How-To

Microsoft’s 26220.7051 (Dev/Beta) Insider build introduces an opt‑in Ask Copilot entry on the taskbar. Here’s how that UX change surfaces...

Windows 11 Insider Build 26220.7051 adds “Ask Copilot” to the taskbar — what to baseline for DFIR

4n6 Beat
6 min read

Microsoft shipped Windows 11 Insider Preview build 26220.7051 (KB5067115) to Dev and Beta on October 31, 2025, introducing an opt-in “Ask Copilot” experience on the taskbar. You enable it at Settings > Personalization > Taskbar > Ask Copilot and can also toggle whether the Copilot app auto-starts at sign-in. Microsoft states Ask Copilot uses existing Windows APIs to return apps, files, and settings like Windows Search, and it does not grant Copilot access to personal content. (blogs.windows.com)

WhatsApp is rolling out passkey-encrypted cloud backups on iOS and Android. This replaces backup passwords and 64‑digit keys with device‑...

WhatsApp moves cloud chat backups to passkeys. Here’s what changes for DFIR.

4n6 Beat
5 min read

WhatsApp is rolling out passkey-encrypted chat backups for iOS and Android, letting users protect backup restores with Face ID/Touch ID, Android biometrics, or the device screen lock instead of a password or 64-digit key (BleepingComputer; The Verge). End-to-end encrypted (E2EE) backups themselves aren’t new-WhatsApp shipped them in October 2021 with a password or 64-digit key option and an HSM-backed Backup Key Vault design (Meta Engineering)-but the gate to restore is now a platform passkey instead of something you type. Enable path remains: Settings → Chats → Chat backup → End-to-end encrypted backup (BleepingComputer).

Hero image for DJI Fly App Forensics: Extracting and Analyzing Flight Logs on Android, iOS, and DJI RC

DJI Fly App Forensics: Extracting and Analyzing Flight Logs on Android, iOS, and DJI RC

4n6 Beat
8 min read

You often investigate incidents where a DJI aircraft is involved-flyaways, near-misses, restricted-area incursions, or simply reconstructing pilot actions. The DJI Fly app (dji.go.v5) is the default ground-control app for most recent DJI consumer drones, and it quietly records rich telemetry you can extract, preserve, and analyze for DFIR.

This guide shows you how it works, where to find the artifacts, and how to process them with current tools-on Android, iOS, and DJI RC-class smart controllers. You’ll also learn the common traps (Android scoped storage, missing DAT files, cropped logs, and cloud policy changes in the U.S.) and practical workflows to avoid data loss.

Shufflecake hides multiple encrypted filesystems inside apparent free space on Linux. Here’s how it works, what deadbox can’t tell you, a...

Shufflecake on Linux: what deniable, multi-layer volumes mean for DFIR

4n6 Beat
6 min read

Shufflecake implements plausible deniability on Linux by scattering several independently-keyed volumes across what looks like random free space, making both the existence and the number of volumes hard to prove in deadbox exams. The design ships as a device-mapper target (kernel module) plus a userland CLI, with volumes exposed as virtual block devices under /dev/mapper when opened (Shufflecake project site). The project originated at Kudelski Security and EPFL in November 2022 (Kudelski Security blog), and the research was later peer-reviewed at ACM CCS 2023 (Shufflecake ePrint).