Thought-provoking analysis, case-driven breakdowns, and real-world lessons from the field of digital forensics. These insights go beyond surface-level procedures and examine what really happens when evidence is missing, metadata is manipulated, or crash detection contradicts testimony.
Featured Articles
- The Art of Hunting for Nothing
Forensic analysis usually focuses on what’s present. This case showed the opposite — the absence of data can be just as powerful. By mapping “gaps of darkness” in iOS fsevents, investigators exposed a serial killer’s pattern of powering off his phone to evade detection. Silence became evidence — and now there’s a tool to make that analysis reproducible. Read the Article - Reconstructing Distraction
Joint publication from Bunting Digital Forensics (U.S.), Deep Dive (Albania), and Cybir (U.S.), presenting real crash detection and distraction data across iPhone and Android. Includes motion testing, sysdiagnose analysis, and log timelines from actual forensic cases and testing scenarios. Read the Article - The Digital Crash
A fictional scenario based on real-world testing — using crash detection logs, accelerometer timelines, and mobile forensic workflows to evaluate texting or distraction at impact. Demonstrates the value of sysdiagnose and Android log recovery when evaluating motion-triggered crashes. Read the Article - When the Chain Breaks
The tampering case: metadata manipulation, improper handling, and how a team of experts mapped what others ignored. Read the Article - How Did That Photo Get on That iPhone?
Peer-reviewed deep dive into iOS’s Photos.sqlite database — tracing image provenance, timestamps, and sync behavior. Read the Article - Forensic Analysis of Spoliation – Part 1 (Mac)
Discovery violations through the lens of macOS activity and the consequences of overlooked data. Read the Article - Forensic Analysis of Spoliation – Part 2 (Windows)
Windows system logs, user artifacts, and how deleted isn’t always deleted — especially under a microscope. Read the Article
New articles are added regularly. For updates, professional inquiries, or to suggest a topic you’d like to see covered, visit the Contact page.