PHP2Shell: How to Assess Exposure, Exploitation and Impact
A vulnerable PHP runtime can establish technical exposure. It cannot, by itself, establish that an attacker executed code, accessed data or compromised an organization. That distinction is central to assessing CVE-2026-109618 and CVE-2026-109619, the PHP-core vulnerabilities referred to collectively in public reporting as PHP2Shell. The supplied PHP advisories describe different mechanisms: one concerns out-of-memory handling […]
When Source Code Differs: A Defensible Method for Investigating Alleged Software Derivation
Allegations of software copying are often framed as a search for identical source code. That framing is too narrow for many real investigations. Source may have been rewritten, identifiers renamed, code obfuscated, the original repository made unavailable, or the systems made comparable only through compiled binaries and observed operation. In those circumstances, the absence of […]
Cloud Timestamps Are Not Events: Reconstructing Chronology from Digital Evidence
A cloud evidence set may contain several timestamps for what appears to be the same file or object. One may describe when a provider processed a request. Another may have been supplied by a client device. A third may have been created when an export or collection tool wrote the file to local storage. A […]
Cross-Border Electronic Evidence: How Provenance Informs Evidential Assessment
Cross-border electronic evidence rarely moves through a single, uniform process. It may be requested under an international cooperation mechanism, obtained from a service provider, transferred between investigative teams, converted into another format, translated and ultimately presented to a decision-maker in a different jurisdiction. At each stage, questions arise that are both legal and technical: who […]
Brazil’s Electronic Voting System: What Digital Evidence Can—and Cannot—Establish
For disputes involving electronic voting, the central question is not simply whether a vulnerability exists. It is whether the available evidence can establish that the vulnerability was exploitable in the relevant environment, actually exploited during an election, and capable of changing a declared result. Those are different propositions. Treating them as interchangeable weakens both technical […]
Software Implementation Disputes: What Digital Evidence Can Establish
Software disputes often begin with a simple question: what was delivered, configured, tested or adopted, and when? The answer is rarely contained in a single contract, ticket or system log. It is usually distributed across technical environments, project records, acceptance materials and communications between the parties. A defensible assessment therefore requires more than identifying a […]
From Blockchain Address to Real-World Identity: What Cryptocurrency Evidence Can Establish
A blockchain address can appear precise. It may have a visible transaction history, a persistent balance and a sequence of incoming and outgoing transfers. Yet an address is not a name. It is a ledger identifier, and the evidential question is how, if at all, that identifier can be connected to a person or entity. […]
When Can a Cloud or SaaS Export Support a Defensible Conclusion?
A provider-issued export can appear authoritative. It may contain timestamps, account activity, messages, audit events or records of changes. In a dispute, however, the central question is not simply whether the export is intact as a file. It is what the export represents, what it does not represent, and whether another investigator could understand the […]
Preserving Ephemeral Collaboration Data Before It Disappears
When a dispute or investigation begins to take shape, relevant communications may not exist in one convenient archive. They may be distributed across a collaboration platform, individual devices, cloud storage, provider exports, third-party integrations and administrative records. Some content may also be subject to automatic retention rules, account changes or deletion workflows. The practical problem […]
Everything about digital forensics in digital documents.
Digital documents are those that are created, stored, and transmitted through computer devices, such as computers, tablets, cell phones, and servers. They can be of various types and formats, such as texts, spreadsheets, images, videos, audios, emails, contracts, invoices, etc. Digital documents are increasingly used in personal, professional, and institutional activities, as they offer advantages […]
