r/digitalforensics

Hello all. I'm currently in my last year of getting my bachelor's in cybersecurity technology from UMGC, and have been planning on immediately getting the master's in digital Forensics. Im also currently studying to take A+ and later Network+ cert exams. Im not currently in the tech field, but plan on moving into it as soon as I can. From what I've gathered, getting a digital Forensics role usually takes years of experience first, so is it worth getting the master's now or should I wait until after I gain more experience? Any insight would be much appreciated.

Which of the following bachelors degrees at Penn State would be best for a Digital Forensics career and why?
-Cybersecurity Analytics and Operations
-Information Technology: Security and Risk Analysis option
-Computer science

Hello everyone,

I would appreciate your help with creating a project in the field of DFIR.

I applied for an advanced DFIR course and was shortlisted for a personal interview. The thing is, I don’t currently have any cybersecurity-specific projects; I only have software development projects. So, I would like to work on a DFIR project that I can present during the interview.

The project doesn’t necessarily need to be highly professional or advanced. I just want it to demonstrate that I have some practical experience and hands-on exposure to the field.

I would also like to practice and prepare myself for the course. What would you recommend I focus on or study to get ready?

My little sister rejected a guy and he has been trying to ruin her life and extort her. Please help us. Police are not helpful.

Thanks

Hello! I wanna start learning and practicing mobile forensics but I don't know where to learn it from. Also, I am a beginner so I can't afford to buy paid courses. Please help me out. Thank you so much in advance^^

Sometimes the problem isn’t that you don’t have the information.

You have too much of it.

Maybe it’s spread across hundreds of emails, text messages, PDFs, contracts, invoices, screenshots, reports, notes, logs, and spreadsheets.

You know the information is in there somewhere, but trying to piece together exactly what happened has become a project of its own.

That’s what CodexOS Reconstruction is designed to help with.

We take the available records and reconstruct the matter as clearly as the evidence allows.

Depending on the material, that can include:
• What happened and in what order
• The most important findings supported by the records
• Where different records agree or conflict
• Who appears to have known certain information, and when
• What evidence supports an important finding
• What information appears to be missing
• What the available records cannot actually establish

The goal isn’t to give you another summary.
It’s to organize the evidence well enough that you can actually inspect what happened and see where the conclusions came from.

This may be useful for situations involving:
• Business or contract disputes
• Vendor or contractor problems
• Complicated project histories
• Property management matters
• Insurance documentation
• Internal business issues or investigations
• Workplace records
• Compliance or administrative matters
• Other situations where the story is buried inside a large collection of records

A good potential case usually has a reasonably defined problem, actual source records, enough material to reconstruct something useful, and one or more questions you’re trying to answer.

You do NOT need to organize every file perfectly before contacting me.

If you have a situation buried in emails, documents, messages, screenshots, reports, or other records, send me a DM with a short description of:
• What happened
• Why you’re trying to make sense of it
• The main questions you want the records to help answer

I’ll look at the situation first and tell you whether it appears suitable for a responsible reconstruction before you commit to anything.

This isn’t legal advice, advocacy, or a service that decides who is right. We don’t fill gaps by guessing. If the records don’t support a conclusion, we say so.

**You give us the records. We reconstruct what they show.**

https://reddit.com/link/1vq8cyg/video/btfopmmbvsjh1/player

I built Augur, an open-source tool for seeing what is actually hidden inside a file.

It finds things like zero-width characters and hidden instructions, Trojan Source / bidi controls, mixed-script homoglyphs, EXIF and GPS metadata, C2PA manifests, and data appended after an image.

It can also write a cleaned copy without modifying the original or recompressing the image, then scans the result again to verify the selected stuff is actually gone.

Video shows the real thing - the demo files are generated by a script in the repo, including everything Augur then detects.

https://github.com/dejo1307/augur

New code in iOS 27 beta 5 shows that the company is working on something called Apple Reference Image, which is designed to authenticate the source of photos using unique data tied to the iPhone camera hardware that captured them.

In line with Apple’s privacy-focused approach to cloud-based processing of potentially sensitive user data, the company is designing Apple Reference Image in a way that prevents Apple from accessing the raw photo itself.

Instead, the system sends the image to Private Cloud Compute for authentication, while only certain sensor information and photo metadata are sent back to Apple. Interestingly, if Apple determines that a sensor may have been compromised, it may revoke prior authentications associated with that sensor.

Or would that be a stretch? I hate my career in embedded sw and wish i went with something criminal justice related.

I’m currently on my last year pursuing a BA in Criminology and I’m planning to venture in Digital Forensics/ Cybersecurity
I’m completely new in this field but at the same time have a deep passion for it. I’d love to work with Law Enforcement or Corporate as long as investigations are involved.
I’m also planning to volunteer in relevant institutions/ parastatals as I finish school for the experience and learning.
Any recommendations or advice on roadmaps I should follow?

Either I'm missing something obvious (totally possible) or Cellebrite reader is dumb. Help.

Edit to add: I'm a solo investigator and don't have PA or Axiom, so I just work with whatever I get in a UFDR.

When I review extractions in Cellebrite Reader I get overwhelmed with duplicates and junk files. And I mean everything. Media, artifacts, messages, etc.

I understand certain events can create effectively identical artifacts in multiple databases. That's fine, but Reader doesn't have a way to filter sources that I can find. If I could, for example, hide KnowledgeC or Contacts, that would thin out the timeline or search results dramatically so I could actually find things. I often find myself exporting Excel files so I can deduplicate and review/search in other ways. Location data is a great example of this when I want to pull data and plot things on a map.

I find that the deduplicate filter never does anything.

Part 2 is media: my dream is that I could simply browse through a phone's photo app like a normal person using a phone. What I always find in the media browser, however, are hundreds of thousands of photos, including cached preview images, little tiny graphic emoji buttons, logos, etc from every app installed on the phone. I don't seem to find a combo of filters that ever works.

If I could just scroll the photos and videos on the phone's native app that would be a total dream. Browsing cached photos from social apps, deleted items, etc. is important, but often secondary to an initial review.

How do y'all handle this stuff? I have to find some faster workflows. On my cases I generally need to do an initial high level review/triage of the whole thing--calls, messages and media, before anything detailed, and it just takes so long.

Thanks!

Can cellebrite extract data from an unlocked iphone 16 pro and if it can what all data can kt extract? There is no passcode on the phone

Hi all, a good friend of mine (L) recently received pictures that her partner (C) said had been sent to her over Instagram by a burner account (who blocked her shortly after). These pictures depict L cheating on C with a random person neither of them had seen before, but they looked convincing enough. I know L and know that cheating goes against everything she stands for, and I'd bet my life on these being faked somehow; either AI generated or edited in some way.

L has her suspicions on who could be behind the pictures, but she can't begin to take legal action (defamation case) without some ground to stand on regarding these suspicions. Thing is, I'm a complete amateur in digital forensics, so try as I might I have only been able to get the pure basic metadata from these photos. The photos themselves have also been through a lot of sending and re-sending on different platforms, and I believe only one of the ones I have is an "original" in any regard; the others are screenshots.

So my question is, is there anybody here who could help? Either with the forensics aspect of it (which I believe I've reached a dead-end in, but again, I'm only an amateur) or with the visual analysis/AI identification part of it? We'd be super grateful.

Tired of linkedin. Only shows roles needing high YoE. Don't know if it's algorithm issue.

Okay chat here we go. About a year ago I sold a car to a friend from high school. The car was listed everywhere for $2500, and he agreed to pay that amount. His only stipulation was that he would only pay $1000 up front and I would receive the other $1500 at a later time because he didn't want his dad to know how much he was really spending on the car. His dad comes with him to both pickup the car and to transfer the title. No reason to mention the $1500 right? Wrong. Fast forward over the last 11 months. Initially I was reaching out every couple weeks to ask about the money, to which he would always claim, "I don't have it yet but I'll get it soon." That went on up until about 2 weeks ago. I made a post (attached) to which HE replied to. "I didn't pay for it dad did." WHATEVER. Anyways. Couple days ago. I ask again, where's the money? He now claims to know nothing about ever owing me any money at all and that I have fabricated this elaborate scheme to extort money from him because I need the money and he's such an easy source. He now wants proof and evidence. Only issue is that this exchange was done over snap and the messages have long since disappeared. I've tried a data request but it didn't include any chats that had disappeared. If I could get those chats it would prove the whole thing.

What we have already

-Why would he reply to the story if he doesn't owe anything?

Does anyone know of any way to pull up the story so I can see that he actually replied to it?

Is there ANY way possible to get those chats back. At this point I'm willing to go to the police and have them scan my phone to try to get it back. Any suggestions help. End TedTalk.