Two new probes, and every probe now opens a window.

chromiumcacheprobe rebuilds the H.264 video Chrome caches on Android.

mediacarve carves images and video by signature.

All five ship a window beside the command line.
leapps.org/probes #DFIR

On October 21, join us for a webinar that will demonstrate how Magnet #Autokey provides fast access to encrypted vehicle data and helps investigators accelerate time-to-evidence with streamlined collaboration in Magnet #Review: https://ow.ly/92bG50ZY8Zg

#DFIR

Submissions are coming in for the 14th annual #Volatility #PluginContest! This is your chance to contribute to open source forensics, gain community-wide visibility for your work + win a cash prize!

See the contest details here: volatilityfoundation.org/the-14th-ann...

#dfir #memoryforensics

Confidence scores ≠ truth—validation & provenance matter in DFIR workflows. #DigitalForensics #AI #IncidentResponse #DFIR #AIgovernance #Cybersecurity https://thedailytechfeed.com/why-ai-confidence-doesnt-guarantee-truth-in-digital-forensics/

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

The Forensic Focus State of DFIR Survey is now open. Caseloads, AI, tools, hiring and the year ahead, in 8 minutes. It's anonymous, and everyone who takes part can get early access to the report. Closes 30 November. www.surveymonkey.com/r/S3G2BCF #DFIR

#DFIR folks: a signed launcher can hide an unsigned target. In our Autorunsc 14.3 tests, a change in launcher target resolution buried a real persistence entry. Check your workflows!

This is a potential regression from Autorunsc 14.2 and prior.

digitaldefenseinstitute.com/blog/autorun...

Volexity has discovered in-the-wild exploitation of a zero-day exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). The threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution.


#DFIR #threatintel

"EtherRAT used decentralized infrastructure for C2 resolution, querying Ethereum smart contracts through 1rpc[.]io to resolve its current C2 URL."

Read the full report:
https://
buff.ly/2MhA5Az

#DFIR #ThreatIntel

— from @TheDFIRReport (https://x.com/TheDFIRReport/status/2110010217685475531)

Hear from past #MagnetUserSummit attendees about their favorite moments, the lessons they've taken back, and why they believe it has become one of the premier events for #DigitalInvestigations professionals.

Learn more and register: magnetusersummit.com

#MUS2027 #DFIR

Fed Aether a custom PwnedTool script to automate CFG recovery during RE. The logic is nasty, but it nailed the control flow in one pass.

Who else is using it for binary analysis? #ReverseEngineering #DFIR

Building a toolkit for investigators.

I have curated a list of essential Digital Forensics Tools for investigation, data recovery, and security analysis.

133 Stars and growing.

Check it out here: github.com/yogsec/Digit...

#CyberSecurity #DFIR #Forensics #InfoSec #OpenSource #GitHub

Week 41 - 2026 #DFIR

thisweekin4n6.com/2026/10/11/w...

VLEAPP nearly doubled: 103 artifacts at the last release, 202 on main now. Ford SYNC, GM OnStar, GM Bosch HMI, Nissan 08IT, BMW MGU, SiriusXM and more.

Also: DLEAPP +65, iLEAPP +11, ALEAPP +9, and raw images can now offer free space and deleted files to artifacts.

leapps.org/releases#sec...

#DFIR

Dumplyzer is an open-source, local-first memory forensics platform for Windows x64. Processes, network connections, timeline, VAD regions, and reconstructed binaries, analyzed fully offline.

#tool #DFIR #memoryforensics https://github.com/EmadAbedini/Dumplyzer

Join @attrc.bsky.social, Volexity’s Director of Research, at #BSidesNYC on Oct 17 at 10AM ET (Blue Track). In “Finding Evil Fast: Windows Memory Triage with Volatility 3,” he'll share five automated checks for quickly finding malicious activity in Windows memory.


#memoryforensics #dfir #volatility

Catch Volexity’s Josh Duke at #BSidesNYC on Oct 17 at 5PM ET (Other Track). Josh will present “No Safe Harbor: OceanLotus and ROGUEHARBOR,” sharing details from a recent #OceanLotus campaign that used WhatsApp to target human rights organizations and deploy the ROGUEHARBOR RAT.


#dfir #threatintel

We crested over 250,000 page views on the Forensics StartMe page just recently. I'm incredibly grateful for the #DFIR community's support! startme.stark4n6.com

The production VMDK still exists in its normal datastore, but it no longer exists in the referenced path.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Pro-tip: Hunting malware in a PCAP? Don't carve packets manually. Hit File > Export Objects > HTTP/SMB to pull dropped payloads directly out of the stream in seconds.

#Wireshark #DFIR #InfoSec