#digitalforensics

@abrignoni@infosec.exchange · Aug 05, 2026

📱 New: Telegram support across both LEAPPs, plus a reference nobody had published. Fifteen artifacts. Six for iOS in iLEAPP, nine for Android in ALEAPP, which had no Telegram support at all before this. Thanks Geraldine Blay for the questions that spurred all this research and development. ⚙️ The settings. Auto download stored per network type and per chat category, plus Save to Photos and Save to Gallery. These are what answer whether a photo ever reached the device gallery, which the message record cannot tell you. ⚠️ The warning that matters most: Telegram writes no settings record until the user changes something. No key in the database does not mean "off," it means the app default applied. A tool that prints "off" there is inventing evidence. Ours distinguishes the two states explicitly. 📖 The system events reference. The two clients name the same events differently, and only 27 of roughly 70 pair by name. So: 64 iOS types, 68 Android types, 62 paired, every row linking to the defining line in Telegram's own source, pinned to a commit. Printable PDF included. Also documented: our own gaps. Five capabilities we could not validate against real data, listed in the post, with a request for research images. Blogpost: leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage Telegram Events Reference Documentation: leapps.org/blog-post?post=2026-08-04-telegram-system-events-reference #DFIR #DigitalForensics #MobileForensics #LEAPPs #ILEAPP #ALEAPP

0

kennethbspringer.au @kennethspringer@infosec.exchange · Aug 04, 2026

1930s fraud-detection mathematics, still working today — just aimed at a target it was never built for. Challenge: catch an AI-generated JPEG using nothing but a 1938 statistical law. No neural network involved. Benford's Law: in real-world numerical data, the leading digit isn't uniformly distributed — 1 shows up ~30% of the time, 9 under 5%. Holds for river lengths, electricity bills, physical constants... and, it turns out, for the AC coefficients in a JPEG's DCT blocks, if the image actually came from a capture-and-compress pipeline. I run this as one of six checks in snapWONDERS' analyse pipeline: 8×8 DCT on every block, absolute value of the AC coefficients (DC term excluded — it doesn't follow Benford), leading digit extracted, binned against the classic log10(1 + 1/d) curve, then a chi-squared goodness-of-fit test. Above threshold, it's flagged. It's not a standalone verdict — heavy resampling or repeated re-saves can trip it too, same as a genuinely synthetic image would. So it feeds a combined score alongside five other signals rather than deciding anything alone. But as a zero-training, zero-black-box check, it's a genuinely satisfying one: an accounting fraud-detection tool from 1938 has something real to say about whether a photo actually came out of a camera. Full technical breakdown (with the formula) → https://kennethbspringer.au/2026/08/05/benfords-law-detecting-ai-generated-images-without-ai/?utm_source=mastodon&utm_medium=social&utm_campaign=article-16 #digitalforensics #OSINT #infosec #aiimages #deepfake #snapWONDERS

22

0

19

0

The DFIR Report @TheDFIRReport@infosec.exchange · Aug 04, 2026

EtherRAT brought blockchain-backed C2 into this intrusion. A malicious MSI masquerading as Sysinternals RAMMap deployed EtherRAT, which used EtherHiding to retrieve Ethereum-hosted C2 config updates before pivoting to TryCloudflare infrastructure. Full report: https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/ #DFIR #ThreatIntel #DigitalForensics

0

Alexis Brignoni

@abrignoni@infosec.exchange · Jul 29, 2026

Apple Unified Logs are no longer an edge-case data source. 🔒 Lock/unlock activity 📱 App launches 📶 Connectivity changes 📸 Screenshots 🧭 Navigation My updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite. Article + printable guide: https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs #DFIR #iOSForensics #DigitalForensics #iLEAPP

0

Alonso Caballero / ReYDeS @Alonso_ReYDeS@infosec.exchange · Jul 29, 2026

🕵️‍♀️ Hoy Miércoles 29 de Julio a las 8:00 pm (UTC -05:00) iniciamos el Curso Autopsy Digital Forensics 2026 🐕 🥇 Miércoles 29 y Viernes 31 de Julio ✨ De 8:00 pm a 11:00 pm (UTC -05:00) 📲 WhatsApp: https://wa.me/51949304030 🌎 Información: https://www.reydes.com/e/Curso_Forense_de_Autopsy #DFIR #DigitalForensics #CyberInvestigation #CyberCrime #CyberSecurity #Malware #IncidentResponse

0

Alonso Caballero / ReYDeS @Alonso_ReYDeS@infosec.exchange · Jul 28, 2026

🌞 Mañana miércoles 29 de julio iniciamos el Curso Autopsy Digital Forensics 2026 📆 Miércoles 29 y Viernes 31 de Julio ⏰ De 8:00 pm a 11:00 pm (UTC -05:00) 📲 WhatsApp: https://wa.me/51949304030 🌎 Info: https://www.reydes.com/archivos/cursos/Curso_Autopsy.pdf #digitalforensics #datarecovery #forensics #computerforensics #forensicinvestigator #forensicinvestigation #forensicscience #dfir

0

hasamba @hasamba@infosec.exchange · Jul 28, 2026

🚨 Incident Response: Unifying Detection Engineering and Digital Forensics with Velociraptor

A new research paper proposes a unified detection-forensics methodology using Velociraptor, bridging the gap between real-time alerting and traditional forensic analysis. The core concept is that detection logic directly initiates targeted evidence acquisition at the point of detection, rather than operating in parallel.

The paper introduces a four-stage methodology to convert artefact knowledge into reusable and testable detection rules suitable for both post-incident triage and live monitoring:

Baseline establishment
Evidence correlation
Attack chain analysis
Scenario labelling with confidence

The researchers demonstrate this approach using three Velociraptor BaseVQL log sources: forensics/windows/prefetch, forensics/windows/usn, and /windows/wmi. They show that artefact-based detections enable scalable forensic triage without the need for full disk acquisition. Additionally, periodic artefact analysis offers continuous monitoring while substantially reducing data volume compared to conventional endpoint logging.

Two case studies illustrate the practical application:

First, a Prefetch and USN baseline for triage when Windows Event Logs are cleared or unavailable. Attackers routinely disable or clear volatile log sources (MITRE ATT&CK T1070.001). Relying on these logs for SIEM-based detection creates a single point of failure. By establishing baselines with Prefetch and USN Journal data, responders can reconstruct past activity even when standard logging mechanisms are compromised.

Second, a WMI persistence correlation that supports both triage and continuous monitoring through periodic artefact analysis. Windows Management Instrumentation (WMI) is a common technique for maintaining persistence. Correlating WMI artefacts allows defenders to detect these mechanisms without relying solely on real-time event forwarding.

The implications of this methodology are significant for SOCs and IR teams. By shifting some detection logic to endpoint artefacts rather than exclusively forwarding volatile logs to a SIEM, organizations can maintain visibility even when attackers attempt to cover their tracks. This approach also addresses the data volume problem that plagues many SIEM deployments, as periodic artefact collection is more efficient than continuous event logging.

For practitioners, the paper provides deployable BaseVQL queries that can be used immediately. The integration of detection engineering with forensic artefacts provides a more resilient detection strategy.

🔹 DFIR #Velociraptor #DetectionEngineering #DigitalForensics #IncidentResponse

🔗 Source: https://arxiv.org/html/2606.28812v1

0

Alonso Caballero / ReYDeS @Alonso_ReYDeS@infosec.exchange · Jul 27, 2026

🔍 Aprende a rastrear datos eliminados 💾 y reconstruir evidencia digital con Autopsy 📍 ☠️ Curso Autopsy Digital Forensics 2026 🥇 Miércoles 29 y Viernes 31 de Julio ✨ De 8:00 pm a 11:00 pm (UTC -05:00) 📲 WhatsApp: https://wa.me/51949304030 🌎 Info: https://www.reydes.com/e/Curso_Forense_de_Autopsy #DFIR #DigitalForensics #CyberInvestigation #CyberCrime #CyberSecurity #Malware #IncidentResponse

0

Alexis Brignoni

@abrignoni@infosec.exchange · Jul 27, 2026

🚀 iLEAPP v2026.2.1 is out! The Biome rabbit hole keeps going deeper. This release adds 60+ new Biome streams: 🔋 Device power and lock state 📍 Location visits and app location activity 📸 Camera AutoFocus ROI ⚡ Energy mode and boot sessions 🚨 Emergency voice calls 😀 Emoji engagement 🧠 A full Apple Intelligence family, including Safety Overrides Several of those came out of research by the awesome Mattia Epifani. Thank you Mattia! Also in this release: 💬 Signal for iOS: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories 🔑 Expanded keychain handling: examiner-supplied keychains, a pure Python SQLCipher reader, UFED encrypted keychain dumps, and reuse of a keychain already carried by the extraction 🔔 Notifications overhaul: attachments checked in as media, embedded payload images recovered, payload fields split into their own columns, and notifications no longer reported three times over Plus fixes for addressBook column pruning, a MemoryError during HTML report generation, several Timeline issues, and an SMS rendering crash. Welcome to four first-time contributors: CynthiavDorp, JSap0914, Sanjays2402, and sandrzejewskipl! 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

0

Alonso Caballero / ReYDeS @Alonso_ReYDeS@infosec.exchange · Jul 27, 2026

📈 El requerimiento de profesionales forenses crece 🔍 conoce todas las capacidades de Autopsy 🛡️ ☠️ Curso Autopsy Digital Forensics 2026 🥇 Miércoles 29 y Viernes 31 de Julio ✨ De 8:00 pm a 11:00 pm (UTC -05:00) 📲 WhatsApp: https://wa.me/51949304030 🌎 Info: https://www.reydes.com/archivos/cursos/Curso_Autopsy.pdf #DFIR #DigitalForensics #CyberInvestigation #CyberCrime #OSINT #CyberSecurity #BlueTeam #Malware #IncidentResponse

0

kennethbspringer.au @kennethspringer@infosec.exchange · Jul 21, 2026

Last week I wrote about how steganalysis catches naive embedding — comb patterns in pixel histograms, RS analysis asymmetry, the works. This week: what Vaultify does differently, and why "hide it well" is harder than it sounds. Naive tools embed the same amount of data into every pixel, uniformly — which is exactly the uniformity last week's detection methods key on. Vaultify runs an AI system that models how a person actually perceives an image — which parts a human eye would register a change in, and which it wouldn't — to decide how much each region can absorb. Then, separately: the payload gets encrypted first, and only the ciphertext gets embedded — a break of one layer doesn't hand over the other. No permanent claims about tomorrow's forensic research, just an honest one about resisting today's — the field doesn't stand still on either side. Full article details: https://kennethbspringer.au/2026/07/22/how-photo-steganography-works-and-how-we-push-vaultifys-limits/ #infosec #steganography #OSINT #digitalforensics

0

Alonso Caballero / ReYDeS @Alonso_ReYDeS@infosec.exchange · Jul 21, 2026

🎭 El 90% de los ciberatacantes se esconden en el tráfico legítimo 👁️ Aprende a desenmascarar sus técnicas 🌐 ⚓️ Curso Forense de Redes 2026 💡 Jueves 23, Martes 28, Jueves 30 Julio y Martes 4 Agosto 🏅 De 3:00 pm a 6:00 pm (UTC -05:00) ⚔️ WhatsApp: https://wa.me/51949304030 🎞️ Info: https://www.reydes.com/e/Curso_Forense_de_Redes #DigitalEvidence #DFIR #DigitalForensics #Malware #CyberSecurity #CyberCrime #OSINT

0

Alexis Brignoni

@abrignoni@infosec.exchange · Jul 16, 2026

New iLEAPP parser: the United Airlines iOS app! ✈️ New blog post from the awesome James Habben walking through the research: where the data lived, which rabbit holes were worth chasing, and which ones he left alone. 12 new artifacts in iLEAPP: 👤 Account profile 🧳 Saved travelers and trip passengers 🎫 Trips, boarding passes, and PNR documents 🔎 Booking and flight status searches 📋 Boarding status log 🎬 Inflight entertainment watch history ⌚ Watch complications 💬 iMessage recipients from the app's plugin cache The traveler/passenger split, the trip JSON mining, and that late-discovered iMessage plugin cache are the fun ones. Read the write-up, it shows the actual thinking, not just the results. Thank you James! 📖 Read it: https://leapps.org/blog-post?post=united-ios-app-artifacts 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

0

Alexis Brignoni

@abrignoni@infosec.exchange · Jul 16, 2026

Photos.sqlite in LAVA! 📸 The entire Photos.sqlite parser family in iLEAPP, 42 artifacts, is now converted to LAVA. A massive body of work from the awesome Scott Koenig, covering one of the richest sources of evidence on any iOS device. What it parses: 📷 Basic asset and album data 📍 Assets with valid locations ⭐ Favorites, hidden, trashed, and burst assets 🤖 GenAI-detected images 👥 People and detected faces 📤 Shared albums plus iCloud Shared Photo Library assets and contributors 🔗 iCloud shared links 🗂️ Asset internal resource data ⚙️ Camera, MediaAnalysis, and SlideShow plist configs 📱 Per-version reference tables from iOS 14 all the way through iOS 26 Standardized timestamps, guarded queries across iOS versions, and full LAVA output for every one. Here is why that matters. Photos.sqlite is data heavy. The old HTML report can choke and crash under that many rows. LAVA does not. It handles the volume and stays fast and filterable, exactly when you need it to. Huge thank you to Scott Koenig for the research and for keeping it current release after release. 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #DigitalForensics #iOS

0

kennethbspringer.au @kennethspringer@infosec.exchange · Jul 14, 2026

Your steganography tool says the image is clean. Here's what the chi-square test says. LSB replacement — the simplest and most common form of image steganography — leaves three separate statistical fingerprints: a comb pattern in pixel value pair histograms, a measurable shift toward true randomness in the LSB plane, and a broken correlation between the LSB and the rest of the image that real camera noise doesn't break. RS analysis turns the first two into a quantitative test — partition the image into pixel groups, measure local smoothness, flip the LSBs and measure again. Unmodified images hold a specific symmetry between the resulting group counts. Embedding breaks that symmetry in proportion to how much payload was hidden, which means RS analysis doesn't just detect presence — it estimates embedding rate. DCT-domain hiding (embedding inside JPEG's compressed frequency coefficients rather than raw pixels) is a harder target for spatial tests like RS analysis, but coefficient-histogram and calibration-based methods exist specifically for that domain. Harder to detect has never meant undetectable — every generation of "harder to catch" embedding gets a purpose-built detection method eventually. No single test proves presence or absence with certainty in either direction — noisy or heavily compressed images can trip a naive test into a false positive, and adaptive embedding can sit under one test's threshold. That's why real steganalysis combines multiple independent signals and reports confidence, not a binary verdict. snapWONDERS runs this as part of its forensic pipeline. Full breakdown: https://kennethbspringer.au/building-steganography-detection-statistical-analysis/?utm_source=mastodon&utm_medium=social&utm_campaign=article-12 #OSINT #digitalforensics #infosec #steganography

1

0

Alexis Brignoni

@abrignoni@infosec.exchange · Jul 14, 2026

New blog post: Be Careful What You Wish For. We are implementing AI in digital forensics wrong. Here is a new technology that works like a genie. You make a wish, the genie provides. Need a timeline? Ask the genie. A data source you don't understand? Ask the genie, it comes back parsed. What is not to like? Plenty, it turns out. For the last few weeks I have been using Claude extensively on the LEAPPs codebase, reviewing every single PR. That work taught me exactly what the genie can do, what it cannot, and what happens the moment you forget the difference. So I wrote it down. It is about wishes, monkey's paws, and the one thing the genie can never grant you. 📖 Read it: https://leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for #DFIR #MobileForensics #DigitalForensics #AI #FLOSS

0

kennethbspringer.au @kennethspringer@infosec.exchange · Jul 09, 2026

You've seen the little "cr" badge start showing up on images. Do you know what it actually proves — and what it doesn't? It's not a vibe check. It's a COSE-signed certificate chain sitting inside a JUMBF box in a JPEG's APP11 segment (or a PNG caBX chunk). The signature proves two things and only two: which tool or camera signed the manifest, and that the pixel data hasn't changed since. That's the entire guarantee. The digitalSourceType field inside that manifest is what tells LinkedIn's badge to say "AI-generated" instead of "camera capture" — trainedAlgorithmicMedia vs digitalCapture. LinkedIn reads it. X is rolling out the same read. Where it stops: no manifest, no proof either way. The chain says nothing about who the human behind the tool is, and most images in circulation still carry no manifest at all — that's normal, not suspicious. snapWONDERS validates the full chain on every upload — signature, hash binding, source type — and feeds it into the authenticity score. Full breakdown: https://kennethbspringer.au/2026/07/09/think-twice-before-claiming-ai-work-as-your-own-what-c2pa-content-credentials-prove/?utm_source=mastodon&utm_medium=social&utm_campaign=article-10 #OSINT #digitalforensics #infosec #C2PA #contentauthenticity

0

Cloud 🤖 @cloud@infosec.exchange · Jul 05, 2026

🤖 Gurugram, India: municipal employees faked attendance records using AI-edited photos and GPS spoofing. HR detected fraud through EXIF metadata analysis and location-log forensics. Source: ThePrint #GNSS #Spoofing #DigitalForensics #CyberSec

0

T.F.G. @TFG@social.linux.pizza · May 05, 2026

The last few days I was working on a case that made me thinking. Its about a 15yr old boy who was victim to bullying at school. He came up with the story that his bully accesses his (and his parents) devices (phones, laptops). Changing hostnames, in-/uninstalling apps, sending text messages from one device to the other and the like. Finally there was a death-threat in a text file on the laptop. My job was to prove or disprove the accusations. Of course all this was made up and not a single trace on the devices supported his claims. Quiet the opposite. It was easy to prove, he staged all himself. Unfortunately his parents are extreme no-tech people and believed their son every word how unlikely and not-technically-possilble his claims even were. But that's another story. But... what a hell must he have lived in to stage such a story. And if your kid comes up with some outrageous story ... there might be something behind, you should ask questions about. -- BTW: The boy changed the school in the meantime.. and like magic.. no more "hacker" harassing him. Stupid story, good ending. #digitalforensics #dfir #bullying

0

About This Hashtag

#digitalforensics

Related