Investigations get tested after they're written.

A trial court refused to admit video that had been enhanced with an AI tool. The expert who produced it could not say whether other forensic analysts used the method, or point to any peer review of it, and the court found the technique relied on opaque methods to represent what the model thinks should be shown. Admitting it would mean a trial within a trial about a process nobody could review.

An industry analyst firm published research arguing that agentic incident-response and forensics tools which cannot show what they did and why will be shut out of enterprise contracts and excluded from court, and that governed autonomy and a tamper-evident chain of custody have to be built into these architectures now.

An appeals court upheld expert evidence from a proprietary blockchain-forensics tool and affirmed the convictions. It relied on corroboration, case-specific checks and explanations of the tool's methods; it also rejected the source-code challenge where counsel and qualified experts could review the underlying rules and assumptions and the defendant had not explained why the code itself was needed.

A high court quashed an inquest's findings and ordered a fresh investigation and inquest. Among its reasons were the absence of a forensic device examination, an incomplete manual review and unexamined social-media data; the court left the eventual conclusion to the new inquest.

A privacy regulator investigating a breach found that a government department had issued an urgent patch directive to the schools under its authority, but never verified that the directive was actually carried out; at least one school had not applied it. The regulator found the department in breach of its data-security obligations and ordered corrective measures, including a mechanism to confirm that future directives are actually followed.

A federal auditor ran fifty adversary-emulation tests, mapped to standard attack techniques, against a live detection stack. Forty-five produced no alert in the monitoring system built to catch them.

More than one court has ordered a forensic incident-response report produced in litigation after finding it wasn't actually protected by privilege, regardless of how the engagement was structured or labeled.

In a trade-secrets dispute, one side's forensic examination of a device reportedly found that a confidential file had been used elsewhere after an employee left the company; the other side's own examination of the same device reportedly found no such evidence. Citing a risk that the underlying evidence could be destroyed, a federal court ordered expedited production of the forensic images and related materials for independent testing, narrowed other discovery requests, and declined to decide which side's forensic conclusion was correct.

Police identified a suspect from a surveillance image using facial-recognition software, but disclosed that use only days before trial and never produced the software's identity, its search parameters, or the other candidates it returned. An appeals court held that a trial continuance could not cure that prejudice, found the trial court abused its discretion in denying dismissal, and reversed the conviction without ruling on whether the identification itself was accurate.

A court excluded encrypted-messaging evidence at trial over insufficient proof of its integrity and chain of custody after a multi-stage cross-border transfer, and acquitted the defendants. An appeals court annulled that ruling and ordered the evidence reconsidered; on retrial it was admitted and the defendants were convicted.

A top European court ruled that prosecutors may use encrypted-messaging evidence gathered by another country's authorities and transferred across borders, so long as domestic law would have allowed the same evidence to be obtained directly. It also held that a national court must disregard such evidence if the accused cannot effectively contest it and it could materially affect the fact-finding.

A state financial regulator found that a mortgage lender never obtained a written forensic report establishing a ransomware breach's root cause, contributing factors, or remediation. Without admitting or denying the findings, the lender agreed to an $825,000 penalty and other corrective terms.