Digital Forensics Now

Heather Charpentier & Alexis "Brigs" Brignoni

A podcast by digital forensics examiners for digital forensics examiners. Hear about the latest news in digital forensics and learn from researcher interviews with field memes sprinkled in.

  1. 17 MARS

    Live From the MSAB Digital Summit 2026!

    Send a text Tool output can look authoritative while still being dangerously easy to misread, and we’ve both seen how fast that goes sideways when a case hits court. Live from the MSAB Digital Summit 2026, we walk through a simple principle that saves careers: an artifact is a clue, not a conclusion. We talk about how “artifact worship” happens, how to build real corroboration, and why multiple records on the same phone are not automatically multiple lines of evidence. We also get honest about forensic reporting and peer review. Assuming “legal will catch it” is a trap, because attorneys and supervisors may not be able to validate the technical meaning of a timestamp, a parser decision, or an attribution statement. We share practical ways to write clearer digital forensics reports, verify tool parsing, and test your assumptions so you’re not learning hard lessons under oath. If you work mobile device forensics, this section is for you. From there we shift into training and deep technical skills that are quickly becoming baseline: Android RAM acquisition and analysis, what kinds of artifacts can show up in memory, and why RAM can hold evidence you may never find in a file system extraction. We also unpack protocol buffers (protobuf) and the uncertainty that comes with app data when the .proto schema is missing, plus why that matters when AI and automation start “helping” with interpretation. We wrap with an ALEAPP update, a reminder that a portable tool report isn’t analysis, and a quick look at how standards like Daubert and Frye raise the bar for methodology. Notes: Brett Shavers Blogs:  It’s Not Artifact Worship When One Artifact Actually Changes the Case https://www.linkedin.com/pulse/its-artifact-worship-when-one-actually-changes-case-brett-shavers-nwi6c/ I Thought Legal Would Catch It. They didn’t. https://www.brettshavers.com/brett-s-blog/entry/i-thought-legal-would-catch-it-they-didnt IACIS https://www.iacis.com/events/in-person/2026-orlando-training-conference/

    50 min

  2. 9 JANV.

    From Wins to Wishlists: Digital Forensics Year in Review

    Send a text A blue jay, a busted feeder, and a brand-new camera set the tone, but only briefly.  We kick off the new year with updates from the Florida ICAC conference, including firsthand courtroom experience watching frame rate and frame count testimony in action. The episode centers on Frame Counts Galore, an open-source script for extracting and hashing every video frame, calculating true variable frame rates, and producing transparent, courtroom-ready logs and reports. We cover upcoming DFIR conferences, introduce a lightweight AI Provenance Scanner for fast C2PA and metadata checks, and reflect on standout moments from the digital forensics year—especially the impact of open-source tools and honest conversations about the realities of the work.  The episode closes with a 2026 wish list focused on stronger education, fair workloads, and customizable forensic reporting that analysts can actually defend in court. Happy New Year to the DFIR community. Notes: Frame Counts Galore- https://github.com/abrignoni/frame-counts-galore Upcoming Conferences-  https://www.iacis.com/                         https://www.msab.com/digital-summit-2026/  https://magnetvirtualsummit.com/               https://www.technosecurity.us/ https://ofta.cellebrite.com/event/cellebrite-c2c-user-summit-2026/ AI Provenance Scanner-   https://github.com/abrignoni/AI_Provenance_Scanner Brett Shavers Blogs-                                                     https://www.brettshavers.com/ UFADE & ALEX-                                                               https://github.com/prosch88

    1 h 22 min

  3. 30/10/2025

    Brett Shavers Blogging Extravaganza!

    Send a text This episode digs into the habits that actually hold up: learning from CTF wins and post-event reviews, exploring scholarships and Reno trainings that build technical muscle, and walking through expert-witness prep that turns courtroom stress into structured, confident testimony. We’ll unpack Brett Shavers’ reminder that truth alone doesn’t win cases—procedure, documentation, and bias-aware methods do. Clear writing matters too; vague language can undermine solid work. On the tools side, RabbitHole v3 now recovers deleted SQLite records and rebuilds them into query-ready databases—speeding validation and reporting without losing traceability. We’ll also demo the new Android Logical Extractor: pull device info, logs, and scoped chat data with hashes and ready-to-file PDFs. It’s ideal when consent is limited or full file systems aren’t on the table, and integrates cleanly with downstream workflows. Throughout, we emphasize one idea: tools are abstractions. If you can’t explain how a result was produced or reproduce it, you don’t own the finding. That’s especially true with AI. Generative models are nondeterministic—useful when documented, risky when their prompts or scope stay hidden. We’ll cover prompt disclosure, reproducibility, and how to write about “deleted” data with precision: previously existing, marked deleted, not referenced—describe state, not intent. If you’re serious about improving testimony, validating results, and adopting new tools without losing forensic footing, join us. Then share your take on AI prompts and language precision—what will you change in your next report? Notes:  IACIS Scholarships https://www.iacis.com/awards-and-scholarships/will-docken-scholarship/ https://www.iacis.com/awards-and-scholarships/womens-scholarship/ Training Opportunities! IACIS Reno https://www.iacis.com/events/in-person/reno-nv/ Free DFIR Test Images + Industry Tools to Analyze Them https://www.dfir.training/downloads/test-images New Blogs from Brett Shavers! https://www.linkedin.com/pulse/theres-lot-more-trial-than-you-may-know-even-have-100-brett-shavers-br4sc/ https://www.linkedin.com/pulse/case-almost-made-me-quit-dfir-shouldve-news-brett-shavers-pie1c/ https://www.linkedin.com/pulse/i-when-digital-forensics-lost-its-soul-brett-shavers-otkec/ https://www.linkedin.com/pulse/end-dfir-again-dfir-training-ab5jc/ https://www.linkedin.com/pulse/how-wreck-your-report-affidavit-testimony-one-word-brett-shavers-qkyvc/ Free Webinar https://www.suspectbehindthekeyboard.com/fighting-city-hall-dfir-lessons-from-a-pro-se-plaintiff Rabbithole Update https://www.linkedin.com/posts/rabbithole-dataviewer-sqllite-ugcPost-7384144022065274880-0d0D https://www.cclsolutionsgroup.com/forensic-products/rabbithole ALEX Release https://github.com/prosch88/ALEX https://github.com/RealityNet/android_triage

    1 h 14 min

  4. 02/10/2025

    Blogs, blogs & blogs!

    Send a text A baby camel, a high-speed chase, and a heartfelt tribute set the stage for a season opener that is equal parts human and hard-nosed. We pause to honor Mark Baker, mentor, officer, and friend. This episode spotlights a free Belkasoft AI course along with the much-anticipated release of Rabbit Hole v3, designed to tackle complex data structures. From there, it is all about blogs, and there are plenty of them. Mattia explores extraction nuances, showing how AFU versus BFU states and encryption classes still determine what you can recover from iOS and Android. Hexordia provides important guidance on first responder missteps, emphasizing how early handling and precise thinking safeguard the integrity of a case. We also showcase open-source and budget-friendly tools such as Autopsy and IPED, which expand analysis capacity without breaking the bank.  A hands-on demo of Gallery Builder illustrates how to create courtroom-ready visuals, paired with a reminder that “vibe coding” with LLMs is no substitute for validated forensic standards. Finally, we close with the latest LEAPP and LAVA updates, which continue to push practical workflows forward for the field. Notes: BelkaGPT: Effective Artificial Intelligence in DFIR https://belkasoft.com/belkagpt-training Training First Responders in Digital Evidence Handling: How To Protect Your Department from Case-Destroying Mistakes https://www.hexordia.com/blog/training-first-responders-in-digital-evidence-handling The Packd Byte https://www.thepackdbyte.org/ Two New Blogs from Mattia  http://blog.digital-forensics.it/2025/09/exploring-data-extraction-from-android.html https://blog.digital-forensics.it/2025/09/exploring-data-extraction-from-ios.html SWGDE https://www.swgde.org/documents/published-complete-listing/16-f-002-considerations-for-required-minimization-of-digital-evidence-seizure/ Gallery Builder https://github.com/charpy4n6/GalleryBuilder

    1 h 15 min

  5. 29/08/2025

    DFN: 2nd Anniversary

    Send a text We celebrate our two-year podcast anniversary and discuss the importance of thorough case preparation for CSAM cases, courtroom experience, and extracting evidence from iOS devices. • SANS Difference Maker Awards open for nominations through September 15th across multiple categories • AI debate webinar with Magnet Forensics scheduled for September 17th • Binary Hick's blogs reveal insights on iOS search party and Samsung's Rubin and Digital Wellbeing databases • Discussion on properly preparing CSAM cases for trial with understanding of statutes and evidence requirements • Brett Shaver's article highlights importance of attending trials to understand courtroom proceedings • iOS File Provider Storage in BFU extractions can reveal user-created images with metadata • Updates to LEAPPS tool including CashApp parser improvements and Snapchat returns parser • New Lava viewer coming soon for the LEAPPS project Notes: SANS Difference Makers Awards- https://docs.google.com/forms/d/e/1FAIpQLSeLNMZm3r4c9WSKdNW8XaPh6KRXoS3C1WI51UtnEANe2osCpQ/viewform AI Unpacked #5: The great AI debate with Digital Forensics Now- https://www.magnetforensics.com/resources/ai-unpacked-5-the-great-ai-debate-with-digital-forensics-now/ The Binary Hick New Blogs- https://thebinaryhick.blog/2025/08/19/further-observations-more-on-ios-search-party/ https://thebinaryhick.blog/2025/08/06/not-strange-bedfellows-samsungs-rubin-digital-wellbeing/ Monolith Notes- https://www.monolithforensics.com/free-tools Brett Shavers- Courtroom Trials Are the Final Exam for Your Work. Why Haven’t You Attended One?- linkedin.com/in/brettshavers/recent-activity/all/

    1 h 4 min

  6. 01/08/2025

    From Cryptic Apps to Clickable Maps: Making Sense of Digital Evidence

    Send a text We're back! After a short break we are back to discuss the growing crossover between real-world events and digital evidence in court cases, highlighting how device data can make or break timelines in high-stakes investigations. This episode covers: Ian Whiffin’s latest forensic work, including iOS power log timestamps, Apple Health data reliability, iPhone battery temperature readings, and IR Doppler functionality – with examples of how these artifacts were used in a recent homicide trial to validate timelines and environmental conditions.Kevin Pagano’s App Store Package Search tool, which translates obscure bundle IDs into recognizable app information for easier analysis.Concerns over the growing reliance on AI in digital forensics, emphasizing the need for human expertise and proper validation in every step of the process.A demonstration of LUMYX, a mapping tool that converts extracted location data into customizable visual timelines for courtroom presentations.Updates on LAVA (LEAPPS Artifact Viewer App) and guidance on writing LAVA-compliant artifacts to improve reporting workflows. Notes: Ian's FOUR Newest Blogs https://www.doubleblak.com/blogPost.php?k=powerlog https://www.doubleblak.com/blogPost.php?k=healthaccuracy https://www.doubleblak.com/blogPost.php?k=temperature https://www.doubleblak.com/blogPost.php?k=doppler Ian Whiffin Testimony https://www.youtube.com/watch?v=kahgl-mIUFE Kevin Pagano Stark4n6 app store package search https://www.stark4n6.com/2025/07/introducing-asp-app-store-package-search.html https://github.com/stark4n6 Elcomsoft Article- AI driven Password Recovery Myth or Reality? https://blog.elcomsoft.com/2025/07/ai-driven-password-recovery-myth-or-reality/ Beyond the Badge AI's role in Modern Investigations https://www.magnetforensics.com/blog/beyond-the-badge-ais-role-in-modern-investigations/ LUMYX https://lumyx.com/ LEAPPs leapps.org How to make LAVA Compliant LEAPP Artifacts https://www.linkedin.com/video/live/urn:li:ugcPost:7356497708628520962/ UFADE  https://cp-df.com/en/blog/ufade_touch.html

    1 h 16 min

  7. 27/06/2025

    Techno, Timeline, and Training Truths

    Send a text We kick off this episode with highlights from the Techno Security Conference, our 80s-themed outfits, packed LEAPP labs, AI panel discussions, and great conversations with friends and colleagues across the field. We discuss Brett Shavers’ recent series on DFIR entry-level work, and share our thoughts on the need for better forensic training and clearer distinctions between forensics, cybersecurity, and incident response. We also talk about recent tool changes in the industry. Cellebrite’s acquisition of Corellium could make mobile app testing more accessible, and Magnet’s purchase of Dark Circuit Labs. We cover Harper Shaw’s Vehicle Network App, a valuable source of vehicle-related data. Alongside that, we highlight a recent blog on cached screenshots in Windows 11.  Be sure to check out the excellent “Parsing the Truth” podcast. Heather walks through her Easter road trip to test Android's Timeline feature (formerly Google Location History). The location data was impressively accurate, but also showed how easily some points can mislead without the right context. Catch us at IACIS Reno in January and check out the some of the resources we mentioned. Notes: Parsing the Truth: One Byte at a Time  https://parsingthetruth.com/ Cached Screenshots on Windows 11 https://thinkdfir.com/2025/06/13/cached-screenshots-on-windows-11/ The Vehicle Network App from Harper Shaw https://harpershaw.co.uk/the-vehicle-network-app-1 Beklkasoft CTF https://belkasoft.com/belkactf7/ Brett Shavers 6 part series https://www.linkedin.com/pulse/dfir-really-entry-level-brett-shavers-ewsvc/ https://www.dfir.training/new-to-dfir/dfir-career Artifact of the Week/Android Location History https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/

    1 h 6 min

  8. 16/05/2025

    Every Breath You Take, Every Swipe You Make—Your iPhone’s Logging It

    Send a text Apple devices are constantly recording user activity, yet few forensic examiners are making use of the vast amount of data these systems quietly generate. Apple's Unified Logs and Spotlight databases track nearly everything that happens on an iOS device, often without the user realizing it. Would you believe an iPhone can generate around 1.5 million log entries in just 15 minutes of regular use? These records include highly specific actions—such as the exact moment Face ID is used to unlock a device, when the phone is flipped face-up, or whether a user interacted with Siri or used the device manually. Despite their detail and reliability, these sources are often overlooked in mobile investigations. In this session, we’ll show how forensic practitioners can process and search these massive log sets using open-source tools. We’ll walk through examples of log entries that record actions like toggling airplane mode, launching specific apps like Facebook, or even detecting changes in device orientation. For investigators, this means direct, time-stamped evidence of how a device was used. One of the most valuable aspects of this data is its ability to help distinguish between user actions and automatic background processes. Was an app opened by the user, or was it a system event? These logs provide that level of clarity. We’ll demonstrate how to isolate specific events from millions of entries and construct accurate timelines that reflect exactly what happened—and when. As part of our ongoing work, we’re also focused on improving the accessibility and usability of these artifacts with incorporation into the LEAPPS. If you work with iOS devices, this is a session you won’t want to miss.  Notes: 2026 IACIS in Reno NV- https://www.iacis.com/training/reno-info/ Spotlight- https://github.com/ydkhatri/mac_apt Unified Logs- https://www.ios-unifiedlogs.com/ https://github.com/abrignoni/iLEAPP

    1 h 15 min
Tout afficher (42)

À propos

A podcast by digital forensics examiners for digital forensics examiners. Hear about the latest news in digital forensics and learn from researcher interviews with field memes sprinkled in.

Informations

  • Création
    Heather Charpentier & Alexis "Brigs" Brignoni
  • Années d’activité
    2023 - 2026
  • Épisodes
    42
  • Classification
    Tous publics
  • Copyright
    © 2026 Digital Forensics Now Podcast
  • Site web de l’émission
    Digital Forensics Now

Vous aimeriez peut‑être aussi