Send us Fan Mail

In this episode, we get into AI and digital forensics, where it can help, where it can go wrong, and how we’re using it without handing forensic conclusions over to an LLM. Instead, we look at AI as an engineering tool that can help develop an approach, generate code, and accelerate problem solving. From there, deterministic processes take over, backed by continuous integration, regression testing, and known datasets to produce repeatable results that examiners can validate and defend.

We also introduce GLEAPP, the newest member of the LEAPPs family, built for image and video triage at scale. GLEAPP can ingest file systems, archives, raw images, E01s, and Project VIC JSON, helping examiners work through large media collections more efficiently. We cover duplicate detection, perceptual hashing for visually similar media, face matching, offline mapping of EXIF GPS data, and flexible categories, tags, and flags for organizing what matters.

If you work in mobile device forensics, DFIR, or open-source forensic tooling, this episode is for you. We’re focused on practical tools, transparent methodology, and workflows that examiners can test, understand, and defend.

Give it a listen, let us know what you want us to tackle next, and share it with someone in your lab who could put GLEAPP to work.

Notes:

IACIS Registration: https://members.iacis.com/training/orlando

IACIS Scholarships:

https://www.iacis.com/awards-and.../will-docken-scholarship/ https://www.iacis.com/awards-and.../womens-scholarship/ https://www.iacis.com/mark-baker-scholarship

Crush: https://github.com/kalink0/crush-forensics

Arc2Lite: https://github.com/stark4n6/Arc2Lite/releases/tag/v3.0.0

LEAPPS.org

Send us Fan Mail

AI is speeding up digital forensics, but speed without control is how good labs get burned. We dig into a safer way to work: use AI-assisted coding to generate a repeatable process, then test it against a real corpus of known extractions so results stay deterministic, verifiable, and defensible. If you’ve ever felt your LLM results “drift” from run to run, this mindset shift is the difference between a helpful assistant and a hidden liability.

We also get practical with what’s new across the community: a free macOS timestamp utility, Android intrusion logs (and how to extract and parse them when a user has opted in), and a deep look at Apple Unified Logs and log archives as an underrated iOS forensics goldmine. The big takeaway on logs is interpretation: one scary-looking line is not a conclusion. You have to read the surrounding sequence of events to avoid false narratives, and we talk about how newer workflows can process log archives directly from extractions without requiring a Mac.

From there we move into evidence sources that often decide cases: iOS Health database artifacts, LevelDB and IndexedDB for browser forensics, and a standout BitLocker improvement that can auto-unlock secondary encrypted volumes when keys are preserved in a system image. Finally, we walk through reporting at scale with LAVA, the LEAPPs viewer that adds conversation views, analytics, tagging, notes, and LAVA subset exports for massive chats that would otherwise choke HTML reports.

If this helped you rethink your workflow or gave you a new artifact to chase, subscribe, share the episode with your lab, and leave a review so more examiners can find it. What tool or artifact do you want us to test next?

Notes:

Timestamped - https://thebinaryhick.blog/2026/08/16/timestamped/

Brett Shavers Blog Posts - http://linkedin.com/pulse/let-ai-run-your-case-make-you-stupid-brett-shavers-vproc/

Android Logical Extractor - https://github.com/prosch88/ALEX

Tim Korver Blog Posts - https://www.linkedin.com/in/tim-korver/recent-activity/articles/

SANS DFIR Summit & Training - https://www.sans.org/cyber-security-training-events/digital-forensics-summit-2026

MSAB Digital Summit - https://www.msab.com/msab-mobile-forensics-digital-summit-2027/

Cellebrite 101 - https://community.cellebrite.com/s/101

HEART Metadata Forensics - https://github.com/MetadataForensics/HEART_by_Metadata_Forensics

Arsenal - https://arsenalrecon.com/products

LEAPPs & LAVA - leapps.org

Send us Fan Mail

We come back from a busy conference stretch and go hands-on with new digital forensics tools that speed up real workflows across vehicle, iOS, and Android investigations. We also tour major updates to LEAPPs and LAVA, show how Batch LEAPP changes multi-extraction processing, and end with a hard question about validation that every examiner needs to take seriously.

Show Notes:

North Loop Consulting: Sedgwick and NCL Spectator https://northloopconsulting.com/

Crush Digital Forensic Analysis Workbench: https://github.com/kalink0/crush-forensics

LEAPPS: leapps.org