Submit your proposal!

sans.org/mlp/dfir-summi…

#dfir

A great job by Quix0te: AChoirX for Android based on our Android Triage!
Red the blog and download and test the tool!

musectech.com/2024/03/achoir…

#dfir #mobileforensics

Windows Thumbnail caches are a mostly unused artifact. Did you know they can point to paths on external systems? (Yes path embedded in thumbcache file, not from win search db) Can be helpful when threat actors actively delete logs and other artifacts! #DFIR

📱 Novità sul sequestro dei dispositivi informatici? 💻

🎥 #dueparole youtu.be/1iIW9EKAwkc

Un emendamento cruciale promette di rivoluzionare il panorama del sequestro di dispositivi e sistemi informatici, introducendo significative modifiche al codice di procedura penale.…

Dissecting the Android WiFiConfigStore.xml for forensic analysis

#dfir #mobileforensics

blog.digital-forensics.it/2024/02/dissec…

A first look at Android 14 forensics

#dfir #mobileforensics

blog.digital-forensics.it/2024/01/a-firs…

Analysis of Android settings during a forensic investigation

#dfir #mobileforensics

blog.digital-forensics.it/2024/01/analys…

A great class!

Last blog post of the year: 'Has the user ever used the XYZ application? aka traces of application execution on mobile devices'

blog.digital-forensics.it/2023/12/has-us…

#dfir #mobileforensics

Working on the next couple of posts on iOS comparison.

Also, working on some tests and a blog post on what you can still hope to find after an app has been uninstalled.

#dfir #mobileforensics

BrowserState has come up a few times recently and certainly deserves an explanation.
But what else could “last_visited_time” mean?

doubleblak.com/browserstate

iOS 15 Image Forensics Analysis and Tools Comparison - Browsers, Mail Clients, and Productivity apps

blog.digital-forensics.it/2023/11/ios-15…

#DFIR #mobileforensics

iOS 15 Image Forensics Analysis and Tools Comparison - Communication and Social Networking Apps

blog.digital-forensics.it/2023/11/ios-15…

#DFIR #mobileforensics

Post on third-party social networking and communication apps almost ready!

A huuuge one!

#dfir #mobileforensics

Few corrections coming on the third blog post.

Already working on the fourth one: third-party communication apps.

A huge one 😅

#dfir #mobileforensics

iOS 15 Image Forensics Analysis and Tools Comparison - Native Apps

blog.digital-forensics.it/2023/10/ios-15…

#DFIR #mobileforensics

Working hard on the third blog post on iOS Tools Comparison…

#dfir

DFIR NetWars is ready to go at SANS Institute, EMEA DFIR Prague 2023.
Packed room!
Directed by David Szili 🆗 and Jason Jordaan 🇿🇦🇺🇦🌻 and with Taz Wake Xavier Mertens 🇧🇪 Jess Garcia Sarah Edwards 👩🏻‍💻🐈‍⬛

Bart Vanautgaerden, from Google Cloud, sharing the details of an intrusion by Chinese Threat ActorUNC4841 explotiting a Barracuda zero-day SANS DFIR SANS Institute, EMEA #DFIReurope23

Catarina de Faria and Lucas Echard, from WithSecure, sharing and amazing in-depth research of how SRUM *really* works at the low level on different Windows versions #DFIREurope23 #dfir #dfir summit SANS DFIR SANS Institute, EMEA