Articles
Practical reading for digital investigators, from the community, our sponsors and the wider industry.
Before You Acquire Everything: On-Scene Device Triage with Preview Mode
ADF PRO Preview Mode lets examiners review mobile data while collection is still underway—helping teams make faster on-scene decisions, prioritize relevant devices, and reduce forensic backlogs.ADF Solutions
Hub ArticleDeleted Doesn’t Mean Gone: What 2026 Research Reveals About Mobile Anti-Forensics
Mobile anti-forensics can make evidence harder to see without fully removing it. A major 2026 review identifies where residual traces persist—and how examiners can build a more complete, defensible analysis.
Kevin DeLong · Aug 22, 2026The Machine Found It. Should You Trust It?
AI can help digital investigators move faster through overwhelming evidence volumes.
Kevin DeLong · May 5, 2026
Hub ArticleHow to Triage from a USB Device: Boot and Live Scan Computers
How to Triage from a USB Device: Boot and Live Scan Computers
ADF Solutions · Feb 10, 2026
Hub ArticleHow to Master Triage For Your Forensic Investigations
How to Master Triage For Your Forensic Investigations
ADF Solutions · Jan 28, 2026
Hub ArticleWhat’s New? ADF PRO v6.2.0 Features and Enhancements
What’s New? ADF PRO v6.2.0 Features and Enhancements
ADF Solutions · Jan 23, 2026
Hub ArticleWhy Digital Forensic Triage Matters: A Cost-Benefit Analysis from the Field
Independent data underscores the sheer scale and evolving nature of online child sexual abuse, and it’s precisely why agencies are embracing triage-first workflows
ADF Solutions · Jan 16, 2026
Hub ArticleThe Field Investigator's Challenge: Why Traditional Digital Forensics Equipment Falls Short
Digital forensic investigators face a complex web of challenges when conducting field investigations. Understanding these problems—and their solutions—can mean the difference between a successful evidence collection and a compromised case.
MediaClone · Sep 30, 2025
Hub ArticleMediaClone IT Cloning and Duplication – Essential Tools for Managing Forensic Servers
Maintaining and upgrading forensic servers is a critical yet complex task. These servers are responsible for handling massive volumes of digital evidence, and any disruption in performance or data integrity can significantly hinder investigative operations.
MediaClone · Jul 25, 2025
Hub ArticleHow to Overcome the Backlog of Evidence Media in Your Digital Forensic Lab
The backlog for processing evidence media in digital forensic labs is a persistent challenge. Discover how to overcome these challenges and what to look for in a high volume forensic imaging solution.
MediaClone · Jun 19, 2025
Hub ArticleForensic Shoe Print Documentation and Analysis with Amped FIVE
Shoeprints are among the most revealing forensic evidence. They may not stand in the spotlight like fingerprints or DNA, yet they’re just as crucial, and often among the first evidence collected.
Amped Software · Jun 17, 2025
Hub ArticleReducing Enterprise Costs with SaaS-based Digital Forensics Solutions
Data breaches, malware infections, ransomware, unauthorized access to critical systems, and similar incidents against organizations have surged dramatically in recent years. Discover how SaaS-based digital forensics solutions are changing the DFIR landscape.
Magnet Forensics · May 28, 2025
Hub ArticleForensic Fingerprint Analysis: Advanced Techniques with Amped FIVE
Discover how forensic fingerprint analysis reaches new levels of clarity and precision with Amped FIVE. This article explores advanced techniques for enhancing, preserving, and presenting fingerprint evidence, even in complex cases involving difficult surfaces or lighting conditions.
Amped Software · May 20, 2025
Hub ArticleErase Data from NVMe SSD
In digital forensics and data security, securely non-retrieval erasing data from digital storage devices is paramount. Learn how to overcome common challenges of erasing data from NVMe SSD in forensic and data security applications.
MediaClone · May 15, 2025
Hub ArticleNative File Format: A Must for Social Media Evidence
In legal investigations, screenshots of social media content might seem like a quick solution—but they often fall short. Discover why preserving online evidence in native file format is essential in social media and open-source intelligence.
SMI Aware · May 1, 2025
Hub ArticlePortable, Rugged Digital Forensic Lab
When a forensic investigator needs to perform a full, on-site investigation, they need to consider a few preparations and constraints. Here are the most important things to look for in a portable forensic imager.
MediaClone · Apr 17, 2025
Hub ArticleHow to Get Social Media Evidence Admitted Into Court
Admitting social media and deep web findings into evidence is not difficult, but it does require ethical considerations and prompt action. Here's what you need to ensure you have to get social media evidence admitted into court.
SMI Aware · Feb 28, 2025
Hub ArticleTick-Tock: The Clock is ticking on TikTok Ban
TikTok's potential U.S. ban could go into effect by January 19, 2025. ByteDance must divest or face app removal, but what does that mean for the content collection & preservation of TikTok data in your investigations?
SMI Aware · Jan 17, 2025
Hub ArticleEmbracing AI for a Safer Future: Revolutionising Law Enforcement with Advanced Technology
Dr. Liam Owens, Founder and CEO of Stafford-England-based Semantics 21, explores how artificial intelligence is changing the face of law enforcement.
Dr. Liam Owens · Jun 26, 2024
Hub ArticleNavigating SEC Regulations In Cybersecurity And Incident Response
As 2024 approaches, we all know how vital it is to keep up to date with regulatory changes that affect our work. We get it – it’s a lot to juggle, especially when you’re in the trenches working on an investigation, handling, and responding to incidents.
Binalyze · Dec 21, 2023
Hub ArticleBFU – Seeing is Believing
This is the common reaction; a device needs extracting, and you find it in a BFU state. According to other vendors, your options are now limited. Even if you do get an extraction, it will only acquire basic information. BFU means the data is encrypted and secured.
Adam Firman · Dec 18, 2023
Hub ArticleMediaTek: A Short Story
Access to MediaTek’s Boot ROM interface is the best way to extract the maximum amount of data from any device with a MediaTek chipset. The Boot ROM is always there, and it will not change. Because of this, we do not have to worry about different vendors, firmware, or security patches. It just works.
Adam Firman · Oct 30, 2023
Hub ArticleCell Site Analysis: Capturing a Snapshot of the Cellular Network’s Coverage
When crime scene or accident investigators examine a location, they take all the necessary measures to accurately collect, record and document the environment and characteristics, so as to have the best chance of accurately determining what happened, or to build on clues in pursuit of the truth.
Bill Teel · Apr 4, 2023
Hub ArticleFuture-Proof Your Cyber Career
Cyber moves fast, so staying on top of everything can be difficult to impossible at times. So, to effectively future-proof your cyber career, you can do some or all of the following things. Doing so will ensure you stay ahead of the curve without wasting time looking in the wrong direction.
Greg Kipper · Mar 23, 2023
Hub Article3 Ways Programming Skills Can Help You Succeed in DFIR
I often come across this topic among those interested in digital forensics and incident response (DFIR). People seem to ask the same question – “Do I need to learn how to code?” – as if it’s a dreaded task. While you don’t have to be an expert coder in order to have a successful career in DFIR, having some programming knowledge can help you excel.
Matt Danner · Mar 1, 2023
Hub ArticleElevated Speed Performance with the Samsung 990 Pro
Non-Volatile Memory (NVMe) storage, which Wikipedia defines as a type of computer memory that can retain stored information even after power is removed, was developed in 2009. In comparison, volatile memory requires constant power to keep data. NVMe SSDs offer the advantage of running quickly through the PCIe Bus on the Motherboard.
Bitmindz · Feb 7, 2023
Hub ArticleTips, Tools and Techniques for Using Open Sources in Threat Intelligence
Open-source intelligence doesn’t just refer to the accessibility of information. OSINT is the practice of collecting information from publicly available sources that is widely used by analysts in nearly every type of organization — from government and law enforcement to financial crime analysts, fraud and brand misuse investigations, and particularly cybersecurity.
Jeff Phillips · Dec 12, 2022
Hub ArticleThe Rise of LokiNet
Over the past few years, we’ve witnessed the advent of cryptocurrency and blockchain technology become the technological paragon and consequently, an investment zeitgeist. While you will find many polarizing views on cryptocurrency, you will find few (if any) naysayers or neophobic attitudes towards blockchain technology.
Keven Hendricks · Dec 11, 2022
Hub ArticleHow Managed Attribution Empowers Online Researchers
Chances are, anyone involved in online research – cybersecurity specialists, fraud and brand misuse analysts, law enforcement investigators – has heard of the concept of managing attribution in order to stay safe and anonymous online.
Jeff Phillips · Dec 8, 2022
Hub ArticleWhy and How You Should Include the Dark Web in Your Research
The dark web is an area of the internet that’s not accessible using regular commercial browsers. It is most notoriously known for the illegal activity it facilitates. However, for online investigators, the dark web can be a tremendous resource for gathering information, researching their adversaries and following up on threat indicators.
Jeff Phillips · Nov 9, 2022
Hub ArticleTop Online Tools for Law Enforcement Investigations
Federal and local law enforcement agencies have dedicated divisions for fighting cybercrime, and naturally, most of their time is spent browsing the internet — gathering intelligence on cyber terrorists, investigating computer-based crimes, and following up on reports of fraud, hacks and stolen data.
Jeff Phillips · Nov 2, 2022
Hub ArticleWeb3 – The Old Colossus?
Why do I say that the advent of “Web3” is the Old Colossus? Simply because, nobody knows for certain what “Web3” is going to truly be at this juncture. You will not find somebody alive today who has seen the Colossus of Rhodes, and you will certainly not find somebody today who can tell you how (and when) “Web3” will become commonplace for the world wide web as we know it.
Keven Hendricks · Aug 20, 2022
Hub ArticleHow to Use ExifTool to Look at Metadata
Today, we’ll discuss a very well known tool written by Phil Harvey. ExifTool is an extensively used tool to look at metadata from various types of files. It supports reading metadata from common file formats such as GPS, image files from many different digital cameras, video files, Microsoft Office files and many more. It’s freely available and can be downloaded from www.exiftool.org.
ArcPoint Forensics · Jun 21, 2022
Hub ArticleCryptocurrency – The Final OSINT Frontier?
Unless you have been living under a proverbial rock for the past few years, you have undoubtedly heard about cryptocurrencies. Whether its Bitcoin, blockchain, NFTs…it is safe to say that cryptocurrency isn’t going anywhere, and will likely continue to assimilate into our daily lives
Keven Hendricks · Jun 17, 2022
Hub ArticleHow to Get Started in the Field of Digital Forensics
When you think of different career paths in the field of cyber you might not always notice the field of digital forensics. However, if you have a passion for all things digital and keen attention to detail, this field could be the perfect place for you where a job is not to work, but something you enjoy. Many people might also explore this field as an option after retiring from a career in the military or law enforcement and want to start a “second life”. No matter where you come from, you will need some specific strengths and skill sets to be successful in the field.
Amber Schroader · Apr 23, 2022
Hub ArticleUnderstanding Tox Chat
Over the past several years, there has been an evolution in end-to-end encryption (the acronym E2EE for short) messaging services. “WhatsApp”, undoubtably the most popular and most utilized E2EE service in the world (estimated 2 billion users), was acquired by Meta (Facebook) over 7 years ago. Second to “WhatsApp”, the E2EE messaging platform “Telegram” has over 800 million users. It would be safe to deduce that privacy oriented communication has become a staple for the world today.
Keven Hendricks · Apr 19, 2022
Hub ArticleDark Web Investigations and I2P
Before we had the popularity of Meta’s Facebook messenger and end-to-end encryption apps like Telegram, there was AOL Instant Messenger (AIM for short). AIM was brilliant, and from my high school to college years, it was the preferred method of staying in touch with my friends. With the success of AIM, there were competitors: Yahoo Messenger and MS Messenger, and while not comparative in the popularity of AIM (here in the United States at least), both services had their own features which set them apart.
Keven Hendricks · Mar 25, 2022
Hub ArticleExpectations of Facebook Data
As social media continues to rise so does the power of Facebook. If you are not on it personally you are for your business or to connect with people on a hobby. That being part of the Meta universe has become as essential as getting a driver’s license. So, what does this mean in the world of digital investigations? It means there is always a good snippet of data waiting for you that is going to help you get just a little more perspective on an individual’s digital fingerprint.
Amber Schroader · Mar 11, 2022
Hub ArticleEMI Shielding and Why You Need It
The topic of Physics may not be the first thing that comes to mind when you think of digital forensics, but it does play a key role in the preservation of your digital evidence. Not every organization is lucky enough to have their lab so isolated that they get no issues with signals that could potentially risk their digital evidence. This is where physics and the role of EMI shielding, or the use of Faraday technology, come into play.
Amber Schroader · Feb 23, 2022
Hub ArticleWorking with Virtual Machines
Throughout the course of investigations, you run into individuals who have all types of technical backgrounds. For times when you have to look at evidence from a more technically savvy user, you may run into virtual machines installed on the machine. Virtual machines are separate instances of an operating system that you can run virtually.
ArcPoint Forensics · Feb 10, 2022
Hub ArticleRooting Microsoft Surface Duo
The Microsoft Surface Duo launched on September 10th, 2020. Instead of using Windows Phone OS, Microsoft decided to switch it up on everyone and introduced the Microsoft Surface Duo; a device that was built on Android
ArcPoint Forensics · Jan 15, 2022
Hub ArticleInvestigating and Capturing Google Data
There are so few people on the planet now that don’t have something to do with Google. With parents selecting Gmail accounts for their kids prior to being born to the proliferation of Google in the classroom the searching giant is everywhere. With this level of distribution also comes the value of the Google data in an investigation.
Amber Schroader · Dec 9, 2021
Hub ArticleAndroid Viber Forensics
Viber is a cross-platform VoIP and instant messaging application distributed across multiple mobile and PC platforms, including Android, iOS, Microsoft Windows, macOS, and Linux. There are over 1.1 billion Viber users worldwide and more than 820 million monthly active users.
Nov 23, 2021
Hub ArticleJailbreaking iOS Devices for Testing
When looking at digital evidence, forensic examiners want as much data as possible. This can be particularly tricky when working with an iOS device. Apple has these devices pretty locked down and can make it difficult to retrieve any data. If you have the passcode to the device, you can create a regular backup which will give you a lot of data.
ArcPoint Forensics · Nov 13, 2021
Hub ArticleMedia Files Forensics
The modern Internet is all about media. Suppose you look at any list of the most popular apps. All of them are somehow connected to media: TikTok featuring short videos, Instagram showing you photos, or YouTube, where you can watch films, podcasts and listen to music.
Belkasoft · Nov 12, 2021
Hub ArticleGoogle Drive Evidence You Should Know About
As the world continues to adopt the use of cloud storage and make it a part of everyday use in personal and professional settings, you should be aware of the forensic artifacts and logs available for review. In this article I’ll cover the forensic data you can review for Google Drive.
Matt Danner · Nov 10, 2021
Hub ArticleInstalling Autopsy on macOS Big Sur
Many forensic examiners and investigators are used to having resources at their place of employment to work cases. We believe the learning process never stops and no one can be an expert in everything. Therefore we have to use the resources we have at our disposal and when we’re away from work, we may not have the computer forensic towers or dongles needed to run software. Autopsy is an open source forensic software that’s built on the Sleuthkit that is amazing for what it does at its price point (free).
ArcPoint Forensics · Nov 3, 2021
Hub ArticleUsing Traditional Forensic Tools in an OSINT Environment
What do you do when you want to perform an investigation, but don’t have any media? At times I have wanted to connect the dots, disprove theories, or just view things from different angles. Stuff that’s easy to do when you have media like phones or hard drives and an analytical tool like Truxton. But, if all you have are sites on the web, what is a resourceful OSINT investigator to do?
Oct 20, 2021