Did you hear the news? Magnet User Summit and Magnet Virtual Summit are coming back in 2026 to help redefine and rediscover what’s possible in DFIR in 2026! Magnet Virtual Summit will take place February 23-27 while Magnet User Summit returns to Nashville April 20-22—and we’re opening submissions for speaking spots at both events. Magnet … Continued
Note: This series is based on real-world criminal investigations, and some content may be graphic or disturbing. In digital forensics, every little detail counts—and expertise makes all the difference in solving a case. In an investigation involving the tragic death of a child and the serious injury of others, a single piece of digital evidence … Continued
Note: This series is based on real-world criminal investigations and some content may be graphic or disturbing. Digital forensics is a demanding, high-pressure field, where the right combination of skill, training, and perseverance can be crucial to solving a case. The gravity of this work is immense, especially when a single digital artifact has the … Continued
In modern criminal investigations, digital evidence—including emails, text messages, phone records, video footage, social media posts, and cloud-stored information—often holds more value than physical evidence. Artificial intelligence (AI) is rapidly transforming law enforcement and digital forensics, allowing police to process massive volumes of data, solve cases more quickly, and protect officers from exposure to traumatic … Continued
The digital forensics and incident response (DFIR) landscape is in the middle of a revolution, thanks to the adoption of cloud-based forensic solutions. Some of the transformative benefits of cloud-based tools may be familiar, but there are even more advantages that you may not know about yet. Below, we’ve gathered 10 benefits of cloud-based forensics … Continued
In this series, Chad Gish, CID/SISU Detective, Metropolitan Nashville Police Department will delve into some noteworthy cases in his 26-year career, focusing on investigations that were either completely solved or significantly aided by a critical piece of evidence—what he calls “that one artifact.” In some cases, physical evidence can be so limited that solving the … Continued
In digital forensics, Windows operating systems leave behind a wealth of forensic artifacts that can be invaluable in investigations. Among the key artifacts are ShimCache (Application Compatibility Cache) and AmCache (Application Activity Cache). These artifacts can provide valuable insights into program execution and file system interaction, often essential in piecing together an event timeline or … Continued
PowerShell is a powerful tool within Windows systems, widely used for administrative tasks, automation, and scripting. Unfortunately, due to its powerful scripting capabilities and default presence on Windows machines, it has also become a popular tool for malicious actors. PowerShell can be used in advanced attacks, including fileless malware, lateral movement within a network, and … Continued
Time is always critical when dealing with criminal investigations, but did you know that some iOS forensics evidence will be lost entirely if it isn’t extracted within a certain window of opportunity? To help avoid any lost data during mobile forensic data extraction, we have outlined the best iOS evidence sources to capture before expiration, … Continued
Remote Desktop Protocol (RDP) is a powerful tool for remote administration, but it can also be a gateway for attackers seeking unauthorized access. For digital forensics professionals, RDP artifacts are critical in tracing an intruder’s steps. In this blog, we will explore what RDP digital artifacts entail, where they are located, how they can be … Continued
Notifications
