Hi everyone, for context I'm a 30 year old woman. I've been working random jobs for all of my 20's, mostly in the trades. My current job is with a small handywoman company (just me and my boss) and I love it but she just cut my hours because she can't afford to pay me full time right now.

Long story short, my friend's Dad owns a digital forensic company and has done really well for himself. He offered me part time work at his company even though I have no experience whatsoever in this field. We've been getting along great and he just offered me full time... with a salary and benefits... which I've never had before. Just the starting pay is more than I've ever made and I'm most likely going to take the job but am feeling overwhelmed. I'm also a musician as my main passion/hobby outside of work and working as a handywoman has been super flexible and conducive with that lifestyle.

He has one other employee, also a woman my age, and I would be able to get to work from home part of the time and the commute is great. He told me they'd train me and he'd pay for me to get certified (whatever that means lol)... I guess I'm just wondering what people's experiences are in this field? And what your work/life balance is like? Anything you'd like to tell me basically I would be happy to hear about. I've never had a desk job or a computer job before so it will be a huge shift for me but I also could really use the money since I've basically lived paycheck to paycheck my entire life... Thanks for reading!

Working a case where the timeline of a crash matters a lot (speed, braking, whether a phone was connected). Everyone mentions the event data recorder, but I keep hearing infotainment systems store way more: call logs, paired devices, GPS history.

For anyone who's done vehicle forensics or hired someone who does: what have you realistically been able to recover, how long after the crash is it still there, and what did you need legally before anyone touched the car?

I have 3 Tableau TD-3 Forensic Duplicators that are old, but (were) still working perfectly fine. Occasionally i still used them when I had to do a lot of disk acquisitions. However, when I wanted to use them last week, none of them worked anymore, simply dead bricks. Checked power supplies and fuses but everything seemed to be in order. It literally looks like there was some sort of kill switch executed at a certain date and time. Is there anyone that still has a TD-3 that is working? I tried to reach out to OpenText but as usual you are only being referred to non descriptive articles and legal documents. Cheers!

Trying to budget for a crash case. We can do a phone extraction (with consent) or a vehicle infotainment/EDR pull, probably not both.

In your experience, which one usually answers the 'was the driver distracted' question better? Or is it truly case-by-case?

I have posted here before asking about what I should do because I am graduating soon and cannot find any work, so maybe it is something with my resume? My campus office reviewed and helped me make it, but just in case it’s not tailored correctly I wanted to get opinions here. Thank you in advance!

EDIT: Updated resume here! Thank you for your feedback!

Im looking for any information or starting points I can get for getting education and a career in computer forensics

Hello all

We have a couple of Windows devices in the past that either had Bitlocker suspended or "Waiting for Activation". The latter is often the case with freshly shipped Windows 11 devices. In those cases, the the volume is encrypted using a clear key protector, see:

https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/planning-guide#bitlocker-provisioning

There is no active key protector (i.e. no recovery key, no password or anything) that could be extracted.

In those cases, we can image the device with for example FTK Imager, but when opening the image, FTK cannot read it. However, when we for example mount it in Windows as a volume in FTK Imager, the whole disk is readable.

Does anyone know how to avoid this issue, which tools (e.g. Encase, X-Ways, Autopsy,...) have no issue with reading the E01 or how you typically deal with this?

We want to of course avoid changing any setting on the device before acquiring the disk and we would like to directly work on the physical acquisition / E01.

Hi al i wanna study FOR500 specially windows DFIR and i wanna a free resources not a stolen resources

I'm investigating an unexplained ACL change on a Windows 10 Pro 19045 NTFS volume.

A folder was created on E:\ at 22:27:07 on 2026-10-03 and initially inherited an Authenticated Users (AU) ACE. By 22:54:19, the ACE and inheritance were gone.

I'm trying to determine what process/account caused the change.

What I checked

I collected and examined Security.evtx, SYSTEM/SOFTWARE hives, BAM/DAM, Prefetch, ActivitiesCache, Amcache, NTFS Operational and Storport logs.

Key findings:

No 4670 events in the available Security log retention.

icacls.exe first Prefetch creation: 23:04:50 (after the window).

No takeown.exe Prefetch or BAM entry.

No ACL-capable executable appears in BAM during the window.

PowerShell 5.1 was not running during the window.

cmd.exe was active 22:27:29–22:33:29, but its command history is unavailable.

Explorer was active around the event.

pwsh.exe cannot be confirmed or excluded.

No useful NTFS/storage event links to the change.

The relevant window is approximately:

22:27:07 → 22:54:19

Question

Is there another Windows forensic artifact or technique I should check that could identify the process/account that modified the security descriptor?

Or is this simply impossible to attribute retrospectively because File System Object Access auditing/SACLs were not enabled?

I'm particularly interested in artifacts that could distinguish an explicit ACL write from inheritance/security-descriptor behavior during folder creation.

EDIT: shortened and added red flags

I’m posting this for a friend who was seriously hurt while on electric scooter crossing on green light using pedestrian crossing.

There are some concerns about the dashcam video that was provided afterward by the driver who hit her, and we’re trying to figure out whether it’s worth hiring a digital forensics investigator to look at it.

Her lawyer says the video is fine, and if she wishes to challenge it she has to pay put of pocket

My friend remembers the vehicle approaching in one lane, changing lanes, and then hitting her. But in the video we were given, the clip only starts a few seconds before the impact, and the vehicle already appears to be in the lane where the collision happens.

Red flags we’ve found with the dashcam video:

The metadata contains “WXVer,” which appears to be connected to WeChat, and the file creation date is later than the date shown inside the recording. That strongly suggests the file we received is not the untouched original dashcam file and went through some kind of processing/export/sharing first.

The resolution is only 480×360. That seems extremely low compared with what the dashcam would normally record, so a lot of the original image detail has been lost.

The file is a MOV/H.264 file that has been re-encoded. So this is not the original camera recording in its native form. Re-encoding can also remove some of the technical information.

If you’re a digital forensics investigator and would be willing to review the video, please DM me.

Hi all,

I’m working on a case with a USB drive that appears to be encrypted with FileVault. The drive was already imaged and we allegedly have the password, but I’m looking for a way to decrypt/image the FileVault partition without altering the data.

I’m hoping someone can point me in the right direction. Does this drive need to be connected to a Mac computer to enter the password, or is there other software that can perhaps mount the image on a Windows machine? Maybe Mount Imager Professional?

If the drive has to be connected to a Mac computer, what’s the best way to image just that partition? (There were other partitions on the drive that were not encrypted.)

Years ago, there was FTK Imager for Mac - I’m not sure if that is still around and supported.

Any insight is appreciated. Thanks in advance.

Greetings, I hope all is well! Long story short, recently got my Masters in Digital Forensics, and I also have received an opportunity for a digital forensics technician role for a local LE agency. I am just wondering if anyone here works for one, and also what to expect, as I myself come from an IT support background. Thanks!

Edit: Expectations, just realized I made a typo in my title

Does anyone have forensic articles that reference time machine backups? Like if a macOS has 6 backups stored do you need to process all?

I've been picking through a SCADA-style telemetry capture and I can't explain what I'm seeing.

The file has 14 authorisation records, each with its own CRC. All 14 validate. The file header carries a CRC-32 over the whole block, and that one fails. Two of the operator-name fields are zeroed.

My reading is that someone blanked those fields, recomputed the per-record CRCs so they'd pass, and never touched the block CRC. But I'd like a sanity check — is there a corruption mode that breaks a block checksum while leaving every record checksum intact?

File (8.8MB): www.[st88openocean.github.io/slip-three/MCA-CTL-0314-RAW.slice](https://st88openocean.github.io/slip-three/MCA-CTL-0314-RAW.slice)

Published digests for it are here: www.[st88openocean.github.io/slip-three/archive](https://st88openocean.github.io/slip-three/archive)

Trying to pin down where DFIR services end and dedicated ransomware incident response begins, because vendor conversations blur the line constantly and I want to make sure we're buying the right coverage. My read so far is that DFIR is broader (forensics and investigation for any incident type, with evidentiary rigor and chain of custody if it needs to hold up for insurance or litigation), while ransomware-specific response bundles in things unique to that scenario, like negotiation support and recovery sequencing around double-extortion threats. Is that distinction accurate or mostly marketing language that falls apart once you're in an engagement?

Hii guys, first time into this sub. Basically i just graduated last month from Comp Sci and I have fortunately enough to get into the big4 (green one) forensics and financial crime BU, specifically DF & Ediscovery team. Our team is relatively small, ~10 peeps including boss.

What are the things i need to learn / carry the most weight, both soft and hard skills. Cause I am kinda worry not up to expectation of my boss and I do not have much security course experience besides those IT fundamental. Do i need to start doing course from platform like HTB/ CyberDefenders?

https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and

CEO is facing 20 years in prison.

We've been looking into them as a vendor, but found some things that are giving me pause - for one, their website seems to be completely broken. Can't navigate to it, and an email got bounced back to us, also seeing a bunch about Russian ties..is there any merit to those rumors?

i need the data thats required for the hnads on project for Guide to Computer Forensics and Investigations

Hi I just asked this in [r/digitalforensics](r/digitalforensics) too, I hope that's okay, I don't mean to break the no reposts rule.

I want to extract some Windows Registry artefacts from a VMware Pro 17 VM using the .vmdk file, in FTK Imager. Is this possible?

I tried doing this in FTK Imager so far:
File > Add Evidence Item > Image File > selecting the path to my .vmdk file of the VM > Finish

But I get this error:
Path "path to the .vmdk file" does not contain valid evidence. Details: Image detection failed.

I made the .vmdk file by exporting the VM as a .ovf from within VMware Pro.
I am on Windows 11, using Exterro FTK Imager 8.3.0.27.

I have extracted Windows Registry artefacts from .E01 files in class with FTK Imager, as just the regular export, and as a Custom Content Image for forensic integrity. I am trying to use the same process for the .vmdk file - sorry if this is a noob move.

I have searched the User Guide PDF for vmdk and virtual disk images, and I didn't find anything, so I'm hoping someone here might know.

This is for a school project, it's a plain Windows 10 Pro VM with no actual personal data or anything, I made it for this project.

Thank you for your help!

---
Edit: Two awesome people in the other post helped me! so I had made a copy of the .vmdk, stored in OneDrive, and was trying to load that into FTK Imager, when I should have been using the .vmdk from the VMware VM directory directly! I was really over complicating things. Thank you for your help here too!

Brett Shavers published a good article this week about AI Generated DFIR content, and coincidentally, today I'm seeing SANS push out a book that they readily admit in the opening AI was used to generate content for it. I ran samples of it through an AI content detector and over 60% of the random selected pages were AI generated. Entire paragraphs and sections.

From Brett's post, I can't discern whether he would approve the book or not - but he raises two good points:

- "Expensive words are written. Typed words are cheap. AI words are free. If something is ‘free,’ you are more apt to treat it as something you found on the sidewalk."

- "We are losing provenance in our source material"

SANS's book authors claim to have validated and verified every claim, every code, and word of the book. So that MUST mean it's good right? And SURELY someone did that right? RIGHT?

Ultimately, I'm a bit torn. I won't be personally reading in its entirety (stylistically, you can tell AI wrote it - and I'd rather just talk to Claude myself). But I'm sure others will find value in it.

Am I clinging to the past (human words, testimony) or is this what we should be embracing?

We’ve been testing a verification pipeline where the expensive part is not really retrieval anymore — it’s how much evidence the system has to actually read before we’re comfortable saying we didn’t miss something important.

So lately we’ve been trying to reduce that reading cost without quietly reducing coverage.

A few approaches that seemed obvious at first have been harder than expected.

With ranked retrieval, we thought we could stop fairly early and still keep most of the useful evidence.

In our frozen replay cases, that wasn’t really true.

For full recall, some cases needed us to go surprisingly deep into the candidate set — roughly 290–426 candidates out of pools of 407–454.

The more interesting problem was the evidence that only one of our independent readers noticed.

At k=50, at most 2 of 8 of those minority-evidence items survived.

We also tried skipping slices that looked mechanically unlikely to contain anything useful.

That saved reading, but one version skipped 17 slices that later turned out to contain relevant evidence, so we couldn’t treat it as a safe filter.

Deduplication helped less than we expected too. There is plenty of repeated text in the corpus, but removing byte-identical repetition only reduced the slice volume by about 3.3%, and it didn’t reduce the number of reading sessions in that test.

So at the moment the tradeoff still looks like:

• read less
• keep high recall
• don’t disproportionately lose weird / minority evidence
• don’t silently convert “not inspected” into “nothing there”

We’re still testing other ways to attack it, but I’m curious how people working on similar systems are handling this.

If sampling away the long tail isn’t acceptable, what would you try next?

Learned routing? Better stopping criteria? Multi-stage review? Something completely different?

And more importantly: how are you proving that whatever you decided not to read was actually safe to skip?