Research and insights
Short pieces that explain one thing properly: what a standard changed, how a technology behaves, why a tool family was renamed. Every piece lists its sources and the date it was checked.
6 pieces6 categoriesSources on every piece
- What NIST SP 800-88 Rev. 2 ChangedNIST published the final NIST SP 800-88 Rev. 2 in September 2025 and withdrew the 2014 revision. The new edition drops the media-by-media technique tables and asks organisations to run a sanitization programme instead. Here is what moved, what stayed and what it means for disposing of IT assets in India.
- SSDs, TRIM and What Happens to Deleted DataOn a hard disk a deleted file usually sits where it was until something overwrites it. On an SSD the drive itself may clear it within minutes. This explainer covers TRIM, garbage collection and wear levelling, what a forensic image of an SSD really contains and why file carving so often comes back empty.
- DPDP Rules, 2025 and Their Phased CommencementThe Digital Personal Data Protection Rules, 2025 were notified by MeitY in November 2025 under section 40 of the Digital Personal Data Protection Act, 2023. They come into force in three stages over eighteen months. This update sets out what we verified in the Gazette text, what each stage brings and what a forensic laboratory or training institute should start doing now.
- Hash Verification in Digital EvidenceA hash value is the one number that lets a court trust that the copy examined is the copy seized. This tutorial covers which algorithms to use and why, when to hash, how hash sets work, how to verify an image against its source and how to write hashes into the chain of custody and the report, with a worked synthetic example.
- Cellebrite Inseyets and the UFED TransitionCellebrite now presents Inseyets as its flagship digital forensics suite, with UFED and Physical Analyzer living on as its extraction and decoding components. This update separates what Cellebrite's own pages say from what is independently known, lists which products are current and which are in transition, and suggests what an examiner or student should learn first.
- Why CCTV and DVR Evidence Is Hard to ExportA DVR export is rarely a simple video file. It is a proprietary container that needs the maker's own player, with a clock that may be minutes off and a frame rate that changes with motion. This explainer covers what makes DVR evidence difficult, how to verify an export with hashes, when to image the whole disk and what to document.
How these are written
The editorial team reads the primary document first: the published standard, the Gazette notification, the maker’s own release note. Secondary reporting is used only to find the primary source, never as the source itself. Where something could not be checked, the piece says so. Nothing here is a vendor announcement and DFRTI has not tested a product unless the text says it has.
More from DFRTI research
- Ongoing Research ProjectsOur active projects cover disk analysis, mobile evidence, cloud forensics, memory research and malware investigation. Each one starts from a problem investigators run into on real cases.
- Publications & Case StudiesResearch papers, case studies and investigation reports for analysts, teachers and forensic researchers. Written to show method, so readers can apply it to their own cases.
- DFRTI Tools & InnovationsWe build forensic tools for storage, mobile, cloud, memory and malware work. The aim is simple: more accurate evidence, found faster, with every step on record.
- Collaborate on ResearchWe want to push forward how digital evidence is acquired, analysed, validated and automated. If your research or project is in digital forensics, you can work with our experts, labs and datasets.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.