Paper outlines a seven-agent n8n workflow for log forensics
Agents built on n8n and Gemini pass results layer by layer; authors tested 16 cases and call the findings promising.
Stories per day · 30 days
2 RSS
Relatedintrusion-detection2audio-visual1benchmark1bitcoin1cellebrite1credentials1data-breach1dataset1deepfake1evidence-extraction1explainable-ai1federated-learning1gemini1host-based-detection1iphone1jurisdictional1leakage1leaked-document1
26 stories, newest first · one card per story
Stories tagged #forensics
Federated Forensics architecture supports multi-agency learning with jurisdictional controls
New architecture blocks restricted model updates at jurisdictional borders while maintaining 93% accuracy.
MODEXRE Forensic Pipeline Uses SHAP Explainability for Intrusion Detection
Extends XGBoost classifier with SHAP for explainable forensic intrusion detection with chain of custody.
Bitcoin forensics dataset Elliptic++ has temporal leakage
Re-evaluation of Elliptic++ after correcting for temporal splits and feature definitions drops random forest F1 score on illicit class from 0.846 to 0.291.
SNEEF framework extracts forensic evidence from mobile SQLite databases
SNEEF achieves an F1 score of 0.967 for evidence entities from SQLite row content.
SoK finds host intrusion detectors leave time assumptions unstated
A review of detector papers finds most provenance systems state no clock bound and trust stored evidence.
AV-FABLE benchmarks sparse audio-visual manipulations in long videos
Zero-shot audio-visual language models are near chance, while separated readouts of frozen features lead localization.
Leaked Cellebrite note describes an iPhone Advanced Unlocks product
The leaked note says a dedicated appliance can reach after-first-unlock iPhones from about 8 meters, including with Stolen Device Protection on.
UK Legal Aid Agency Hack Scope Widens After Forensic Review
Forensic review finds the UK Legal Aid Agency breach reached records from 1978 and some probation and practitioner data.
2
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)
SANS published two Python scripts that reconstruct OpenCode and Hermes AI agent activity for forensic review.
Podcast: Leak Show Cops Can Break into Locked iPhones
A 404 Media podcast says a leak shows police can bypass the iPhone inactivity reboot.
Correct Answers, Unsupported Findings: Evidence Binding in Forensic Reconstruction of LLM Agent Logs
Study finds LLM readers can match agent-log facts while asserting unsupported citation sources.
Possible Vulnerability in Apple’s Automatic Reboot
Magnet Forensics' GrayKey Preserve reportedly bypasses iPhone inactivity reboot so forensic data stays available.
Around 2-6% of World Bank foreign aid got siphoned into crypto wallets
NBER researchers estimate 2-6% of World Bank aid, roughly $1.7-4.4 billion, leaked into crypto wallets.
Safari History Database Tags Can Reveal Users’ Browsing Themes in Forensic Investigations
Safari History.db stores Wikidata-linked topic tags that can reveal browsing themes in macOS investigations.
Safari History Database Tags Can Reveal What Users Were Browsing on macOS
Safari History.db topic tags can reveal macOS browsing themes even after some history records are removed.
DF-CBM: Region-Aware Concept Bottleneck Models for Deepfake Detection
DF-CBM is a region-aware concept bottleneck model that explains deepfake decisions with spatially grounded manipulation concepts.
A2A-ForensicTrace: Offline Verification of Tamper-Evident A2A Runtime Evidence
A2A-ForensicTrace offline-verifies tamper-evident Agent2Agent evidence, and all 240 test receipts checked out.
MAD-Guard: Controlled Study of Autoregressive Generation versus Direct Decision Interfaces for Closed Multimodal Forensic Tasks
MAD-Guard shows direct decision heads outperform autoregressive decoding for closed multimodal forgery forensics.
AI Sandbox Escapes: Why Forensic Readiness Matters More Than Containment
Dark Reading says AI agent sandbox escapes reflect familiar access-control failures more than rogue-machine scenarios.
FARE: Forensic Acceptance Region Estimation for Catching Bait-and-Switch Image Generators
FARE flags silent swaps of certified AI image generators by testing images against enrolled forensic artifacts.
GUIAuditor: Enabling Post-hoc Child Safety Forensics via Action-Guided GUI Provenance on Mobile Devices
GUIAuditor uses an on-device model to record mobile GUI activity for later guardian safety review.
Knowledge Retention & Sharing in DF/IR
DFIR veteran reflects on knowledge retention and sharing gaps across the industry, from EnCase training to PCI forensics workflows.
wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)
Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.
5