The AI Investigative Framework Interview with Heather Barnhart

Send us Fan MailIn this episode, we get into AI and digital forensics, where it can help, where it can go wrong, and how we’re using it without handing forensic conclusions over to an LLM. Instead, we look at AI as an engineering tool that can help develop an approach, generate code, and accelerate problem solving. From there, deterministic processes take over, backed by continuous integration, regression testing, and known datasets to produce repeatable results that examiners can validate and defend.We also introduce GLEAPP, the newest member of the LEAPPs family, built for image and video triage at scale. GLEAPP can ingest file systems, archives, raw images, E01s, and Project VIC JSON, helping examiners work through large media collections more efficiently. We cover duplicate detection, perceptual hashing for visually similar media, face matching, offline mapping of EXIF GPS data, and flexible categories, tags, and flags for organizing what matters.If you work in mobile device forensics, DFIR, or open-source forensic tooling, this episode is for you. We’re focused on practical tools, transparent methodology, and workflows that examiners can test, understand, and defend.Give it a listen, let us know what you want us to tackle next, and share it with someone in your lab who could put GLEAPP to work.Notes:IACIS Registration: https://members.iacis.com/training/orlando IACIS Scholarships: https://www.iacis.com/awards-and.../will-docken-scholarship/ https://www.iacis.com/awards-and.../womens-scholarship/  https://www.iacis.com/mark-baker-scholarshipCrush: https://github.com/kalink0/crush-forensicsArc2Lite: https://github.com/stark4n6/Arc2Lite/releases/tag/v3.0.0LEAPPS.org

Send us Fan MailAI is speeding up digital forensics, but speed without control is how good labs get burned. We dig into a safer way to work: use AI-assisted coding to generate a repeatable process, then test it against a real corpus of known extractions so results stay deterministic, verifiable, and defensible. If you’ve ever felt your LLM results “drift” from run to run, this mindset shift is the difference between a helpful assistant and a hidden liability. We also get practical with what’s new across the community: a free macOS timestamp utility, Android intrusion logs (and how to extract and parse them when a user has opted in), and a deep look at Apple Unified Logs and log archives as an underrated iOS forensics goldmine. The big takeaway on logs is interpretation: one scary-looking line is not a conclusion. You have to read the surrounding sequence of events to avoid false narratives, and we talk about how newer workflows can process log archives directly from extractions without requiring a Mac. From there we move into evidence sources that often decide cases: iOS Health database artifacts, LevelDB and IndexedDB for browser forensics, and a standout BitLocker improvement that can auto-unlock secondary encrypted volumes when keys are preserved in a system image. Finally, we walk through reporting at scale with LAVA, the LEAPPs viewer that adds conversation views, analytics, tagging, notes, and LAVA subset exports for massive chats that would otherwise choke HTML reports. If this helped you rethink your workflow or gave you a new artifact to chase, subscribe, share the episode with your lab, and leave a review so more examiners can find it. What tool or artifact do you want us to test next?Notes:Timestamped - https://thebinaryhick.blog/2026/08/16/timestamped/Brett Shavers Blog Posts - http://linkedin.com/pulse/let-ai-run-your-case-make-you-stupid-brett-shavers-vproc/Android Logical Extractor - https://github.com/prosch88/ALEXTim Korver Blog Posts - https://www.linkedin.com/in/tim-korver/recent-activity/articles/SANS DFIR Summit & Training - https://www.sans.org/cyber-security-training-events/digital-forensics-summit-2026MSAB Digital Summit - https://www.msab.com/msab-mobile-forensics-digital-summit-2027/Cellebrite 101 - https://community.cellebrite.com/s/101HEART Metadata Forensics - https://github.com/MetadataForensics/HEART_by_Metadata_ForensicsArsenal - https://arsenalrecon.com/productsLEAPPs & LAVA - leapps.org

Send us Fan MailWe come back from a busy conference stretch and go hands-on with new digital forensics tools that speed up real workflows across vehicle, iOS, and Android investigations. We also tour major updates to LEAPPs and LAVA, show how Batch LEAPP changes multi-extraction processing, and end with a hard question about validation that every examiner needs to take seriously. Show Notes:North Loop Consulting: Sedgwick and NCL Spectator https://northloopconsulting.com/Crush Digital Forensic Analysis Workbench: https://github.com/kalink0/crush-forensicsLEAPPS: leapps.org

Send us Fan Mail AI is becoming more common in digital forensics, but the biggest danger is people trusting it too much. Heather Barnhart discusses a framework that helps examiners assess when AI is appropriate, where it can assist with tasks like triage, and where it should not be used, while keeping trained human experts responsible for decisions. Notes:https://www.linkedin.com/posts/heather-barnhart-cellebrite_ai-dfir-digitalforensics-ugcPost-7463670252950847488-b7s-/

Send us Fan Mail“The tool said” might be the fastest way to lose a jury. Recorded live at IACIS, we sit down with Stacy Eldridge and Becky Passmore of Parsing The Truth One Bite At A Time, two former FBI senior forensic examiners who build a true crime-ish podcast around one thing most shows ignore: the digital artifacts and the courtroom testimony that prove what happened.https://parsingthetruth.com/

Send us Fan MailTool output can look authoritative while still being dangerously easy to misread, and we’ve both seen how fast that goes sideways when a case hits court. Live from the MSAB Digital Summit 2026, we walk through a simple principle that saves careers: an artifact is a clue, not a conclusion. We talk about how “artifact worship” happens, how to build real corroboration, and why multiple records on the same phone are not automatically multiple lines of evidence.We also get honest about forensic reporting and peer review. Assuming “legal will catch it” is a trap, because attorneys and supervisors may not be able to validate the technical meaning of a timestamp, a parser decision, or an attribution statement. We share practical ways to write clearer digital forensics reports, verify tool parsing, and test your assumptions so you’re not learning hard lessons under oath. If you work mobile device forensics, this section is for you.From there we shift into training and deep technical skills that are quickly becoming baseline: Android RAM acquisition and analysis, what kinds of artifacts can show up in memory, and why RAM can hold evidence you may never find in a file system extraction. We also unpack protocol buffers (protobuf) and the uncertainty that comes with app data when the .proto schema is missing, plus why that matters when AI and automation start “helping” with interpretation. We wrap with an ALEAPP update, a reminder that a portable tool report isn’t analysis, and a quick look at how standards like Daubert and Frye raise the bar for methodology.Notes:Brett Shavers Blogs: It’s Not Artifact Worship When One Artifact Actually Changes the Case https://www.linkedin.com/pulse/its-artifact-worship-when-one-actually-changes-case-brett-shavers-nwi6c/I Thought Legal Would Catch It. They didn’t. https://www.brettshavers.com/brett-s-blog/entry/i-thought-legal-would-catch-it-they-didntIACIS https://www.iacis.com/events/in-person/2026-orlando-training-conference/

Send us Fan MailA blue jay, a busted feeder, and a brand-new camera set the tone, but only briefly. We kick off the new year with updates from the Florida ICAC conference, including firsthand courtroom experience watching frame rate and frame count testimony in action. The episode centers on Frame Counts Galore, an open-source script for extracting and hashing every video frame, calculating true variable frame rates, and producing transparent, courtroom-ready logs and reports.We cover upcoming DFIR conferences, introduce a lightweight AI Provenance Scanner for fast C2PA and metadata checks, and reflect on standout moments from the digital forensics year—especially the impact of open-source tools and honest conversations about the realities of the work. The episode closes with a 2026 wish list focused on stronger education, fair workloads, and customizable forensic reporting that analysts can actually defend in court.Happy New Year to the DFIR community.Notes:Frame Counts Galore-https://github.com/abrignoni/frame-counts-galoreUpcoming Conferences- https://www.iacis.com/                        https://www.msab.com/digital-summit-2026/ https://magnetvirtualsummit.com/              https://www.technosecurity.us/https://ofta.cellebrite.com/event/cellebrite-c2c-user-summit-2026/AI Provenance Scanner-  https://github.com/abrignoni/AI_Provenance_ScannerBrett Shavers Blogs-                                                    https://www.brettshavers.com/UFADE & ALEX-                                                              https://github.com/prosch88

Send us Fan MailThis episode digs into the habits that actually hold up: learning from CTF wins and post-event reviews, exploring scholarships and Reno trainings that build technical muscle, and walking through expert-witness prep that turns courtroom stress into structured, confident testimony.We’ll unpack Brett Shavers’ reminder that truth alone doesn’t win cases—procedure, documentation, and bias-aware methods do. Clear writing matters too; vague language can undermine solid work.On the tools side, RabbitHole v3 now recovers deleted SQLite records and rebuilds them into query-ready databases—speeding validation and reporting without losing traceability. We’ll also demo the new Android Logical Extractor: pull device info, logs, and scoped chat data with hashes and ready-to-file PDFs. It’s ideal when consent is limited or full file systems aren’t on the table, and integrates cleanly with downstream workflows.Throughout, we emphasize one idea: tools are abstractions. If you can’t explain how a result was produced or reproduce it, you don’t own the finding. That’s especially true with AI. Generative models are nondeterministic—useful when documented, risky when their prompts or scope stay hidden. We’ll cover prompt disclosure, reproducibility, and how to write about “deleted” data with precision: previously existing, marked deleted, not referenced—describe state, not intent.If you’re serious about improving testimony, validating results, and adopting new tools without losing forensic footing, join us. Then share your take on AI prompts and language precision—what will you change in your next report?Notes: IACIS Scholarshipshttps://www.iacis.com/awards-and-scholarships/will-docken-scholarship/https://www.iacis.com/awards-and-scholarships/womens-scholarship/Training Opportunities!IACIS Renohttps://www.iacis.com/events/in-person/reno-nv/Free DFIR Test Images + Industry Tools to Analyze Themhttps://www.dfir.training/downloads/test-imagesNew Blogs from Brett Shavers!https://www.linkedin.com/pulse/theres-lot-more-trial-than-you-may-know-even-have-100-brett-shavers-br4sc/https://www.linkedin.com/pulse/case-almost-made-me-quit-dfir-shouldve-news-brett-shavers-pie1c/https://www.linkedin.com/pulse/i-when-digital-forensics-lost-its-soul-brett-shavers-otkec/https://www.linkedin.com/pulse/end-dfir-again-dfir-training-ab5jc/https://www.linkedin.com/pulse/how-wreck-your-report-affidavit-testimony-one-word-brett-shavers-qkyvc/Free Webinarhttps://www.suspectbehindthekeyboard.com/fighting-city-hall-dfir-lessons-from-a-pro-se-plaintiffRabbithole Updatehttps://www.linkedin.com/posts/rabbithole-dataviewer-sqllite-ugcPost-7384144022065274880-0d0Dhttps://www.cclsolutionsgroup.com/forensic-products/rabbitholeALEX Releasehttps://github.com/prosch88/ALEXhttps://github.com/RealityNet/android_triage

Send us Fan MailA baby camel, a high-speed chase, and a heartfelt tribute set the stage for a season opener that is equal parts human and hard-nosed.We pause to honor Mark Baker, mentor, officer, and friend.This episode spotlights a free Belkasoft AI course along with the much-anticipated release of Rabbit Hole v3, designed to tackle complex data structures.From there, it is all about blogs, and there are plenty of them. Mattia explores extraction nuances, showing how AFU versus BFU states and encryption classes still determine what you can recover from iOS and Android. Hexordia provides important guidance on first responder missteps, emphasizing how early handling and precise thinking safeguard the integrity of a case.We also showcase open-source and budget-friendly tools such as Autopsy and IPED, which expand analysis capacity without breaking the bank. A hands-on demo of Gallery Builder illustrates how to create courtroom-ready visuals, paired with a reminder that “vibe coding” with LLMs is no substitute for validated forensic standards.Finally, we close with the latest LEAPP and LAVA updates, which continue to push practical workflows forward for the field.Notes:BelkaGPT: Effective Artificial Intelligence in DFIRhttps://belkasoft.com/belkagpt-trainingTraining First Responders in Digital Evidence Handling: How To Protect Your Department from Case-Destroying Mistakeshttps://www.hexordia.com/blog/training-first-responders-in-digital-evidence-handlingThe Packd Bytehttps://www.thepackdbyte.org/Two New Blogs from Mattia http://blog.digital-forensics.it/2025/09/exploring-data-extraction-from-android.htmlhttps://blog.digital-forensics.it/2025/09/exploring-data-extraction-from-ios.htmlSWGDEhttps://www.swgde.org/documents/published-complete-listing/16-f-002-considerations-for-required-minimization-of-digital-evidence-seizure/Gallery Builderhttps://github.com/charpy4n6/GalleryBuilder

Send us Fan MailWe celebrate our two-year podcast anniversary and discuss the importance of thorough case preparation for CSAM cases, courtroom experience, and extracting evidence from iOS devices.• SANS Difference Maker Awards open for nominations through September 15th across multiple categories• AI debate webinar with Magnet Forensics scheduled for September 17th• Binary Hick's blogs reveal insights on iOS search party and Samsung's Rubin and Digital Wellbeing databases• Discussion on properly preparing CSAM cases for trial with understanding of statutes and evidence requirements• Brett Shaver's article highlights importance of attending trials to understand courtroom proceedings• iOS File Provider Storage in BFU extractions can reveal user-created images with metadata• Updates to LEAPPS tool including CashApp parser improvements and Snapchat returns parser• New Lava viewer coming soon for the LEAPPS projectNotes:SANS Difference Makers Awards-https://docs.google.com/forms/d/e/1FAIpQLSeLNMZm3r4c9WSKdNW8XaPh6KRXoS3C1WI51UtnEANe2osCpQ/viewformAI Unpacked #5: The great AI debate with Digital Forensics Now-https://www.magnetforensics.com/resources/ai-unpacked-5-the-great-ai-debate-with-digital-forensics-now/The Binary Hick New Blogs-https://thebinaryhick.blog/2025/08/19/further-observations-more-on-ios-search-party/https://thebinaryhick.blog/2025/08/06/not-strange-bedfellows-samsungs-rubin-digital-wellbeing/Monolith Notes-https://www.monolithforensics.com/free-toolsBrett Shavers- Courtroom Trials Are the Final Exam for Your Work. Why Haven’t You Attended One?-linkedin.com/in/brettshavers/recent-activity/all/