r/digitalforensics

So I had a samsung s25 phone that police seized. I didnt give my password to them.I shut the phone down before they took it and I have a 16 digit passcode on it. How likely is it police can get into my phone? Apparently a samsung thats been restarted has an extra layer of security (BFU)?

Location: United kingdom

Dear all, Account throwaway. I am looking for fake audio files, to test purpose. Obviously, obtaining them must be legal.

thanks

Greetings r/digitalforensics,

I built a free tool called ChronoVerify that is useful for photo forensics.

It pulls capture time and metadata from EXIF/XMP, validates C2PA Content Credentials, and runs some basic pixel forensics to spot edits.

You get a plain-language verdict instead of just a bunch of raw data. Everything runs in your browser — no images get uploaded or stored.

There's also a free API tier if you or an agent want to script it.

If you try it, I'd be curious what you think, especially those experienced with forensics. Could this be useful to you or the image forensics community?

Thanks!

Hi everyone,

I’m looking for advice from people with experience in mobile network security, incident response, telecom infrastructure, or digital forensics.
Over the past few months I’ve become concerned that I may be the target of a sophisticated attack involving my mobile connectivity. I realize these are extraordinary concerns, so I’m not asking anyone to assume they are true. Instead, I’m looking for guidance on how to investigate them properly and collect evidence.
Some of the questions I have are:
How can I determine whether there is any evidence of telecom-level compromise?
What kinds of logs or records can I legally obtain from my mobile provider?
If someone had unauthorized access to telecom infrastructure, what evidence would typically remain?
Is there any practical way to detect or rule out SS7-related attacks?
Which forensic tools are recommended for iPhone and eSIM investigations?
Should I preserve baseband logs, network traces, or any other artifacts?
Are there independent telecom security experts who perform this type of forensic analysis?
I’m not looking for speculation or conspiracy theories. I’m specifically looking for:
digital forensic methodology;
telecom security expertise;
evidence preservation;
legal documentation standards;
ways to distinguish between normal carrier behavior and actual compromise.
If you’ve worked in telecom security or incident response, I’d really appreciate

Hi everyone,

I’m looking for advice from people with experience in mobile network security, incident response, telecom infrastructure, or digital forensics.

Over the past few months I’ve become concerned that I may be the target of a sophisticated attack involving my mobile connectivity. I realize these are extraordinary concerns, so I’m not asking anyone to assume they are true. Instead,
I’m looking for guidance on how to investigate them properly and collect evidence.

Some of the questions I have are:

How can I determine whether there is any evidence of telecom-level compromise?

What kinds of logs or records can I legally obtain from my mobile provider?

If someone had unauthorized access to telecom infrastructure, what evidence would typically remain?

Is there any practical way to detect or rule out SS7-related attacks?

Which forensic tools are recommended for iPhone and eSIM investigations?

Should I preserve baseband logs, network traces, or any other artifacts?

Are there independent telecom security experts who perform this type of forensic analysis?

I’m not looking for speculation or conspiracy theories. I’m specifically looking for:
digital forensic methodology;
telecom security expertise;
evidence preservation;
legal documentation standards;
ways to distinguish between normal carrier behavior and actual compromise.
If you’ve worked in telecom security or incident response, I’d really appreciate your advice.

Thank you

Hey everyone. Recently been looking to find another job and figured I would post on her to see if anyone had any advice or ideas. Not looking for a specific role or job posting to fill, rather another area or space within DF that I might enjoy more. Just kind of lost on where to go or what’s out there.

For the past 4 years I've been working at a regional DF lab supporting multiple local, state, and federal LE agencies the US.

I mostly do Mobile Forensics. Analysis, extraction, preservation, and report generation using mainly Cellebrite and Magnet tools, but have experience with a wide range of tools. Have a little experience doing computers, DVRs, and vehicles but we don't get those requests nearly as much. Also have a little experience testifying as an expert. I work on all kinds of cases but getting very burnt out.

For those who started off in a similar setting or with similar experience, what areas of DF did you transition to and do you enjoy it more?

If it helps, my undergrad degree is in CJ, nothing CS related. This was my first job out of college and they trained me and got me my certifications

Thank you in advance. Any advice is greatly appreciated.

Mi hanno rubato i miei dati e hanno rubato alcune foto mie personali, se potresti aiutarmi per favore

So a thought crossed my mind just now: how realistic is the possibility of say 3-letter agency getting a photo of a palm off r/PalmReading or similar online sources, and running physical fingerprints lookup?

They say that they’ve broadened support, including iPhone 17 and iOS 26.3. https://cellebrite.com/en/products/launches-releases/spring-release-2026/

Is this actually real? Does this mean complete data extraction is available AFU?

Hello guys, I am 29M living in India, doing a job in IT operations (prompt engineering and a bit of database handling)

I have a Master's degree in IT (completed in 2020) now trying to make a career transition into digital forensics. I am in a dilemma whether I should go for another master's of 2 years (M.Sc. in Digital Forensics & Information Security) or look for relevant certification courses which can help me to land in a job related to Digital Forensics. But if I opt for certification courses how will I get hands-on experience on using the forensic tools? How will I perform or learn practical knowledge? Please help 🥺

I have a few screenshots that were transferref from an iphone x to a laptop. I checked the exif data but i just want to make sure. Is it possible that the exif changed as it was being transferred?

I am carrying out a research project on a case study for my degree on the following information I’m trying to understand the current capabilities and limitations of Cellebrite UFED/Premium and Magnet AXIOM when examining an iPhone 15 (iOS 17/18) in England.
Specifically, I’m interested in what investigators can realistically recover from a passcode-unlocked device during a standard police forensic examination.
Some questions I have:
Can deleted Snapchat chats or disappearing messages be recovered, or is only metadata (timestamps, contacts, etc.) typically available?
What Instagram data is usually recoverable (deleted messages, media, notifications, cached data)?
How much app cache remains available on modern iPhones compared with older devices?
What is normally obtainable from iCloud versus the physical handset?
Are there significant differences between what Cellebrite and Magnet AXIOM can extract on iPhone 15 models?
Are there any recent white papers, webinars, or real-world forensic experiences covering iPhone 15/iOS 17–18?
I’m looking for technically accurate information from digital forensic practitioners rather than speculation. Any insight or links to current documentation would be greatly appreciated.

anyone would be interested in Agentic AI based solution for automatic Audit evidence collection system solution such as ISO, SOC2, GDPR etc? Just upload your application list, automatic controls mapping to backend integration to collect evidence and keep it Audit ready. Anyone interested send a note to me

Someone (I believe a certain ex but am going to avoid possible defamation lawsuit) made a fake twitter/x profile and posted an intimate image of me on it. The police have been involved and basically told me that this last warrant (this started in 2023) is my last hope but because I’m located in Canada and the platform is US based it’s “difficult” and sometimes our laws are invalid there. I want to know if there is anyway I can find out who it is if the police don’t. This isn’t an image I sent to someone either, this was non consensual or even possibly under the influence as I don’t recognize anything in the background of the image. I just want my life back. I moved, I changed my number, locked down all my social media and have struggled severely with my mental health since. The photo itself has been taken down and from what it appears the account is locked out or something as the profile picture is gone along with every post from the account. They have one follower which is my partner after I blocked the account and they have one person they are following which is some cam girl whom I tried to reach out to. Please, if anyone on here has any idea on how to help me I’d really appreciate it.

Abseits der technischen Diskussion will ich mal eine Frage zur Begrifflichkeit stellen und wie ihr sie definiert.

Ich sehe hier viele Themen, die sich auf IT bezogenen Forensik konzentrieren.

Was mir Recruiter allerdings in letzter Zeit berichten ist, dass wenn sie mit dem Begriff Digitale Forensik ausschreiben, sie in letzter Zeit sehr viele Bewerber bekommen, die mit der klassischen IT gar nichts mehr zu tun haben.

Diese Bewerber stellen sich unter dem Begriff Digitale Forensik eher die digitalisierte Forensik vor - Tatortvermessung mit Drohnen, Sturz- und Bewegungsanalysen, digitalisierte Analysen von biologischen Proben, digitale Rekonstruktionen. In Deutschland ist da vorallem Prof. Labudde von der HS Mittweida ein wichtiger Vertreter.

Ich will diesem Gebiet gar nicht seine Bedeutung und auch gar nicht die Nutzung dieses Begriffes absprechen - denn vielleicht befindet sich der Begriff selbst eben auch in Entwicklung und könnte eben auch ein nützlicher Überbegriff sein für verschiedene Felder der Forensik mit digitalen Hilfsmittel oder Untersuchungsobjekte.

Nur sollten wir dann selbst auch die richtigen Begriffe verwenden, wenn wir nach Bewerbern oder Themen, Informationen suchen. Ich persönlich verwende nun eher die Begriffe IT Forensik oder Computer Forensik, wenn ich über die Forensik spreche, die sich auf die IT bezieht. Das sehen meine Recruiter leider noch anders - und verschwenden momentan viel ihrer und die Zeit der Bewerber...

Can anyone analyse an audio recording to establish if there is a mathematical sequence, rhythmic pattern? And establish if the sound is natural. And any data.