Thanks to a DoJ funded project, Oklahoma State University and @Hexordia are excited to offer a FREE On Demand IoT Forensics - Analyzong Smart Devices course to US Law Enforcement. The course is now available!!! Please register here by Sept 30, 2025 for access bit.ly/IoT4n6OnDemand #DFIR

Check out our first episode of the #TruthInData podcast! Our topic this week: Evidence Gone: The Perils of Delayed Mobile Acquisition youtu.be/vb0G-uLvwMM?... With Debbie Garner & Kim Bradley #DFIR

So excited to collab with Debbie Garner and Kim Bradley on the #TruthInData podcast to bring a weekly deep dive into a different digital forensic topic each week! Subscribe to the Hexordia YouTube channel and never miss the conversation. #DFIR youtube.com/@hexordia

Interesting paper from Hannes Spichiger & Hexordia’s Frank Adelstein on “Preserving meaning of evidence from evolving systems” - how do we test to ensure that we understand the meaning of data at the time it was created? #DFIR www.sciencedirect.com/science/arti...

Mobile evidence? Image as soon as you can! Acquisition 👏 is 👏 Prervation Check out Lars Daniel’s article to learn why! #DFIR www.forbes.com/sites/larsda...

Thanks for catching up with me Forensic Focus!

Acquisition 👏 is 👏 Preservation! Without it we are loosing potentially Exculpatory and Inculpatory evidence. #DFIR www.forensicmag.com/3425-Feature...

Important must read position paper from Scientific Working Group on Digital Evidence (SWGDE) about the use of timely acquisition to preserve evidence. Mobile data has potential to degrade each day you wait to do an acquisition. #DFIR www.swgde.org/25-f-001/

Missed the @magnetforensics.bsky.social Virtual Summit #CTF but want the images for testing and learning? We have already shared them with @nist.bsky.social CFReDS cfreds.nist.gov/all/Hexordia...

Many thanks to Magnet Forensics, Hexordia, and the CTF authors for this great experience! Glad the timing worked out that I was able to participate - really enjoyable, creative, and challenging. Still may go back and look at some more of these questions..

Congratulations to the winners of the Magnet Forensic Virtual Summit 2025 CTF powered by Hexordia 1st place: @deagler 2nd Place: @Cognitor4n6 3rd Place: @Potato 1st Place Team: @X Still time to play for the First to Finish! #MVS2025CTF #DFIR

Sometimes you need to deal with data from a protocol buffer. Here are some tools to help! #DFIR github.com/protocolbuff... github.com/mildsunrise/... www.cclsolutionsgroup.com/forensic-pro... (Grab a 30 day trial of this - it does SO MUCH more!)

Looking for a good source of forensic tools, blogs, and cheat sheets? Check out @stark4n6.bsky.social Forensic Start Me #DFIR start.me/p/q6mw4Q/for...

Today, Feb 10, is the last day to sign up for the Magnet Forensics Virtual Summit 2025 #CTF! Sign up by 5pm ET to play #DFIR -

Want to break down what is in a URL? Try Unfurl from Ryan Benson and gain further insights! dfir.blog/unfurl/ #DFIR

#DFIR 💭 of the Day: Consensus based documents are important to our field. SWGDE is constantly working on development of standards Feeling left out of the current meeting, several draft documents are in the public comment period. Consider reading and submitting comments www.swgde.org/documents/dr...

#DFIR 💭 of the Day: AI doesn’t know what it doesn’t know. This is one of the super powers of Human #DFIR pros - when we don’t know - we test, we validate, we learn. And those findings aren’t always what a “synthesized assumption” would propose as an axiom.

#DFIR 💭 of the Day: playing a #CTF as a team can elevate your labs skills This year the @MagnetForensics DFIR CTF allows for team or solo play! Great opportunity for your team to work together to solve challenges helping your lab level up! www.hexordia.com/blog/play-ctf

#DFIR 💭 of the Day: Challenges keep your skills sharp for solving unknowns How do you train and prepare for things you don’t expect? You learn *how* to test & understand artifacts Check out the Sunday Funday from @HECFBlog www.hecfblog.com/2025/01/dail...

DFIR 💭 of the Day: It is important for practitioners and academics to collaborate The intersection allows for academics to understand practitioner issues to inform research and for practitioners to be aware of advancements in the science of Digital Forensics.

#DFIR 💭 of the day: it is critical that Legal Professionals understand digital evidence While digital forensics professionals are there to give meaning and detailed analysis, legal professionals still need education. Great content at the Magnet Forensics User Summit! magnetusersummit.com/passes/

#DFIR 💭 of the day: Our digital devices are noisy, even when we aren’t using them. It is incredible how much happens in the background of these devices. Looking at live logs is incredibly helpful when researching how data is stored in historical logs! youtu.be/JAcvwbpJ4gA

#DFIR 💭 of the day: Standards bodies need YOUR participation! Did you know that documents from groups like Scientific Working Group on Digital Evidence (SWGDE) and NIST OSAC go out for a public comment period? There are documents open for draft comments right now! www.swgde.org/documents/dr...

#DFIR 💭 of the day: Document your achievements WEEKLY! You’re learning & doing new things daily! You need to track. Keep a list & update it with your achievements (small or big) weekly. This helps at review time Monthly move applicable items to your CV and resume. Your CV is a LIVING document.

#DFIR 💭 of the day: breaking into DFIR requires practice. On school break? Keep learning! Check out DFIR Diva at dfirdiva.com Sign up for the @MagnetForensics Virtual Summit #CTF for hands on practice magnetvirtualsummit.com/capture-the-...

It was a pleasure to sit down and chat with @adamfirman.bsky.social on the #ForensicFix check out our conversation :)

Can’t wait for you to see what we have in store for this years #MVS2025 #CTF - New this year - play as a team! What a great way to build skills together #DFIR

The ICAC Orlando Conference Kicks Off Today! Hexordia is proud to sponsor and participate! 📅 Don’t Miss Our Talk: Topic: 3rd Party Apps Analysis Date: Tuesday, December 17, 2024 Time: 8:00 AM – 9:45 AM Location: Barrel Springs I #DigitalForensics #DFIR #ICAC

On my way to Orlando for the Florida ICAC conference and so excited to see @nerdcop.bsky.social :) Missing us? Well you can still catch up with Debbie on the #DFIRmas podcast with Amy Moles from ArcPoint youtu.be/tma_k7slAu0?...

#DFIR 💭 of the day: Our knowledge base is built on sharing - community contribution is critical. With ever-evolving tech, no examiner knows all - we constantly learn new things. Shared knowledge is required- blog, script, peer review, etc - Please share! You have something to contribute!

#DFIR 💭 of the day: Our knowledge base is built on sharing - community contribution is critical. With ever-evolving tech, no examiner knows all - we constantly learn new things. Shared knowledge is required- blog, script, peer review, etc - Please share! You have something to contribute!

#DFIR 💭 of the day: Nervous before presenting? - it’s a sign you care. Regardless of if it is in court, to an executive or in front of colleagues, that feeling may drive you to be your best. Leverage it to prepare and be the best you can be :)

#DFIR Thought of the day: Open Source tools are evolving and are incredibly valuable in investigations OS tools are often developed to fill gaps in commercial tools. One is the LEAPP project by @abrignoni.com. Incredible new functionality with LAVA LEAPPs.org

#DFIR 💭 of the day: Training should educate examiners on going beyond tool results. Here’s why: 1) Validate tool findings - particularly “smoking gun”. 2) Determine data meaning of results: how/why 3) Explain analysis results 4) Find unsupported artifacts 5) Adapt to change of supported artifacts

#DFIR 💭 of the day: The examiner provides the MEANING of the data NOT the tool. Tools parse data using algorithms to decode data. The tool does NOT provide the meaning - that is the role of the examiner.

Leet hacks get you applause, reports get you paid.

#DFIR 💭 of the day: our product IS a report. You can do all the fancy analysis - but if you cannot articulate it, you have no deliverable. Our reports are oh product. Technical writing should be a required skill.

#DFIR 💭 of the day: The more you know the more you will realize you don’t know. I often see new examiners gain in confidence. Then about 2 years in, humbled by data in a case. From that point forward, a good examiner knows there will always be more that they don’t know than they ever will know!

Want to take part in the Magnet Virtual Summit #CaptureTheFlag competition? Let @b1n2h3x.bsky.social share some helpful info, including what's new (like the ability to play in teams), how to take part, and where to get some tips & tricks: ow.ly/mHW350UkTXe #MVS2025 #CTF #DFIR

#DFIR 💭 of the day: Collaboration between practitioners and academia is crucial. To get ahead of rapid changes in #DFIR, we need scientific study and research! This is the largest scientific survey of DFIR practitioners. Must read to understand current issues www.sciencedirect.com/science/arti...

So excited for all of the new content in our Hexordia Data Structures Course! Check it out to learn data structures you need to parse and validate for your forensic analysis! -SEGB -LevelDB -ABX -PList -SQLite -Protobuf And more! Last day of our once a year 30% off sale! Learn.hexordia.com #DFIR

#DFIR 💭 of the day: It takes a community to build robust best practices. Input from DFIR folks is critical to creating the best documentation. It is our responsibility to contribute. There are 32 draft SWGDE documents for public comment! Please share your feedback www.swgde.org/documents/dr...

#DFIR 💭 of the day: Testing can take considerable time but is worth it! Particularly if you are testing a 72 hour time out - each new go is 72 more hours! Thanks to Nick Dubois for his testing of the iOS inactivity feature that causes iOS devices to reboot. www.hexordia.com/blog/ios18-r...

It’s that time of the year! Hexordia’s annual Black Friday sale! 🤭 this is the only time of the year we mark down all our courses to 30% off 🤯 Take a look at the courses we have and if you have any questions about the content please reach out! Courses can be found here: learn.hexordia.com

#DFIR 💭 of the day: “Deleted” doesn’t provide necessary nuance. A red X doesn’t always mean “deleted” - which infers user action to lay folks. Recovered data reasons depend on function & data structure. Analysis is our role. Paper on Classification of Recovered Dara tsapps.nist.gov/publication/...

#MVS2025 is coming, the CTF returns! @magnetforensics.bsky.social www.magnetforensics.com/blog/magnet-...

#DFIR 💭 of the Day: #CTFs are a fantastic way to learn! They are a great way to learn providing access to forensic images and questions that can increase and challenge your skills. Registration is now open for the Magnet Virtual Summit 2025 CTF powered by Hexordia. youtu.be/YNEnpwoADKs

Honored to be delivering the Closing Keynote at the Magnet User Summit March 17-19. Join me to learn about “The Truth in Data and Why it Matters”. Can’t wait to see you in Nashville! #DFIR #MUS2025 magnetusersummit.com

#DFIR 💭 of the day: It’s important to understand different data structures. The days of just XML or SQLite are gone. We need to know LevelDB, Android Binary XML (ABX), and SEGB… in addition to knowing protobufs and PLists. 30% off our 2-Day Data Structures Course through Dec 2 learn.hexordia.com

#DFIR 💭 of the Day: Lack of data IS information When what is expected isn’t there, it is worth looking deeper! Are there moments when communication goes dark and then returns? Are there apps that were installed and uninstalled? Absence of data IS data.