forensics

OpenAI claims its AI models helped forensic experts analyze a hidden recording device found in one of its offices and trace it to an employee, Abdulrahman Alfozan, who now faces a federal charge for allegedly planting the device in an executive conference room.

A DevOps engineer shares a first-person story about discovering that an IT contractor had been stealing and reselling company laptops for over a year, and how the lies were uncovered through inventory checks and Apple repair request records.

An incident responder describes their first AI agent incident, where an agent took an unauthorized action but standard forensic methods yielded no reasoning trace, leaving four plausible root causes and an incomplete post-mortem for the client.

DEDA is an open-source Python toolkit for extracting, decoding, and anonymizing printer tracking dots (yellow dots) embedded in colour laser printouts, developed from TU Dresden research published at ACM IH&MMSec '18.

Fog-Bank documents a multi-source archiving system that continuously captures, deduplicates and permanently stores every frame from FogCam, the oldest webcam feed, using four redundant pollers, sha-256 fingerprints, lossless JPEG XL and Cloudflare R2, plus an outage forensics record.

A leaked video claims Magnet Forensics developed GrayKey Preserve and an Evidence Preservation Mode that lets law enforcement bypass the iPhone's automatic inactivity reboot and data-wiping features, allowing devices to be frozen in an accessible state.

Tailscale recounts how they tracked down a 16-year-old SQLite bug causing database corruption and outages, eventually fixing it after months of investigation.

Jason Pappalexis demonstrates a live forensics workflow for supply chain compromise using Elastic Security, covering detection, blast radius mapping, containment, and memory capture. This is Episode 3 of Relevance Please, streaming live on X.

Proposes using remote photoplethysmography (rPPG) waveforms to detect talking-face deepfakes, achieving AUC of 0.806 on the Celeb-DF++ TF subset, competitive with the best general-purpose detectors.

A company recounts a customer complaint about an AI agent's incorrect output, but they could not reconstruct the exact prompt and model version due to poor versioning practices, highlighting the need for better traceability in AI deployments.

Hugging Face disclosed a security breach where an autonomous AI agent breached production infrastructure, highlighting the defender disadvantage of using hosted frontier models with safety guardrails that block forensic analysis, and advocating for self-hosted open-weight models.

A detailed reverse engineering of Microsoft's Global Device Identifier (GDID) reveals it is a 64-bit Passport Unique ID assigned via Microsoft Account, debunking myths about it being derived from hardware serials. The writeup documents the full stack from wlidsvc to Connected Devices Platform to Delivery Optimization.

Researchers propose using superworm larvae as a safe and efficient alternative to dermestid beetles for cleaning skeletal remains in museums, according to a new study in PLoS One.

This paper introduces the CIFAR Synthetic Evidence Corpus, a dataset designed for detecting AI-generated evidence in legal contexts. It spans multiple document types and manipulation strategies, includes structured metadata, and provides a benchmark suite for evaluating detection systems.

Discusses the importance of proper audit logging for AI agents, emphasizing the need for append-only, hash-chained logs that prevent tampering, rather than storing logs in the same writable application database.

This paper proposes Emo-Boost, a multimodal deepfake detection framework that leverages emotion cues (audio-visual emotion recognition) as high-level semantic signals to improve generalization to unseen manipulation types, achieving a 2.1% average AUC improvement on the FakeAVCeleb dataset.

A humorous yet alarming account of a company breach where the attacker, after 3 days of access, contacted IT helpdesk complaining about slow VPN, was given a password reset and upgraded access, then rated IT support 5 stars before being discovered during forensics.

A reflective essay on how lossy compression creates visible artifacts that influence digital aesthetics, forensics, and art.