Arsenal’s Brian Gerdon presented Backstage Parser – a python tool that can be used to parse the contents of Microsoft …

John Walther has written an article about Snapchat forensics. He used an iOS device running 11.4.1 and an Android device run…

Free-B-sd m-emory A-cquisition M-odule Tool/Kernel Module allows acquisition of volatile memory from FreeBSD. You can learn …

The latest version of the system dedicated to forensic analysis and incident management, DEFT X, is released and available f…

Signatures are dead, or so we’re told. It’s true that many items that are shared as Indicators of Compromise (file names/pat…

GiftStick allows an inexperimented user to easily (one click) upload forensics evidence (such as some information about the …

New versions of our open source DFIR tools have been released: Autopsy New Features: Removed data from table that are time i…

Pasquale Stirparo has started a post series about macOS persistense mechanisms titled “Beyond good ol’ LaunchAge…

We decided to continue our cloud forensics series, but focus on more popular desktop applications, this time it’s goin…

This Autopsy plugin by Rebecca Anderson won Autopsy Plugin Contest this year at Open Source Digital Forensics Conference (OS…