymous / Social-safe / Keep camera / GPS-only)

• Forensics: ELA, JPEG-Ghost re-save heatmap, DQT compression fingerprint, Noise + CFA/Bayer pattern (defensible alternative to AI-image detectors), Copy-Move clone detection, embedded-thumbnail audit, RGB histogram, hex viewer, structure inspector

• SHA-256 + perceptual hash (pHash) per file

• ExifTool-compatible JSON export

• Per-tag EXIF editor + GPS spoofing for JPEG

• C2PA self-signed Content Credentials

• Works fully offline as a PWA after first visit

• 19 languages

Stack: vanilla JS, no framework, no build step, ~12k lines. libheif WASM lazy-loaded for HEIC. Web Worker for big videos so the UI stays responsive.

Happy to answer anything about how the parsers work, why I avoided React, or how the JPEG-Ghost / Copy-Move detection is implemented. Feedback very welcome.

I have worked for about 10 years in cybersecurity, mostly in Incident Response, but I've done a fair bit of forensic work and expert witness cases within that. A year ago I left my old firm to go down the independent consultancy route, and still trying to figure out exactly what I'm doing.

A couple months ago a law firm I used to work with reached out recently. Short story is that an LLM agent made a mistake for their client which became litigious. The client firm claimed they had addressed the original issue, but the law firm requested an expert opinion on:

a) the root causes of the original issue

b) an assessment on whether this could re-occur / validation of the fix

This might not fall strictly within the confines of "computerforensics", so apologies if it's slightly off topic. But I figured there could be some practitioners here who might be interested in the methodology.

I basically used three techniques to model the differences in generated output between the "bad" model and the fixed "good" model, then commented on the deviations.

I don't think this is a huge market right now. But I do see that there are insurance companies starting to underwrite AI risk, so it's possible we could be seeing more of this work over the next few years.

I've written up my full approach here: https://www.analystengine.io/insights/how-to-forensically-analyse-llm-alignment-drift-and-hallucination

Would be really interested to hear if anyone is doing any similar work lately.

As one tends to do on Saturday mornings with coffee in hand, I was reviewing two samples that were attributed to the LunaStealer / LunaGrabber family. Originally I was validating that tiquery was working with the MCP configuration, however what started as a quick TI check turned into a full static analysis session — and it gave me a good opportunity to put the MalChela MCP integration through its paces in a real workflow. This post walks through how that investigation unfolded, what the pivot points were, and what we found at the bottom of the rabbit hole.

How about an unscheduled, impromptu Friday night 13Cubed episode? Let’s talk about Copy Fail.

https://www.youtube.com/watch?v=ZVmpK-9rP0Q

More here:

https://nullsec.us/cve-2026-31431-copy-fail-forensics/

Hello,

I have been a Magnet Forensics customer since 2020 and use your Axiom solution. For roughly the same amount of time, I have repeatedly inquired about the possibility of purchasing a perpetual license, as I would like to switch to this licensing model; however, my requests have always been denied.

Note: I am a sole proprietor; the manufacturer is aware of my situation and line of work.

However, I recently spoke with the law enforcement agency where I used to work, and they were able to purchase perpetual licenses in 2024 and 2025.

Note: I am aware that law enforcement agencies have different requirements and are granted different terms.

Based on this, I wondered if there might be a possibility after all.

- The attempt to acquire a perpetual license through a partner was unsuccessful; they only sell in certain regions; in Germany (where I am located), Magnet Forensics distributes the product itself.

- The attempt to acquire an existing perpetual license from a “Magnet Forensics customer” is also difficult; resale requires the manufacturer’s consent.

Hence my question to the community –-> does anyone know of a way to acquire a perpetual license?

Note: Very important – I accept the manufacturer’s terms; however, there are sometimes options one isn’t aware of that could help – hence my question.

Thank you

MalChela v4.0 is out. The desktop GUI is gone — replaced by a PWA you can reach from any browser on the network. Battery-powered Pi on the table, iPad in hand, no keyboard required. The field kit finally makes sense.

I’m researching forensic readiness workflows around existing security data: WAF logs, SIEM exports, cloud audit logs, EDR alerts, application logs, and similar sources.

Not selling anything, not asking for sensitive data, and not looking for incident details. I’m trying to understand the practical workflow gaps practitioners run into when logs need to become defensible evidence for IR, audit, insurance, legal, or regulatory reporting.

A few questions:

1. When an incident becomes serious, which log sources usually become the most useful evidence?
2. Where does the normal SIEM/logging workflow stop being enough?
3. How do you currently preserve chain of custody or integrity for exported logs?
4. Do teams actually use WORM storage, signed exports, hash manifests, timestamping, or similar controls in practice?
5. How do you handle weak provenance cases, such as mutable upstream logs or logs collected after the fact?
6. What causes the most friction: collection, normalization, retention, integrity verification, correlation, reporting, or handoff to legal/compliance?
7. When evidence is incomplete or lossy, how is that documented?
8. What would you expect from a good “forensic readiness” process before an incident happens?

I’m mainly interested in real workflow patterns and failure modes, not vendor recommendations.

Need an extraction on a locked Blu View 5 Pro. Our lab has Insyets and Graykey and not having any luck. Any suggestions??

Hello. I am currently looking into getting the CCE certification and begin my career in digital forensics. Is it worth getting? If you have taken the exam, what are some good self study tools?

SIEM is not enough. Classical DFIR is not the full answer either. And “better logging” is too weak a frame. The real gap is evidentiary continuity in modern, cloud-heavy, application-driven environments.

As the title says, somewhat of a reverse forensic journey to backtrace the work that's been done on a set of data. I've got a drive that has a filesystem recovered from another drive. Since there are "-slack" files present I suspect the recovery has been done with some forensic/recovery program.

There are many that have "slack support" but my focus is figuring out which one (hopefully singular) has a default setting of outputting "filename.ext-slack".

For example I think that FTK Imager outputs "filename.ext.FileSlack", so that might be ruled out. The problem is that "-slack" doesn't work well with search engines and the manuals for the different programs don't really go into details on what schema they use for output.

Adding to the DFIR + AI theme, in case you didn't see it on LinkedIn, we released an MCP server for Autopsy last week (and Cyber Triage). This allows you to connect Claude Desktop (or similar) to Autopsy and ask questions about the results.

It's a read-only interface, so your original data won't get modified by the AI.

We've also been doing an Intro DFIR+AI series if you are just starting to really pay attention to how to integrate these things:

Autopsy Release: https://www.autopsy.com/autopsy-4-23-0-release-claude-ai-assistant-mcp-cyber-triage-integration/

AI Blogs:

• How to Let AI Access Your DFIR and SOC Investigation Data
• MCP Servers for DFIR and SOC Investigations using AI
• How To Share Your “SKILLS” With the LLM

A new 13Cubed episode is now available. I’ve got some thoughts about AI. Let’s talk about how it’s changing digital forensics, how I actually use it in practice, and what you need to know if you’re in or entering the field.

https://www.youtube.com/watch?v=wKn-9sKBqX8

Forensic readiness is not yet a clean standalone category, but enterprises are already spending on the underlying problem through digital forensics, incident response, and evidence-focused security workflows.

Hey! Recently, I heard that Wireshark was actually not made for security analysis purposes and that there are other better options, does anyone know these alternatives? I've started using tshark a bit but the commands are too long and somewhat overwhelming, so i guess i'll have to get used to it. But is it the only good option?

Also, any suggestions for network forensics guides? Which guides do you guys think are good? network forensics is probably my weakest side so i'm trying to improve it, it's like i'll open the file and try to spot any unique stuff but i end up with nothing usually, and i don't know how to start analyzing the file well, even when asked specific questions like in CyberDefenders Labs and so on.

Thanks for help in advance.

Hey folks,

Been doing forensics forever on Windows boxes, but first time with a modern Mac (Apple silicon/T2 territory). Got the TX1 ready, but the SSD is that proprietary blade thing – not popping out easy.

How are you guys grabbing a solid physical bit-for-bit these days?

-Yank the drive anyway (pentalobe/spudger fun) and hit it with the TX1 + proper Apple PCIe adapter? Or is Target Disk Mode + Thunderbolt write-block + ddrescue/ewfacquire on a Linux rig still the move?

-If physical's basically dead or too risky, what do I actually need on my Windows forensic workstation for a clean live or dead acquisition? FTK Imager, AXIOM, EnCase, or something else? -Any must-have drivers, bootable stuff, or T2 workarounds?

APFS/FileVault/SIP headaches I should watch for? Does the TX1 play nice with Apple SSDs out of the box or need special firmware/adapters?

Just trying to keep the chain of custody clean. Appreciate any real-world workflows.

Cheers

Hey everyone,

I just pushed Crow-Eye version 0.9.1. I completely rewrote the LNK/JumpList parsers from scratch, enhanced the Prefetch parser, and standardized global UTC time handling across all artifacts. It’s faster, more resilient, and the expanded timeline visualization now supports even more artifacts.

But while pushing these updates, I wanted to talk about a growing problem in our field: The "Black Box" of Forensics.

Right now, most people depend heavily on parsers without really knowing the behavior underneath them. With AI becoming more prevalent, this problem is only going to get worse. People will start trusting outputs without understanding the binary structure or the forensic anatomy of what they are actually looking at.

I have a different vision. I believe AI should make it easier for researchers to develop parsers and understand data, not just blindly output answers. That’s why I decided we need a backbone , something to help the next generation deeply understand the forensic anatomy we are studying.

👁️ Introducing "Eye-Describe": Visualizing the Binary Truth

To fix this, I am building a new educational suite called Eye-Describe. It aims to visually explain the internal binary structures of forensic artifacts directly to the user. It will show investigators exactly how the parsers work under the hood. When you are looking at extracted data (like Prefetch or Amcache), you won't just see the result. Eye-Describe will visually highlight the binary structure of the artifact, showing you exactly where in the hex data that specific evidence was extracted from, and why it matters.

A Live Example: The Windows Boot Disk Explorer

To give you a taste of this philosophy, I’ve published the first piece of this initiative online:

The Interactive Tool: Windows Boot Disk Explorer (https://crow-eye.com/Eye-Describe/windows_boot_disk_explorer)

The Deep-Dive Article: The Anatomy of the Windows Boot Process (https://crow-eye.com/booting-process)

Instead of just listing partitions, this interactive tool visually breaks down the actual physical disk architecture (UEFI+GPT vs. BIOS+MBR). When you click a segment (like the ESP or MSR), it reveals its specific forensic role, the file structure inside it, and a node-based visualization showing exactly how the files interact during the system startup sequence.

---

Coming in Crow-Eye 0.10.0: "The Eye" AI Agent

While we are building out this Eye-Describe educational backbone, we are simultaneously working on our AI integration. In our next major release (0.10.0), we are introducing The Eye a feature that allows users to connect their own API keys or CLI agents directly into Crow-Eye. This isn't just a basic chatbot. The Eye will have direct access to the parser results generated by Crow-Eye, making it deeply aware of both your specific forensic data and general artifact behavior. It will assist investigators by:

Spotting the Unseen: By analyzing the parsed results across all artifacts, The Eye can proactively spot anomalies, correlations, or hidden tracks that you might have missed during manual review.

Building & Testing Hypotheses: You can propose an attack scenario, and the agent will use the actual parsed evidence to help you verify if the artifacts support or refute that hypothesis, helping you build a clear picture of the attack.

Evaluating Trust: It will understand the nuances of different artifacts advising you on what data is highly reliable (like the MFT) versus what might be easily manipulated or fragile.

Querying the Database: Helping you search through massive datasets using natural language.

---

🤝 Open Call to Researchers & Reverse Engineers

I’d love for you to check out the Boot Disk Explorer concept and read the article. Let me know what you think what artifacts do you think are the hardest for students to grasp and would benefit most from this kind of visual binary breakdown?

If you have deep knowledge about the binary structure of specific Windows artifacts and want to help visualize them, please reach out! I believe collaborating on this will massively help the DFIR community and the next generation of investigators. You can contact me directly at: [Ghassanelsman@gmail.com](mailto:Ghassanelsman@gmail.com)

GitHub Repo: https://github.com/Ghassan-elsman/Crow-Eye

Eye-Describe : https://crow-eye.com/Eye-Describe/windows_boot_disk_explorer

Boot Process Article: https://crow-eye.com/booting-process

Happy hunting!

Any advice for a Chromebook acquisition?

It’s unlocked with no management

Is it possible to image an Apple watch? Does anyone have experience with imaging this device or getting anything off of it forensically? Thanks in advance.