Latest News

In an era where the psychological toll of public service is becoming more visible, particularly among Digital Forensic Investigators (DFIs), voices like Hannah’s are both powerful and necessary. After facing burnout, PTSD, and cancer during fifteen years as a police officer, Hannah has transformed her journey of healing into a mission to support others on the frontlines. Through Blue Light Wellbeing, she provides trauma-informed therapy and coaching tailored to the unique needs of those working in high-stress, emotionally taxing environments.

This article explores Hannah’s journey, the services she offers, and how her professional insight rooted in personal experience makes her a culturally competent and transformative presence for DFIs facing the hidden costs of their critical work.

A Journey Forged in Service and Adversity

Hannah served as a police officer with West Midlands Police for fifteen years. During that time, she witnessed the very worst of human behaviour, the immense pressure of life-threatening decisions, and the all-too-familiar undercurrent of organisational stoicism that often prevents open discussion of mental health. Like many who serve in emergency services, she learned to suppress emotional responses and carry on despite accumulating trauma.

However, the cost of that suppression eventually made itself known. Hannah’s career culminated in severe burnout and post-traumatic stress disorder (PTSD). As if the mental toll wasn’t enough, she was later diagnosed with cancer, a turning point that prompted deep reflection about her health, purpose, and identity. Her personal crisis would ultimately become the catalyst for a new professional chapter, one rooted in empathy, empowerment, and cultural awareness.

Retraining and Rebuilding: From Police Officer to Trauma Practitioner

Following her departure from policing in 2013, Hannah undertook extensive training in psychotherapy and trauma-informed practices. She completed a Level 7 Diploma in Trauma Therapy, specialising in Emotional Freedom Techniques (EFT) and trauma-focused cognitive behavioural therapy (CBT). She became an advanced practitioner in Brain Working Recursive Therapy (BWRT), an innovative technique that targets maladaptive emotional responses without requiring clients to re-experience traumatic memories.

In addition, Hannah trained as an accredited well-being coach and continues to engage in professional development to ensure her services meet the evolving needs of emergency personnel. This blend of lived experience and clinical competence is rare, and it’s what distinguishes Hannah’s work from more generic mental health services.

The Cultural Competence DFIs Deserve

One of the biggest barriers to effective mental health support for DFIs is the lack of cultural understanding within mainstream services. Digital forensic work often involves prolonged exposure to Child Sexual Abuse Material (CSAM), extreme violence, and disturbing content, all within a bureaucratic system that frequently undervalues emotional resilience.

Secondary trauma is a significant risk for forensic computer analysts, reflecting the wider mental health challenges faced by DFIs. This reality highlights the importance of culturally sensitive, profession-specific mental health support—an approach central to Hannah’s work.

Traditional therapy models may fail to address the specific trauma that DFIs experience. For example, therapists unfamiliar with policing culture may inadvertently minimise the impact of exposure to CSAM, or misunderstand the guilt and shame that investigators carry. Furthermore, the stigma within digital forensics, where asking for help may be perceived as weakness, can deter individuals from engaging in therapeutic services.

Empathy, compassion fatigue, and burnout are common risks for professionals who work on sexual offence cases. DFIs face similar challenges, making it essential that therapeutic support comes from professionals who understand both the operational demands and the emotional impact of working with distressing material.

Hannah, having worn the uniform herself, breaks down those barriers. She doesn’t just understand trauma clinically; she has felt it, lived with it, and overcome it. Her cultural fluency allows her to build trust quickly with clients from the emergency services, who may otherwise be reluctant to open up.

Services Designed with Real-World Trauma in Mind

At Blue Light Wellbeing, Hannah offers a suite of services including:

• Trauma-Informed Therapy

• Well-being Coaching

• Training and Workshops

• Motivational Speaking

These services are specifically designed to address the emotional realities of DFIs, supporting them in healing, coping, and thriving.

The Relevance for DFIs

Digital forensic investigators are often the unseen casualties in the chain of justice. They spend countless hours reviewing evidence that others are shielded from, such as graphic imagery, video footage, and metadata linked to severe abuse. While safeguarding others, they often internalise trauma with little to no formal support.

The term compassion fatigue describes the emotional and psychological strain that can occur when repeatedly exposed to others’ trauma. For DFIs, regularly encountering disturbing digital material, such as CSAM, can trigger symptoms often associated with direct trauma.

Post-traumatic stress disorder (PTSD) can arise from a variety of causes, and effective treatments depend on understanding these origins. The trauma-related symptoms experienced by DFIs underline the value of trauma-informed approaches in therapy, such as those provided by Hannah.

Hannah’s trauma-informed practice is particularly well-suited to DFIs. Her understanding of the psychological mechanisms behind secondary trauma hypervigilance, emotional numbing, guilt, nightmares, and burnout allows her to provide nuanced, compassionate care.

Police Care UK provided empirical data on trauma prevalence within UK policing. The report highlights how systemic factors, including underfunding, cultural stigma, and insufficient therapeutic provision, discussed by Hannah on the Forensic Focus Podcast, exacerbate mental health issues among frontline workers paralleling the experience of DFIs.

Importantly, her work also reflects an awareness of the organisational challenges DFIs face, including chronic under-resourcing, unrealistic performance expectations, and a workplace culture that may reward emotional suppression over emotional wellbeing.

A Model for Systemic Change

Hannah’s practice also offers a model for what systemic wellbeing could look like in the world of digital forensics. Her emphasis on early intervention, culturally competent care, and proactive resilience training is exactly what is needed in environments where trauma is an inevitable occupational hazard.

Employers often limit therapeutic support to six sessions, a model wholly inadequate for the depth of trauma experienced in digital forensic work. Hannah’s flexible, needs-led services represent a more ethical and effective alternative. She champions the idea that those who protect others should be protected themselves.

Final Thoughts

Hannah’s journey from burned-out officer to trauma therapist is more than inspirational; it’s a roadmap for cultural reform. Her story challenges the silence that surrounds mental health in digital forensics and offers real solutions for those who are silently suffering.

By grounding her services in both clinical skill and lived experience, Hannah has become a vital asset to those working in the shadows of justice. Digital forensic investigators deserve to be seen, supported, and understood. In Hannah, they find not just a therapist, but a fellow traveller one who knows their path, honors their sacrifice, and walks beside them on the road to healing. Hannah can be contacted through the Blue Light Wellbeing website.

Paul Gullon-Scott BSc MA MSc MSc FMBPSS is a former Digital Forensic Investigator with nearly 30 years of service at Northumbria Police in the UK, specializing in child abuse cases. As a recognized expert on the mental health impacts of digital forensic work, Paul now works as a Higher Assistant Psychologist at Roseberry Park Hospital in Middlesbrough and is the developer of a pioneering well-being framework to support digital forensics investigators facing job-related stress. He recently published the research paper “UK-based Digital Forensic Investigators and the Impact of Exposure to Traumatic Material” and has chosen to collaborate with Forensic Focus in order to raise awareness of the mental health effects associated with digital forensics. Paul can be contacted in confidence via LinkedIn.

A round-up of this week’s digital forensics news and views:

SANS DFIR Summit 2025 Playlist Released

SANS has released a comprehensive playlist from the DFIR Summit 2025 featuring cutting-edge digital forensics and incident response strategies. Content covers AI-driven workflows, covert command and control systems, cloud compromise scenarios, and macOS forensics techniques. The playlist provides real-world insights and practical strategies for cybersecurity professionals and digital defenders.

Read more (youtube.com)

UAC v3.2.0 Released with New Features and Bug Fixes

Unix-like Artifacts Collector (UAC) v3.2.0 has been released with new features, additional artifacts, and bug fixes. UAC is an incident response tool designed for forensic investigators, security analysts, and IT professionals that automates artifact collection from Unix-like systems including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris. The tool simplifies data collection for intrusion handling, forensic investigations, and compliance checks while reducing dependence on external support during critical incidents.

Read more (github.com)

Coalition of Cyber Investigators Co-Founder Discusses OSINT Professionalization and Investment Fraud

Neal Ysart, co-founder of The Coalition of Cyber Investigators, discusses his organization’s mission to professionalize OSINT practices and combat investment fraud. Ysart and partner Paul Wright established the coalition as a think-tank combining 80+ years of experience in law enforcement, forensics, and intelligence operations. He emphasizes the need for standardized methodologies and warns against “OSINT cowboys” who compromise evidential integrity, while highlighting the coalition’s specialized work in investigating increasingly sophisticated boiler room investment scams.

Read more (forensicfocus.com)

Part 2 of 3: Running A Digital Forensic Business

Digital forensics expert Patrick Siewert outlines key strategies for operating a successful digital forensic professional services business. Marketing emerges as the single biggest budget item after software licenses, requiring targeted approaches to reach litigators rather than general attorneys or government entities. Siewert emphasizes the importance of proper pricing, networking within professional organizations, and building a strong personal brand through principled practice. He warns against underpricing services and advises setting aside 30% of revenue for taxes while maintaining commitment to long-term business growth.

Read more (dfirphilosophy.blogspot.com)

NCMEC Hash Value Integration Accelerates Child Exploitation Investigations

Cellebrite announces integration of the National Center for Missing and Exploited Children’s hash value list into its digital forensics software, allowing investigators to instantly identify known child sexual abuse material during device examinations. Integration significantly reduces investigation time by automatically flagging CSAM files from NCMEC’s database of approximately 10 million hashed files, while providing mental health protection for law enforcement by allowing them to redact explicit content. Despite receiving over 22 million CyberTipline reports in 2024, NCMEC warns that numbers have actually decreased due to reduced reporting from some platforms and increased use of end-to-end encryption.

Read more (forensicmag.com)

PowerShell Transcripts: Essential Digital Forensics Tool for Incident Response

PowerShell transcripts function as “flight data recorders” for PowerShell activity, capturing both user commands and system outputs in plain-text logs. Eric Capuano explains how these transcripts can be enabled enterprise-wide through Group Policy or Intune, providing investigators with detailed session records including usernames, timestamps, host applications, and process IDs. Security teams can leverage transcripts alongside Script Block Logging to detect malicious activity, though the logs are tamper-able and require proper configuration with write-only network shares for maximum effectiveness.

Read more (blog.ecapuano.com)

iOS Search Party Database Reveals Detailed Device Tracking Data

Forensic researcher Binary Hick discovers that iOS devices maintain comprehensive records of all FindMy-compatible devices they encounter through an encrypted database called Observations.db. The database stores timestamps, precise location coordinates, signal strength, and MAC addresses of detected beacons, creating a detailed tracking log that updates frequently but deletes records rapidly. Binary Hick successfully decrypted the database using keys found in the iOS keychain and demonstrates how the data can help identify unwanted tracking devices like AirTags.

Read more (thebinaryhick.blog)

NJIT Forensics Team Uses Cell Data to Free Wrongly Imprisoned Man

Ray Wooden spent over a year in a Pennsylvania jail for a crime he didn’t commit before three NJIT forensic science students and graduates helped clear his name using cellphone location data. Wooden was falsely accused of firing shots at a Philadelphia home in what he described as retaliation for tipping off police about a woman involved in a home invasion. Mia LoRé, Carmen Cheung and Gillian Kongnyuy analyzed Wooden’s phone records and device data, conclusively showing his phone was never near the residence during the reported shootings and confirming he had possession of his device throughout. Philadelphia prosecutors dismissed all charges in July after the digital evidence proved Wooden’s innocence.

Read more (news.njit.edu)

What We’ve Covered

Playback With Precision

Every transcription stays linked to its original media, giving you full control to review what was said and when.

Speaker Diarisation

Know exactly who said what and when. Automatically separate speech by speaker, label clearly, and assign custom names to create easy-to-follow, court-ready transcripts.

Editing With Confidence

Edit, add context, correct terminology, flag key lines and search for details without needing to export or switch tools.

From Transcript to Report

From media import through review and editing to court-ready reporting, S21 Transcriber provides a seamless, fully offline workflow with detailed, timestamped reports.

There’s Still Time to Explore the Tool for Yourself:

As part of the spotlight, you’ll get full access to your own trial account and a self-guided training hub, including:

• A 30-day free licence
• Step-by-step walkthroughs
• Real-world examples you can try
• A certificate on completion

No pressure. No pitch. Just hands-on experience with the tools that could change how you work.

Thinking Ahead?

If what you saw during this session could support your unit’s workflow, we’d be happy to help you integrate S21 Transcriber into your environment, whether that’s a single workstation or a fully connected review suite.

What’s Next?

Our next Spotlight Session will focus on S21 LASERi-X, a comprehensive solution for rapid victim identification, CSAM categorisation and media review. Its advanced AI capabilities provide enhanced review efficiency, prioritisation, and the ability to act faster.

We’d love to see you there.

Ready to Take a Look?

Want to see real world usage?

Case Studies – www.semantics21.com/case-studies

Follow us on LinkedIn or X to catch each Spotlight update, or head to www.semantics21.com/spotlight to request your free licence and training.

Sign up http://bit.ly/3I58STF

No fuss. Just better forensics.

Retailers are under attack. Recent ransomware and malware campaigns have exposed critical weaknesses in how retail organisations detect, investigate, and respond to cyber threats. These attacks don’t just disrupt operations — they steal sensitive customer data, paralyze supply chains, and cause lasting reputational damage.

In today’s high-speed threat landscape, traditional investigation methods are too slow and fragmented. You need to act within minutes, not days!

Join this webinar to learn how modern forensic techniques can help your team launch immediate, coordinated investigations — no matter where the data resides. We’ll explore how to gain visibility across all endpoints, enable real-time collaboration between teams, and recover critical evidence from remote or mobile environments.

If you’re responsible for protecting your brand, your data, and your customers — this is a session you can’t afford to miss.

Key Takeaways:

• Launch Investigations Instantly
  Remotely collect and analyze evidence the moment a breach is detected.

• Collaborate in Real Time
  Enable multiple investigators to work on the same case – securely and simultaneously.

• Capture Remote & Mobile Evidence
  Extend visibility to remote endpoints and mobile devices without delay.

Date:

Thursday, September 4, 2025

Time:

4:00 PM (CEST) | 3:00 PM (BST) | 7:00 AM (EDT)

Speakers:

Exterro Marketing

Harsh Behl, Vice President Product, Exterro

Matt Blackband, Associate Director – Head of Digital Forensics, Grant Thornton

A selection of the latest DFIR job vacancies (got a job you want to feature in the next round-up? Submit the details here):

USA

UK

Australia

Canada

As businesses face constant pressure to detect and respond to incidents with greater speed and precision, companies are increasingly taking advantage of the benefits of AI-powered digital forensics.

In this blog from Magnet Forensics, learn more about how enterprises are leaning on AI for speed and accuracy in their digital investigations, including:

• Why AI adoption is accelerating

• How AI is being increasingly using in DFIR workflows

• How enterprises are prioritizing usability and seamless integration in AI tools

• Why AI is a double-edged sword

• What the future of AI looks like in enterprise DFIR

• How to make AI work for you

Read the blog here.

MD-NEXT introduces Full Filesystem (FFS) extraction capabilities for the latest Samsung Galaxy devices of Android 16, including the Samsung Galaxy S25 and Samsung Galaxy Z Flip. This breakthrough enables forensic professionals to conduct thorough investigations with unprecedented access to critical digital evidence.

Technical Capabilities

MD-NEXT FFS extraction provides comprehensive data access, ensuring complete recovery of system files, application data, deleted content, and forensic artifacts that conventional partial extraction methods cannot retrieve. MD-NEXT’s advanced architecture supports seamless integration with industry-leading System-on-Chip (SoC) platforms, including Qualcomm ,Exynos, MTK and UNISOC chipsets.

Our development team maintains continuous compatibility updates, ensuring immediate support for emerging flagship devices upon market release. This proactive approach eliminates investigative delays caused by unsupported models.

Core Technical Advantages

Universal Device Compatibility: MD-NEXT supports comprehensive data extraction across diverse device categories including smartphones, feature phones, IoT devices, smart televisions, unmanned aerial vehicles, and cloud services, providing a unified solution for multi-platform investigations.

Extensive Operating System Support: Our platform maintains compatibility with over 15,000 device models across multiple operating systems including Android, iOS, HarmonyOS, Windows, Tizen, KaiOS and more.

Advanced Physical Extraction Methods: MD-NEXT employs multiple extraction vectors including Bootloader manipulation, AnyLock Bypass protocols, ADB Pro (T1-T5) advanced debugging protocols, Fastboot interface utilization, JTAG boundary scan testing, and chip-off memory analysis for maximum data recovery potential.

Next-Generation Hardware Integration: Our proprietary MD-PLUG hardware platform delivers full filesystem access through both generic extraction methods and exclusive hardware-accelerated acquisition protocols, ensuring optimal performance and data integrity for mission-critical investigations.

Evolving Logical Extraction : ADB Backup, iOS Backup, Manufacturers’ backup protocol, App Downgrade, App Backup, App Plus and next thing by evolving new logical extraction technology.

Professional Implementation

MD-NEXT represents a comprehensive mobile forensic solution designed for law enforcement agencies, corporate security teams, and digital investigation professionals requiring reliable, court-admissible evidence extraction from modern mobile devices.

 Contact our sales team to request a demo of MD-NEXT in your forensic investigation and discover how our advanced capabilities can expand the scope of your investigations.

A round-up of this week’s digital forensics news and views:

Digital forensics experts reveal Bryan Kohberger’s preparation for Idaho murders

Digital forensics experts who were set to testify at Bryan Kohberger’s trial reveal evidence showing the convicted killer prepared extensively for the quadruple murders of University of Idaho students. Heather Barnhart and Jared Barnhart from Cellebrite discovered that Kohberger deliberately powered off his phone during the exact window of the November 2022 killings, downloaded detailed reports on serial killers, and used VPN technology to hide his online activity. Analysis of his digital footprint showed obsessive research into murder cases, scrubbed files, and evidence his phone had connected to WiFi at a restaurant where two victims worked.
Read more (the-independent.com)

FBI and NSPCC alarmed at ‘shocking’ rise in online sextortion of children

Tech companies reported more than 9,600 cases of adults grooming children online in the UK during just six months last year, equivalent to about 400 cases per week. Law enforcement agencies including the FBI and UK’s National Crime Agency express growing alarm about sextortion threats targeting teenagers, with victims being blackmailed into sharing explicit images. Snapchat logged approximately 20,000 cases of concerning material in the first half of 2024, more than all other major social media platforms combined. The Guardian reports that some teenage victims have taken their own lives due to this abuse, prompting unprecedented awareness campaigns.
Read more (theguardian.com)

Brian Carrier Launches Course on Automation and AI

Digital forensics has always depended on automation, from early tools like EnCase v1 and FTK v1 that automatically detected and parsed file systems. Brian Carrier explains that automation handles intermediate steps in investigations but still requires skilled investigators to ask the right questions and understand context. He is developing a comprehensive mini-course on automation and AI in forensics through LinkedIn posts, blogs, webinars, and eventually video content.
Read more (linkedin.com)

Hannah Bailey Discusses Mental Health Support for Digital Forensics and Police

Hannah Bailey, founder of Blue Light Wellbeing and former police officer with 15 years of frontline experience, discusses critical mental health challenges facing digital forensics investigators and law enforcement. Hannah, who left policing after experiencing PTSD and cancer, now works as a psychotherapist specializing in trauma therapy for high-risk professions. She emphasizes the need for proactive mental health support rather than reactive approaches, noting that digital forensics investigators face constant trauma exposure with added isolation from working alone with screens. Bailey advocates for regular supervision sessions and culturally-aware therapists who understand the unique stresses of law enforcement work.
Read more (forensicfocus.com)

Unfurl v2025.08 Released with Enhanced TikTok ID Parsing

Version 2025.08 of Unfurl has been released with improved TikTok ID analysis capabilities. Enhanced parser now extracts milliseconds, entity types, sequence numbers, and machine IDs from TikTok identifiers, thanks to research by Benjamin Steel. The update also fixes a bug in Google Search EI timestamp parsing where leading zeros in microseconds caused incorrect conversions.
Read more (dfir.blog)

Researchers Develop Hybrid Framework for Drone Forensics Investigation

Researchers have developed a new forensic framework that combines live, digital, and physical evidence collection to investigate drone-related crimes and accidents. Dongkyu Lee and Wook Kang propose a systematic analysis algorithm specifically designed for unmanned aerial vehicle evidence, addressing the growing need for post-incident investigation capabilities. Current drone security strategies focus primarily on real-time defense measures like detection and neutralization, but this research emphasizes the importance of forensic analysis to identify flight paths, pilot information, and accident causes. The framework aims to enhance the legal admissibility of drone forensic evidence in criminal and civil proceedings.
Read more (sciencedirect.com)

LinkedIn Timestamps Decoded for Open Source Investigations

LinkedIn provides only rough time estimates like “1d” for posts, frustrating investigators who need precise timestamps for fact timelines. Researcher Ollie Boyd discovered that LinkedIn post URLs contain hidden timestamps – the 19-digit number at the end, when reduced to its first 41 bits, reveals the exact Unix timestamp of publication. This technique has been integrated into Bellingcat’s Uniform Timezone Chrome extension to help investigators extract precise publication times from LinkedIn posts and comments.
Read more (maynier.eu)

Mental Health Challenges in Digital Forensics Explored

A new episode of Truth in Data examines the psychological impact on professionals working in digital forensics and incident response (DFIR). Episode 14 focuses on the often overlooked mental health toll that forensic investigators face while dealing with disturbing digital evidence and high-pressure cases. Mental health support and awareness in the cybersecurity field remains a critical but underaddressed concern.
Read more (youtube.com)

The following transcript was generated by AI and may contain inaccuracies.

Paul: Welcome to this special episode of the Forensic Focus podcast. Today I am honored to be joined by someone whose journey and work are having a profound effect on the well-being of those in high-pressure, high-risk roles. Hannah Bailey is a subject matter expert in mental health and well-being, and founder of Blue Light Wellbeing.

She works as a psychotherapist, trauma therapist and well-being coach, supporting individuals and organizations through therapy, coaching, training, and education. But what makes Hannah’s perspective so valuable, especially in digital forensics and frontline responders, is her own lived experience.

Hannah served in frontline policing for 15 years, including roles in emergency response, CID, and major crime. Her career, while fulfilling, was not without significant personal cost. She experienced burnout, PTSD, and overcame a breast cancer diagnosis – challenges that ultimately led her to leave policing and embark on a journey of recovery and reinvention through Blue Light Wellbeing.

Hannah now dedicates her life to helping others in similar roles navigate the mental health challenges they may face. She brings not only clinical expertise, but also cultural credibility. She understands what it’s like to be in these roles, the toll it can take, and what real practical support looks like.

In this episode, we’ll be exploring Hannah’s powerful journey, the founding of Blue Light Wellbeing, and how informed approaches can make a difference for those working in digital forensics and across the broader blue light community. So whether you are on the front lines, behind the screens, or supporting those who are, this is a conversation you will not want to miss. Welcome to the podcast, Hannah.

Hannah: Thank you Paul, and thank you for that lovely introduction. I’m really delighted to be here.

Paul: It is really good of you to join us tonight. So can we begin with your background?

Hannah: Yeah, of course. I know you touched on it in that introduction. So I was a serving police officer in West Midlands Police here in the UK for 15 years. And as you rightly said, Paul, this was a career I loved – really loved.

I joined at 21. I didn’t have a degree in anything else. I hadn’t done any other career, so it was absolutely the career for me. I was very passionate about it. It was my identity. I just loved it.

And I have to say Paul, because of the work and the roles and the jobs we went to, as difficult as some of them were, I would say we laughed every day. I had a great team, great sergeant. We laughed every single day and I’m sure that was part of why it was going so well at the start for me.

But things changed. As much as I absolutely felt I was going to do 30 years service in the police, as we do in the UK, and that was going to be me… As you will know, life throws us curve balls, doesn’t it? Changes that we did not plan along the way. And I certainly didn’t.

It absolutely does, doesn’t it? And so I’ve learned that’s probably the biggest lesson I’ve learned. It did exactly that to me. So I would say probably for about two years before I left, my mental and emotional health went downhill.

It wasn’t one big thing that happened or one awful job, because I know that can be the case for some people. But I think probably the majority of officers or frontline workers who are struggling – it’s probably that repeated exposure, that sort of drip effect that we hear a lot about in frontline roles.

And I’d say that was the same for me. I didn’t think there was anything that had particularly affected me. I felt I dealt with it all really well, but obviously not. We had no training, did we Paul? No education, no awareness of it. There was a huge stigma and taboo, which I was part of by the way. I was part of that culture because I didn’t know any different.

And I would say there were a lot of changes at work as well. It wasn’t just the jobs that we were dealing with – there were a lot of changes within the structure and teams at work. And I had a lot going on at home as well for about those two years. Some issues at home.

So I think it was like a sort of melting pot for me – everything coming at once. I just didn’t have any space to deal with anything, think about anything, have a breathing space. Nothing at all. And I became quite unwell.

So as you touched upon, I had undiagnosed PTSD at the time. I wouldn’t have known what that was. I wouldn’t have even really known that phrase, I don’t think Paul, at the time. And I think I would’ve just carried on. And I did carry on because I had no idea what to say, who to turn to, who to talk to.

So I did try and carry on. And I think I probably would’ve done that until I broke. But another intervention came and I found a lump in my breast. And as you said, I had breast cancer.

So I went through breast cancer the way I think you should – the way I was taught to in the police – which was grit your teeth, put a smile on your face and get on with it. And I did. I was determined I was going to fight it and battle it and get through it and put it behind me. And so I did that.

And I didn’t face anything about how I’d got to that point, Paul, at all, or how sick I really was at the time. So after nine months off work, I went back to policing. Even with everything I had been through, I still wanted to be a police officer.

I didn’t know how else to be or where else to work or where else I might fit if I wasn’t a police officer. I had no idea. So the only option I felt was to go back to policing, determined that I would do something different and it would be different and I might look after myself. But again, I had no idea how to do that or what that entailed or what that meant.

So actually I had cancer twice. My cancer came back within a year. It had mutated, so very rare, very aggressive, with a very poor prognosis of survival.

And I think it was only then – and it probably should have been earlier than that – but only then did I wake up really and think, “I have actually got to face what’s going on here and why I am so sick.” So actually, in the end, I didn’t do chemotherapy or radiotherapy that second time.

My prognosis with those treatments was so poor and I just realized I had to rethink everything. Actually, Paul, reassess everything. I learned how to… I went to Germany for medical treatment in the end. But I researched how to be well long term – mentally, emotionally, physically, spiritually even.

I just thought there’s going to be no stone unturned. I’m going to find out how I get better and how I stay better, which I think is really important – to consistently be well, not just put a bit of a sticking plaster on and hope it will all go away, which is what I’d done so far.

And so yeah, part of that was resigning from the police for me, which even with everything I’d been through was so difficult. I was devastated to leave policing. I can see you nodding your head, so I’m sure you felt the same as well. Even with everything, I was devastated.

But it was the right choice for me, and I became very well. I faced it all – what I needed to through therapy – but physically as well. I changed my lifestyle and how I looked after myself and became very well. I realized that I probably had some skills there from policing that I could actually help others with and turn it around. I decided to retrain professionally, as you said, and come into a different career. So yeah, that’s how I come to be here today.

Paul: I think you’ve touched on so much there. Can I ask, during the period where you did become unwell through suffering from PTSD, et cetera, and then of course that awful news about breast cancer on top of that, what support did you get from the force you were working with?

Hannah: None at all. I’m sorry to say that. And I want to stress here – my sergeant and inspector were nice guys, by the way, so this is not about them being horrible people. They were nice people. And I had good practical support in that I had nine months full pay.

There are lots of jobs that would not do that. And that was an incredible gift financially – to give us that security through that time. I’m not somebody who sits here and police bashes because that’s not what it’s about. And it’s not useful. It isn’t.

But it’s about learning, because nobody had a clue mentally or emotionally, including me, how to support me through any of that at all. So yeah, no emotional and mental support at all. But practically, yes, good. And they were clear that I had the time that I needed to physically get well.

I just had no idea how to mentally and emotionally get well, and nor did they, to be honest, Paul. So yeah, we were all blind leading the blind a little bit through that period of time.

Paul: I asked the question because I quite often hear from DFIs and other people still in policing that the support they are provided is minimal at best, but in quite a few cases there actually isn’t any. And I still find that astounding.

When you consider – and I’ve said this many times now – you send a cop out onto the street, they go out with body armor, tasers, gas, you name it. They’re fully equipped to be protected physically. When it comes to mental health support, there are apps, but there is next to nothing there.

For me, that just doesn’t make sense because once someone becomes susceptible to the stressor, then it takes an awful long time to recover from that. So you’re losing that staff member or those staff members while they’re recovering. Yet that could be averted by putting in a proactive approach to doing this.

For me, it just doesn’t make financial sense not to have it there, not to have it available when it’s needed.

Hannah: Yeah, a hundred percent. And not only available when it’s needed, but – and I think you and I are probably both passionate about this – in a proactive sense as well. Because I just think policing is very reactive, isn’t it?

It’s very reactive and certainly when I was in there, we reacted to hotspots and crime spots and so on and so forth. And it’s got better over the years at looking at that proactively. How do we fight crime or hotspots or that sort of school to prison pipeline? How do we look at that proactively? And I’m like, surely that applies to mental health and wellbeing as well.

If we look at it proactively, how much of a difference we could make – not just to those individuals but the organization as a whole, the community. Every single person and group benefits if we look at it proactively.

Paul: I cannot agree more. Police have developed over the years. They are professionals out there. I’m absolutely not here to police bash if you like, because I’ve got the utmost respect for those men and women who go out on the streets and put their lives on the line on a daily basis.

Hannah: Yeah, absolutely.

Paul: In the same way, DFIs sit in front of screens every day and they are exposed to the depths of humanity. And in both cases, their caseloads are ever expanding. And there are a lot of stats out there to prove this. Yet when it comes to the development of mental health services, they stay stagnant. They haven’t changed for years.

Hannah: It is astounding. And what I would say is the shame as well, Paul, is that it’s not uniform – excuse the pun – but it’s not uniform across the forces. And I don’t know in terms of the digital forensic world, but I’m sure you could tell me if it’s uniform across different companies and organizations.

But I’m lucky enough because I’m freelance – I work with so many different police forces, and you get forces with no mental health and well-being budget. Zero. And you get forces that are really getting there with that proactive aspect coming in. They have good support, good awareness, less stigma.

So it’s really different across different police forces as well, which is such a shame because it is a little bit of a postcode lottery, and that’s a shame.

Paul: You’ve just taken the words out of my mouth. I was just going to say to you, I talk to so many DFIs across the country and some DFIs have got a great service going on. Outside of law enforcement, I know there are some private companies who are really proactive around the mental health of their employees because they want to protect them and realize the value in them.

But then you talk to other DFIs who tell you there is either nothing or the bare minimum, which isn’t even a sticking plaster in some cases. And you are exactly right. I think you used the term postcode lottery. It is exactly that. It depends where you work and what the budget is for that force, whether you get a reasonable amount of support or not.

But that shouldn’t be the case. It should be unified across the country with standards set so that DFIs are fully supported. That’s what I’ve been campaigning for a very long time now.

Hannah: Also because I think certain roles are seen as more high risk. And I do think with digital forensics – because it’s perhaps not the same physical risk for them – I don’t think it’s seen, perhaps sometimes by forces, as the risk that it is. And I would say the role they do with the constant viewing that they are exposed to – certainly in terms of mental health and well-being – they must be one of the most high risk. I would suggest that.

Paul: Absolutely. I can’t think of another job either in or outside of law enforcement which is such a constant trauma-facing role.

Hannah: Yeah, I agree. And also, because when you are looking at stuff on screens or any of the digital formats all the time, you are not getting that same human connection that you might do on a team going out to a job or even just being crewed up in a car with somebody. And then, I don’t know, like all going out to a job as a team to put a door in or something.

So you’ve got more isolation kicking in, I would say, in a digital forensics role than you do in traditional sort of frontline policing. And that would then always increase the risk of the trauma exposure.

Paul: I would absolutely agree. Can we talk about some of the work that you do with DFIs and other forces and such?

Hannah: Yeah, absolutely. Thank you. So I do a mix of things really. In terms of going into different forces or other similar organizations like the NCA – those kinds of law enforcement or investigation roles – I go in and really do different types of training and education, I would say.

Depending on what a team is struggling with at the time. So often around resilience, overwhelm, burnout, PTSD. I go in and talk about my personal experience, because as you just said, that helps a little bit with that credibility, that connection. They know I understand their world.

It really does because they know that what I’m talking about, I really genuinely understand. And I’m genuinely trying to find those ways to help them – not in a bit of a tick box type way. So that would probably be the most common areas that I go in and help those roles with.

But sometimes it’s quite specific, so it might be around FLOs, SIOs. So particular types of roles they’re undertaking. Child sexual exploitation is a really common one because the level of trauma is just so high.

Sometimes the other one as well is change management. So a lot of companies and businesses have change management specialists and that sort of thing. I’m not one of those – I didn’t mean that badly either to change management specialists. Sorry. Nothing wrong with what you do, but I don’t do that.

But I do it in terms of the mental health side of significant change within an organization, because I know how much it affected me, Paul. At a time that I was struggling, we also went through significant change on the teams.

I didn’t know my supervisors, I didn’t know any of my colleagues. And I think that matters so much when you’re in such high risk and demanding frontline roles. You really need to feel comfortable to be able to speak out, and if you don’t know anybody or you don’t trust them…

And also Paul, I thought that they didn’t really know me, so they didn’t know my reputation – that this wasn’t me. It was really unlike me to struggle or not settle or not be able to deal with jobs in the same way. That was so unlike me. So I felt they didn’t know me either. So I didn’t want to speak up and say I was struggling.

Significant change in these types of roles in organizations is a massive impact on mental health and well-being. And so I often go in as well and deliver inputs and training around that. So yeah, that’s what I tend to do for organizations.

And then I work with individuals as well with trauma therapy and well-being coaching. And I think that’s really important to highlight because, again, you and I would be passionate about people… It would be so great if people came a bit earlier. It really would.

So I think it’s one of the myths I like to dispel if I can about therapy. I think people think – certainly in these roles – you go when you’re broken and you are on your knees. And I do get, of course, people who come at that stage, but it’s lovely if I actually get people that are coming earlier – maybe struggling or something not going quite right and they could just do with a bit of help, support, that coaching side.

And it’s really useful. And like you said, much quicker, that proactive side – much quicker to get you back on your feet and get you back into the role or work or life that you love. So yeah, it’s one of the myths I want to help dispel: please come earlier if you can, when you’re struggling and just need a bit of support.

Paul: This is why I’m a big advocate for the proactive approach to mental health, whether it be in digital forensics or uniform frontline cops or indeed, private companies who employ DFIs. Because for me, the proactive approach could take the form of psychoeducation prior – long before anybody succumbs to the stressor, should I say.

If, in my opinion, individuals are taught about what PTSD is, what it looks like, what the signs and symptoms are, how it can affect you physically, how it can affect you mentally, then the earlier they recognize those signs and symptoms and are then able to find the help to reduce them, then the stronger they become, the more resilient, the more productive they continue to be. And I advocate for that time and time again. Mental health support needs to develop.

And I think that echoes beautifully in what you’ve just said.

Hannah: Yeah, and it’s interesting that you said the word psychoeducation, because that is what I start nearly every training input with. Because if we don’t understand how the brain works well and how it processes stress, shock, and trauma – which our brains can do really well and really efficiently, and it’s set up to do that.

But what happens when it goes wrong? What does it look like when it goes wrong or feel like? As you said, what are those signs and symptoms? And then really importantly – we were discussing this, weren’t we, just before we started – the fact that we can put this right. Actually we can recover from this.

And you and I are sitting here as examples of that, having both been through our struggles with PTSD and mental health and are really well. Doing really well, really healthy, really balanced. That function in our brains to process stress and shock and trauma is back fully functioning again, and it’s absolutely repairable and recoverable. It’s such an important part of that education for them.

Paul: It absolutely is. Like you said earlier, taking that decision to resign was one of the hardest things you’ve ever done. I absolutely know where you are coming from. I will openly say, when I walked out of the station on my last day, I was in tears.

Hannah: Yeah.

Paul: But at that point, I had some level of insight into the fact that I was really unwell. And I remember vividly the first time I met the therapist who I worked with. I was absolutely terrified.

Hannah: Yeah.

Paul: Absolutely terrified to open that box and share what was inside. I’m thankful that the therapist that I worked with was absolutely amazing. She just got it.

Hannah: Good.

Paul: But I’m thankful also that she was culturally aware as you are. Because I recently attended a conference and this really shows how important it is to have a background such as yours.

I was recently at a conference where one of the delegates told me that they were a practicing DFI and they shared that they had a psychologist who regularly came in to see them, which they benefited from massively. But during a group session that was being held, one of the DFIs shared a particularly traumatic case, which upset her so much she left and never came back again.

Now I have to say from my point of view, the message that sends to a DFI is “nobody can deal with this.” Whereas, because you’ve lived it, you haven’t just done the job, but you’ve lived the experience of being unwell. You’ve lived through the stresses and you’ve come out the other end a much stronger, more resilient, better person. And I think the cultural awareness attached to therapy is highly underrated right now. I don’t think people realize the value of that.

Hannah: Yeah, no, I completely agree with you. In fact, I think the people going for therapy absolutely value that, like almost more than anything actually. But I don’t think perhaps leaders and organizations do, and they set up, let’s say an EAP, and as long as that’s provided and funded… I think sometimes, if I’m honest, they’re not that bothered how effective it is. It’s just set up and it’s available. That’s being honest.

And you are absolutely right and I hear this actually time and time again, exactly what you’re saying. I had a client who was involved in something incredibly traumatic and before she came to me was detailing that to her counselor. And the counselor got almost a little bit cross and said, “Look, you do know this is distressing for me, don’t you, as well?” when my client was crying. I know. I can see you shaking your head. Exactly. That’s what I was like. I just don’t think you should be a therapist, I’m going to be honest, if you can’t hear other people’s trauma.

But yes, that cultural awareness. And so of course my client felt like she couldn’t talk about that, that she was upsetting the counselor. But also, as you said, you just think “my trauma must be so awful. A counselor can’t hear it and a counselor’s upset by it.”

So you just start to think that you’re in this most awful place that you can’t recount this hideousness that’s in your head and that you can’t get better from it or be relieved from those traumas that it’s causing. And that’s not the case at all.

And yeah, you are right. For me, I don’t want to sound like “aren’t I hard-nosed?” But it doesn’t shock me and there isn’t anything that’s going to shock me I don’t think anymore. I can listen to that as both a therapist and an ex-police officer who has been on both sides of those, and I think that’s really important.

Paul: I think it’s super important.

Hannah: Yeah.

Paul: The sad thing is there aren’t that many culturally aware therapists.

Hannah: And that is the shame, isn’t it? We need people to leave policing and come and be a therapist. And I think that’s growing, Paul, if I’m honest. As we’re talking, I think it’s growing, but you’re right. There’s not enough.

I think you can be… Are there people out there that I’ve met as therapists and they’re not ex-police or whatever, and just seem to have an innate understanding, to be fair to them? Yeah. I don’t know where that comes from, but they do seem to have an innate understanding and a way of taking on that type of job and trauma.

So can it exist without our backgrounds? Yes, it can. But is it much more credible or likely if you’ve had our backgrounds? Yes. Probably.

Paul: Yeah, I agree. So I know you trained in Brain Working Recursive Therapy. Can you tell us about that and how that applies to the therapeutic process?

Hannah: Absolutely. So just to say again from a client perspective, how I found BWRT was looking for a therapy for my PTSD. So I had been in probably more traditional therapy, if you want to call it that, for about 18 months, two years. And it was useful. This is not me saying that’s not useful – it was, and I had got to a much better place and was doing much better.

But I still had what I would phrase as hideous flareups of PTSD. Hideous. And they would just overcome me, probably last for about three days of physical pain, almost paralysis, anger, shame, bitterness – it all came out Paul in those three days. So it was not a pretty sight.

I couldn’t work, that kind of thing. I just survived really for the three days or so, and then felt like I’d been in a punch up and a fight for about a week afterwards. And then would get back to life and my normal life as it was then – in a better place.

So I was searching really for something that I just thought, “I just don’t want this anymore. I don’t want to manage PTSD anymore. I do not want it.” And they are different things. The reason I found BWRT was through searching online.

One of the things I loved about it is that you actually don’t have to recount your trauma in great detail. And I hadn’t really heard of that before and I felt I’d done a lot of that with the two years of therapy I’d had. And you don’t, and that’s quite unusual for therapy.

So you obviously have to know some of the content of what people have been through, but I think if you think of policing, of DFIs, all that, you actually don’t have to recount the trauma in great detail. And it really spoke to me that would be something I’d like to do and it’s quite quick and effective.

And I just thought, “I’m going to go for it.” And it was brilliant and it was all that it just said and promised, and I have never, ever had since then any flare ups of PTSD. I’ve had no nightmares, no flashbacks, nothing like that, no symptoms at all of PTSD. So incredibly life changing for me. And so I decided to train in it as well.

I was already a well-being coach but I thought actually people were coming to me with more trauma because of my contacts and backgrounds. I didn’t really feel equipped to deal with that as just a well-being coach. I thought, “I’m going to train in this.” So I gained my qualifications in it as well.

Level one and level two – they’re not actually better than each other. Level one and level two are just different approaches, different ways of dealing with trauma. And it absolutely transformed how I dealt with trauma clients. It’s just been incredible since that time.

And I also wanted to do more qualifications. I like learning. So you can never stop learning about the brain and the body really, can you Paul? To be honest. So I do, I love learning as well, but I wanted to get those qualifications to be recognized in this field.

And so I did a level seven post-grad in trauma therapy as well. And as fantastic as that was, and as much as it massively added to my skillset, understanding, education – it is still BWRT that I go back to with nearly every client.

Paul: Incredible. It’s interesting that you’ve got such a wide skillset actually, because that must allow you to pull from each therapy if you like, to individualize it for a client.

Hannah: Yeah, absolutely. And I do love that bit of it because people might come with really similar stuff, but everybody’s different aren’t they? And there is not a one size fits all with therapy. So I do love that side and I love that.

Where I’d say my trauma therapy and BWRT comes in is helping almost with all your past stuff, if that would be the right word. We help resolve or move or shift that trauma. But the well-being coaching is like looking ahead and how do you move ahead now? Because therapy can be great, but I would like people to be well long term.

So how do I help them with that? What does that structure look like? The boundaries, what skills or experiences could they try or give a go or be open-minded to? So I love that it’s all encompassing. I hope with those different hats that I wear.

Paul: I’m actually smiling, because what you’ve just described is the therapeutic process that I went through myself.

Hannah: Brilliant.

Paul: So all I expected was for the therapist to deal with the weight I was carrying of the trauma that I had been exposed to. What I didn’t expect during the process is the fact that she was going to make me stronger going forward.

Hannah: Yeah. Brilliant.

Paul: And she absolutely did. The process itself – speaking from experience, for me personally, it was a difficult one to start with, but as the process went on, it became a lot… I don’t want to say easier, but a lot smoother. It became almost natural to open up and discuss really difficult things with her. And just like you, I came out the other end a much better, much stronger, much more resilient person for it.

I’ve been asked, like we discussed earlier, I’ve often been asked, “If you had to go back into therapy, would you do it?” In a heartbeat.

Hannah: Yeah, agreed.

Paul: Knowing what I know now, I would do it in a heartbeat.

Hannah: A hundred percent and I would do it earlier, certainly for me as well. When people say “I should have come to you earlier,” I say, “Look, I had PTSD and two lots of cancer before I woke up and realized I better have therapy.” So I get that. I’m the queen of avoiding therapy, but so I really understand.

But a hundred percent I would do it. I’d do it again and I’d do it earlier. And Paul, I have to have supervision for the work I do. And so it just becomes natural just to take this to them, talk it through, let’s find a solution. Let’s work it through.

If I need a cry, I don’t often now because I’m in a different place, but if I need a cry with some of the stuff I hear all the time, then I have a little cry or get angry or get despairing, and then we work it out and I’m good to go. So I know the benefit of it. So does my brain. It knows that. It knows it will be better once we’ve done that.

Paul: So you’ve just mentioned something really interesting there, and it’s something that I’ve thought if it was applied in digital forensics as a proactive approach, as part of the proactive approach, it would help spot those early warning signs. And that is, you mentioned supervision right now, just like you.

As I work in the NHS now as a psychologist, I get weekly supervision where I go and talk to a colleague of mine who is also a qualified psychologist, and we will talk about the caseload that I’ve got and how I feel about that.

It is an excellent opportunity, not just to offload, but to gain another opinion on difficult cases that you’re working with, which massively helps reduce stress that you’re carrying.

Hannah: Hugely.

Paul: I’ve often thought, and I’ll be interested to hear your views on this, if this was applied in digital forensics, whether it be a weekly or biweekly meeting with say a mental health first aid trained individual, I’ve often thought that would in itself help DFIs offload.

Hannah: I completely agree. And what we’re missing is there are so many benefits, not just the offloading as you said. I mean that in itself… And everybody knows that, don’t we Paul? If you just go and meet a mate at the pub and offload, that feels better, that feels nicer. So we know that helps people to come in, talk and offload.

There are so many other things as well. If you are sitting with somebody trained, they can look for certain signs, certain words, certain… even just facial expressions or how the energy or the mood drops when they talk about certain things or people about their job.

So that trained person could look for things as well. But the other thing we’re missing is, again, which I didn’t have, but I do have with supervision, is building that trust. And if you saw somebody every week or even every month, just even to chat if you want, about holidays…

What happens in the brain is that you start to build trust, connection, rapport, relatability, credibility, all those things so that if there’s a time that DFIs or anybody else needs to then say “this has actually been really shit,” or “I’m struggling with my workload” or whatever that is, it’s 10 times easier to say to somebody that you’ve been meeting every week, every month, and have gotten to know, and got to trust and got to relax around, and all those things that the brain likes. It loves all those things, and we would be providing that for them and it would make it 10 times easier to start having those conversations earlier.

Paul: Yeah, I absolutely agree. It’s all about building that safe, non-judgmental space where someone can genuinely offload and become far more relaxed and de-stressed than when they walked through the door, isn’t it? It’s about building up that trust.

Hannah: Yeah, and I think coming back to that, as you said, that cultural awareness and credibility, I think that trust already is built. When they come to people like you or me, because we’ve had those backgrounds and those roles, there’s already a level of trust there.

They know I’m not going to judge them. For example, if they want to… people talk to me as I’m sure they do to you about these horrific jobs and they often talk quite clinically, quite coldly, quite matter of factly. There’s no particular tears or distress about some of it. And they know I don’t judge that. That’s not because they’re these cold monsters or anything. That’s just how they have to talk about their work.

And that’s completely normal to me actually. And also making jokes about it and stuff – those are all completely normal. So that trust and that non-judgment bit is there already.

Paul: It is. And when you talk about the clients that come to you and the way they talk about the trauma that they’ve been exposed to, I think from my point of view, when I reflect, you talk about it so openly with someone who understands, and to quote you, in quite a cold manner because you become normalized to it.

Hannah: Yeah.

Paul: It’s what happens, it’s what you’re used to. It’s what you see every day.

Hannah: Actually weirdly as well, talking about it normally I think can help the brain process it.

Paul: The way people talk about the trauma, you’re right, it must come across to people who haven’t been exposed to that in quite a cold way, but you become normalized to it. It becomes their normal, doesn’t it?

Hannah: Yeah it really does. And I think actually that’s right. I think there’s a line, isn’t there, Paul? Between having to normalize what they see and deal with – they have to, or their brain won’t process it at all. If everything is this incredibly heightened times a hundred trauma, their brain won’t be able to process that every day.

So if they normalize it, you can process it much better. But I know it also moves into a line of when you’re so desensitized that you lose all emotion or all connection and stuff. And that starts to affect, obviously, as we know, your private life and your relationships.

And I think it’s quite a fine line to be fair for DFIs, for law enforcement – how emotionally involved you remain in your job, but in your life as well. So yeah, I think they have to normalize it to a level that hopefully remains healthy.

Paul: Yeah, we’re drawing to a close now. Hannah, do you have any final words for the DFIs and everyone else watching out there?

Hannah: I think we’ve touched on it a bit, but if you don’t mind me just finishing off, I want to dispel a few myths a little bit really with modern therapy because I think it’s part of the stigma of people not coming forward. So maybe we could dispel some of them.

Just to finish off, my first one I’ve already touched on: please don’t think you have to be broken to come for help. You really don’t. So come as early as you’d like. Even if just for a chat to talk something through, to get different boundaries, different structure, whatever. Come as early as you’d like. Please don’t wait if you just want some help.

The second is that, again, we’ve touched on this – modern therapies have really moved on and absolutely there is a place for talking in depth regularly with a counselor or a therapist, but there are lots of different modern therapies and BWRT is one of them, but there are lots of others.

That genuinely are moving people on differently, more effectively, more quickly. So come and explore the different therapy options. Chat to people, chat to specialists, get word of mouth, anything like that, but explore it before you shut it down and think “I’ll just be stuck in therapy for two years and not move on” or “lying on a couch” or whatever people think therapy has to be.

Paul: Which is not the case, not these days, right?

Hannah: Really not. No, it’s really not. It’s got much more modern. Do your research and find somebody. I think any therapist worth their salt would give you a free consultation. I do. So that you can chat, ask questions: what does it involve? How long, roughly might this take? Costs involved, that sort of thing. So yeah. It’s really different now. Give it a go and give it some research.

And then lastly – and I’m so glad we are both on this page – accepting that you need therapy is not some downward spiral to the end of your career or life. It’s really not. In fact, the opposite for you and I, isn’t it Paul? This was absolutely the door to me being well and stronger and more positive and having this amazing life that I have now.

So this is not a one way street with no light at the end of the tunnel. It can be a really positive, life changing for the good approach to take. So yeah, I’d love people to know those things about therapy.

Paul: Thanks for that. I really appreciate those final words. I think people watching will realize it’s not a sign of weakness to seek therapy. It’s actually strength.

Hannah: It really is. Yeah.

Paul: It really is. It takes a lot of strength to do it. It takes a bit of strength to begin it, but as you progress, it gets easier and you become a much healthier person.

Hannah: You really do and actually you’ve touched on the best bit, honestly. The hardest bit is probably writing that email or text or whatever to a therapist and then going to the first session. That probably is the hardest bit. And I promise after that, pretty much for me, you and all my clients, it gets easier from there on. It really does.

So yeah. Get through that really horrible first bit and it gets better.

Paul: It really does. And I speak from experience when I say that.

Hannah: Yeah. Me too.

Paul: Hannah, it’s been amazing. Thank you very much for joining us tonight. We will include your contact details. I’m sure if anybody sees this podcast – obviously we’ll share your contact details – if they reach out to you, I’m sure you’d be happy just to speak to them as well.

Hannah: Always. And I think that’s what we try to make as accessible as possible. Just reach out, drop me an email, we’ll have a chat. No pressure at all. Let’s just talk through where you are and what options there are and we can go from there.

Paul: Fantastic. Thanks again for joining us, Hannah.

Hannah: Thank you so much for having me on.

Paul: My pleasure. Bye-bye.

Hannah: Bye-bye.

Check out our most recent on-demand webinars:

Validation, Automation, or DIY: Choosing the Right Tool for the Job

In the world of DFIR, one size rarely fits all. Sometimes, the goal is validation — ensuring work meets a defined standard. Other times, the sheer volume of data demands automation, though the costs in time, resources, and complexity can offset its benefits. Occasionally, the most efficient solution is simply rolling up your sleeves and tackling the task manually. Join John ‘Zeke’ Thackray and Keith Lockhart as they explore the pros, cons, and trade-offs of validation, automation, and DIY approaches in digital forensics.

Watch this 14-minute discussion about choosing the right digital forensics tool.

Five Ways Geo-Location Data Can Impact Your Investigation

Join Amanda Mahan and Keith Lockhart for another Oxygen Tech Byte where they can’t wait to talk about geo-location data on some topics that just never stop being of interest, especially with the prolific collection of location data we all live with in 2025!

Watch as 5 different impacts of geo-location data are covered in 18 minutes.

USB vs OTG: Acquisition Versatility at the Forensicator’s Fingertips

Join Ryan Ebersole and Keith Lockhart for the next iteration of Oxygen Forensics Tech Bytes where they will discuss USB-based collections and the unmatched versatility of multi-format USB adapter tools for focused data targeting, triage and acquisition. Ideal for field operations or controlled lab environments, their portability and cross-platform and multi-device capabilities make them indispensable in modern forensic workflows.

Watch this 16-minute discussion of USB vs OTG for digital forensics.

You can find the full list of informative on-demand Oxygen Tech Bytes webinars here.

About Oxygen Forensics

Oxygen Forensics is a global leader in digital forensics software, enabling law enforcement, government agencies, enterprises, law firms, and service providers to gain critical insights into their data faster than ever before. Specializing in remote and onsite access to digital data from cloud services, mobile and IoT devices, drones, device backups, UICC, and media cards, Oxygen Forensics provides the most advanced digital forensics data extraction capabilities, innovative analytics tools, and seamless collaborative analysis for criminal and corporate investigations to bring insight and truth to data.

# # #

Want to share an investigation with us?

We’d love to hear how our software supported you in solving your investigation. Please
contact us at marketing@oxygenforensics.com

What inspired you and Paul Wright to create The Coalition of Cyber Investigators?

Paul and I initially established The Coalition of Cyber Investigations as an OSINT, Investigations and Digital Forensics think-tank to provide a platform to collaborate, share our 80+ combined years of professional experience and provide analysis of topical issues in the converging domains of investigations, digital forensics and OSINT. That convergence has created grey areas around admissibility, process integrity, ethics, context, and validation. The Coalition is our way of advancing the conversation so OSINT-derived evidence can be used properly and effectively.

However, very quickly we started getting asked to take on commercial work – training, OSINT, forensic product assessments, and investigations – and the Coalition has grown from there.

What is the Coalition’s mission and what types of cases do you take on?

Our mission was originally to help OSINT become standardised as a profession, with globally agreed methodologies, standards and training. However, as we are both investigators, we were increasingly being asked to conduct investigations – frequently in the investment fraud space, which led to Lajos Antal (Hungary) joining the Coalition and helping us establish a dedicated boiler room investment fraud practice.

How do you approach boiler room investment fraud investigations, and what makes them so complex?

We combine a comprehensive OSINT toolkit/approach with advanced cybercrime investigation and digital forensic procedures, underpinned by decades of casework. That lets us assess – with a high degree of confidence – whether an investment scheme is legitimate or a scam and gather more details on the criminals behind it. We apply the same methods for proactive validation so clients can avoid scams in the first place.  These scams are becoming increasingly complex as they are now totally technology driven – for example, they have real trading platforms, CRM systems, professional marketing operations, and personas and websites which are AI generated, so it’s increasingly difficult for the untrained eye to spot the warning signs.

You also publish research and thought leadership—what topics have you been focusing on lately, and why?

We’ve recently been focusing on a series of articles centered on the “OSINT cowboys” – these are the types of people that do not understand the importance of evidential integrity, ethics, safeguards and operational security measures. Our aim is to highlight the need to professionalise the domain of OSINT by shining a light on the bad behaviours and methods that cowboy practitioners use, especially where evidence needs to withstand legal scrutiny.

Are there any tools or platforms—commercial or open-source—you rely on regularly and recommend?

We are very wary about tools which label themselves “forensic” as often they are the very opposite, creating a risk that inexperienced practitioners could use them in the belief they are doing the right thing, but in reality, they are not adhering to the basic requirements of handling digital evidence which could ultimately jeopardise any formal proceedings. As a baseline, we tend to look for capabilities including (but not limited to) hashing, robust audit trails, preservation of metadata, repeatability, clear chain‑of‑custody support, and ownership transparency – regardless of whether the tool is commercial or open‑source.

What’s next for you and the Coalition—any new projects, training, or research in the works?

We are currently developing some bespoke OSINT training for law enforcement and also for regulators. And of course, we are constantly refining our methodology for Boiler Room Investment Fraud investigations as this is a really hot area for us right now.

And finally, what do you enjoy in your spare time?

My passion is motorcycles – it’s how I clear my head and do some real thinking. I currently ride a Triumph Tiger 1200 and a Ducati Scrambler 1100 (not at the same time :)).

Latest News

Recent articles, blogs, and social media posts have raised concerns that, in many agencies and organizations, digital forensics is devolving into mere “button pushing,” with many of these so-called “button pushers” trained only to a basic level or familiar with a specific tool, without fully understanding how the tool works or how to explain its findings. This concerning trend is rooted in a multifaceted array of challenges, including significant budgetary constraints, a persistent lack of adequate personnel, and a pervasive scarcity of comprehensive training or the necessary funding to provide it. Furthermore, the desire for a one-stop-shop solution often overshadows the need for deep understanding, contributing to overwhelming workloads and persistent backlogs.

Currently, digital forensic labs face an overwhelming and ever-increasing influx of cases with no end in sight, as the backlog of digital evidence continues to rise. As a former law enforcement executive managing a large investigative work unit and a state digital forensics lab, trying to find the right balance between efficiency, effectiveness, and accuracy to minimize the backlog was a challenge. While one must be efficient in their examinations, they also must be diligent to ensure truth and justice.  

Currently, many agencies and forensic units are exploring workflows that balance the skills of highly trained digital forensic examiners (DFEs) with the efficiency of digital evidence technicians (DETs), but these workflows have yet to be perfected. With diverse skill sets, it’s important that departments are aware of each position’s strengths and weaknesses and how to best integrate both skill sets into their forensic workflows.

Playing to Each Role’s Strengths

DFEs are highly skilled professionals trained in deep forensic analysis, capable of extracting, interpreting, and presenting complex digital evidence. Their role extends beyond simply running forensic tools – they must understand artifacts, reconstruct digital activity, identify anomalies, and ultimately, explain their findings in a manner that is commonly understandable and admissible in court. Some of their key strengths include:

• Expert Analysis: Uncover deleted data, reconstruct user actions, and analyze system logs.
• Courtroom Testimony: Confidently articulate findings, defend methodologies, and withstand cross-examination.
• Case Strategy: Work closely with investigators to shape digital evidence collection and analysis around case priorities.
• Custom Solutions: Adapt forensic methods when standard tools fail, developing scripts or using novel techniques to extract and analyze crucial data.

By comparison, DETs, while less formally trained in forensic analysis, serve a critical function in digital evidence processing. Their primary responsibility is the acquisition, processing, and initial triage of digital evidence. They operate forensic tools to extract standardized datasets, allowing DFEs to focus on complex examinations. Additional key strengths include:

• Efficiency: Handle routine data extraction and processing to free up DFEs for high-level analysis.
• Scalability: Enable forensic labs to process a greater volume of evidence by distributing workloads.
• Workflow Automation: Leverage forensic software to automate reporting and data filtering, reducing bottlenecks in casework.
• Cost-Effective: Typically require less resource-intensive training than developing full-fledged DFEs.
• Expediting Investigative Leads: Rapidly identify and extract immediate investigative leads such as obvious contraband, flagged keywords, or recent communications, allowing investigators to progress their cases without significant delays, preventing investigations from stalling while more in-depth DFE analysis is pending.

Relying too heavily on DETs may lead to incomplete or misinterpreted forensic results. Forensic tools, while powerful, cannot replace the expertise of an examiner who understands the underlying data. Automated processes may miss critical context, and improper handling of evidence could compromise a case. On the other hand, DFEs are often bogged down with routine tasks that do not require their level of expertise. The backlog of digital evidence can lead to delays in criminal investigations, sometimes rendering digital evidence less useful due to procedural and technical time constraints. That’s why it’s important to play to each role’s strengths.

Best Practice Workflow: Integrating DETs and DFEs

A hybrid model that leverages both DETs and DFEs can optimize efficiency while maintaining high forensic standards. Below is a suggested workflow:

• Evidence Intake & Logging (DET): Proper documentation, chain of custody, and initial categorization of devices.
• Preliminary Data Acquisition (DET): Imaging devices, verifying hashes, and applying automated triage tools to flag relevant data for immediate investigative leads.
• Data Processing & Indexing (DET): Running forensic tools to generate reports on common data types and identifying immediate “low-hanging fruit” for investigators.
• In-Depth Analysis (DFE): Investigating anomalies, recovering deleted files, examining logs, and conducting advanced analysis beyond routine extractions.
• Quality Control & Peer Review (DFE & DET Collaboration): DFEs review DET-extracted data for completeness, and DETs assist in cross-referencing.
• Report Preparation (DET & DFE Collaboration): DETs compile structured reports, while DFEs provide in-depth explanations and expert opinions.
• Testimony & Case Support (DFE): DFEs appear in court, with DETs assisting with technical documentation.

This tiered approach ensures that critical investigative leads are identified swiftly, allowing investigations to progress, while detailed, complex analysis is still performed by highly skilled DFEs when needed.

Empowering Growth Through Defined Roles and Career Tracks

While acknowledging that not all agencies possess the resources to employ both DFEs and DETs, and many law enforcement professionals currently perform a combination of investigative, examiner, and analyst duties, the increasing prevalence and importance of digital evidence suggest a growing need for investment in specialized personnel, tools, and training.

This specialization also opens up valuable career path opportunities within digital forensics. Formalized titles and clear role delineations, such as those of the DFE and DET, can provide structured advancement paths for individuals entering the field, from foundational technical roles to advanced analytical and expert witness positions.

Ultimately, regardless of the specific titles used—be it Digital Evidence Technician, Digital Forensic Examiner, or others—the critical element is a clear delineation of responsibilities, continuous training, and robust quality control measures. This strategic division of labor is designed to ensure justice is served efficiently and effectively in the face of an ever-expanding digital landscape.

That’s the philosophy behind Amped Software’s training programs, where image processing and forensic science meet real-world application. Amped’s goal isn’t just to teach you how to use their tools; it’s to help you understand the “why” behind every click.

In their classes, Amped’s expert trainers go beyond teaching you how to use our tools; they also cover the scientific theory behind forensic image and video analysis. Amped believes that understanding the theory is essential to becoming a better investigator.

The expert-led sessions combine hands-on software practice with foundational scientific concepts, from understanding compression and video encoding to applying proper methodology in evidence analysis and processing.

Tools may evolve and change but scientific understanding stays with you throughout your entire career.

Explore Amped’s Training Programs – Learn the Tools and the Science

No matter your role or experience, there’s a course designed to meet you where you are, and take you further.

Amped FIVE Training

Your foundation in forensic video enhancement starts here. Learn how to handle, process, clarify, and present video evidence, all in one single tool and while following proper forensic methodology.

August 18-22, 9 AM – 1 PM CEST, Online

August 26-29, 8 AM – 4 PM CST (USA), Kansas City, MO (In-Person)

September 15-19, 11 AM – 3 PM EDT USA/Detroit – EDT (DST: GMT −4), Online

October 27-31, 9 AM – 1 PM CEST (Rome, Italy time)

November 4-7, 9 AM – 5 PM CET (Rome, Italy time), Amped HQ (In-Person)

November 10-14, 9 AM – 1 PM CET (Rome, Italy time), Online

Amped FIVE Additions

Already comfortable with FIVE?

This course unlocks its extended capabilities, from advanced aspects of video decoding and processing to deeper filter usage and investigative workflows. Ideal for users looking to push the software to its full potential.

Amped Authenticate Training

Learn how to verify image authenticity and uncover tampering. Amped Authenticate gives you the tools to conduct scientific image integrity analysis, and the training ensures you understand the forensic concepts and methodology behind it.

September 22-26, 9 AM – 1 PM CEST (Rome, Italy time), Online

September 29 – October 3, 11 AM – 3 PM USA/Detroit – EDT (DST: GMT −4), Online

October 7-9, 9 AM – 5 PM CEST (Rome, Italy time), Amped HQ (In-Person)

Investigating Video Evidence

This course is ideal for investigators, analysts, and first responders. You’ll learn how to convert proprietary video files, process video evidence, apply basic corrections and prepare the evidence for presentation. You will ensure its value and admissibility are maintained from the moment it’s seized.

Customize Your Learning Path with Focused Training Modules

After completing Amped FIVE training, you can tailor your learning with specialized add-on modules. These are designed for professionals who need targeted skills based on their role or casework focus.

Video Evidence Presentation

Learn how to present video evidence in clear, accurate, and compelling formats for investigative reports and courtroom use.

Measurements and Speed Estimation

Working on traffic cases? This module teaches how to calculate speed, distance, and real-world measurements from video evidence.

File Analysis and DVR Conversion

This module teaches the technical processes of analyzing proprietary video formats and converting DVR files accurately, without compromising evidence integrity.

October 21-23, 9 AM – 1 PM CEST (Rome, Italy time), Online

Amped FIVE Updates

Stay up to date with the latest features, workflows, and improvements in Amped FIVE. This module ensures your knowledge evolves with the software.

November 25-27, 9 AM – 1 PM CET (Rome, Italy time), Online

Prove Your Skills with the Amped Certified Examiner (AFCE) Certification

After training with Amped FIVE, you’ll be ready to take the Amped FIVE Certified Examiner (AFCE) exam. This professional certification tests your theoretical and practical aspects of forensic video analysis with Amped FIVE.

However, it also goes beyond software skills. The AFCE tests your understanding of image and video forensics, from compression to methodology, and gives you the credentials to back your expertise.

It’s not just about knowing how. It’s about proving you do.

Start Learning, Start Leading

You handle critical evidence. You write and produce reports that are presented in court. You influence investigations and outcomes.

Amped Software training gives you the knowledge, skills and insight to face your everyday challenges in digital multimedia evidence processing.

Digital Forensics Expert Offers Guidance on Starting DF Business

Patrick Siewert provides comprehensive advice for aspiring digital forensics entrepreneurs in the first part of a three-part series on starting a digital forensic business. He emphasizes the importance of choosing a clear, professional company name, carefully selecting target clientele, and establishing solid business foundations including mission statements and proper legal structures. Siewert warns against common pitfalls like taking on undesirable clients and reveals that major forensic tool providers make their products deliberately expensive and difficult for private practitioners to access, often due to pressure from their primary law enforcement customers.

Read more (dfirphilosophy.blogspot.com)

Hashcat v7.0.0 Released with Major Performance Improvements

Hashcat releases version 7.0.0 after two years of development, featuring over 900,000 lines of code changes and contributions from 105 developers. Major new features include an Assimilation Bridge for integrating external resources, Python Bridge Plugin for rapid hash-matching implementation, and hash-mode autodetection. Performance improvements include up to 320% speed increases for scrypt and major optimizations for NTLM and NetNTLMv2, while 58 new application-specific hash types have been added including support for Argon2, MetaMask, and LUKS2.

Read more (hashcat.net)

OWASP Releases GenAI Incident Response Guide 1.0

OWASP GenAI Security Project releases its first comprehensive incident response guide for security practitioners dealing with GenAI application incidents. Created by a panel of experts from the project’s CTI Initiative, the guide provides guidelines and best practices without requiring deep GenAI knowledge. It aims to fill a critical gap in helping security teams respond effectively to incidents involving generative AI systems.

Read more (genai.owasp.org)

Building the UFADE Touch V1: A Portable iOS Forensics Device

A forensics professional demonstrates how to build an affordable portable backup system called “UFADE Touch” using a Raspberry Pi 4B, 7-inch touchscreen, and specialized cooling components. Components cost around €175 and include a DSI interface display to preserve USB ports for data sources and drives. Assembly requires minor case modifications and specific configuration changes to Raspbian OS to support the display driver and optimize performance for the 1024×600 resolution screen.

Read more (cp-df.com)

DB Browser Offers Alternative to Spreadsheets for CSV Forensic Analysis

A new video tutorial demonstrates how to use DB Browser for SQLite instead of traditional spreadsheet programs when conducting forensic analysis of CSV files. Sherman Kwok walks viewers through downloading the tool, importing CSV data, and using SQLite commands for sorting, filtering, and formatting data. The tutorial covers basic to intermediate techniques including regular expression filtering for more efficient data analysis.

Read more (youtube.com)

machofile Tool Released for Mach-O Binary Analysis

Security researcher Pasquale Stirparo releases machofile, a new Python module designed for parsing Mach-O binary files with a focus on malware analysis and reverse engineering. The self-contained tool works across macOS, Windows, and Linux without dependencies and offers features including header parsing, entropy calculation, symbol extraction, and code signature analysis. Stirparo developed the initial version after attending Patrick Wardle’s macOS malware class, spending nearly two years refining the tool before its official release.

Read more (github.com)

Cybersecurity Expert Releases Memory Forensics Dataset for Malware Research

Daniel Jeremiah releases a comprehensive memory forensics dataset featuring controlled attack scenarios on Windows 10 systems for cybersecurity research and training. Six distinct scenarios cover process injection, credential dumping, Cobalt Strike beacons, and various remote access trojans including AsyncRAT and MasonRAT. Each scenario includes detailed memory dumps, attack characteristics, and evasion techniques designed for analysts to practice using tools like Volatility and YARA. Cases range from unknown infections to targeted intrusions, providing varied complexity levels for students, analysts, and researchers developing memory analysis workflows.

Read more (daniyyell.com)