Opening in a private window solved the issue, however I'm pretty sure I don't regularly read anything on this site (maybe never was an overstatement?).
Edit: this is the latency project I was thinking about https://danluu.com/input-lag/
Edit: Oh and cpldcpu linked the ComputeDRAM paper that explains how to do it with off the shelf parts.
2012-09-13 SWGDE Model SOP for Computer Forensics V3-0 merely says to detect "Detect malware programs or artifacts".
2020-09-17 SWGDE Best Practices for Mobile Device Forensic Analysis_v1.0 seemed the most in depth, and it merely states:
> 9.4. Malware Detection Malicious software may exist on a mobile device which can be designed to obtain user credentials and information, promote advertisements and phishing links, remote access, collect ransom, and solicit unwanted network traffic. Forensic tools are not always equipped with antivirus and anti-malware to automatically detect malicious applets on a device. If the tools do have such capability, they do not typically run against an extraction without examiner interaction. If the examiner’s tools do not have antivirus/anti-malware capability, the examiner may need to manually detect malware through the use of common anti-virus software applications as well as signature, specification and behavioral-based analysis.
If there's a memory dump to work on, a more in-depth analysis can be done with Volatility on running processes, but it usually falls back on the expert having good skills on that kind of search (malfind tends to drop a lot of false positives).
But at least the guides gave a baseline/starting point that seems to be better than what was described. It's very difficult to prove a negative, so I'd also be careful with the wording, eg: "evidence of a malware infection was not found with these methods" instead of "there's no malware here".
It's obviously quite difficult to prove a negative in general, but the complete lack of any standard of care then presented as an "expert opinion" for the defense was astounding.
(FWIW this was a MS Windows machine, and I think the AV was just Windows Defender)
[1] https://www.swgde.org/?swp_form%5Bform_id%5D=1&swps=malware
Whether it'll be constrained to Win 11 is yet to be seen.
Might want to check that. Also 4.something got SIFT as part of OpenCV (instead of living in the contrib module) because the patent expired and you can now use it for free.
As for blowing up with NN packages and such... I don't really use those parts, but if the NN module had easier support to run networks trained on popular frameworks I might've used it. Disclaimer: it's been quite a while since I last tried to use those parts, so maybe now the latest version has fantastic support and I'm talking nonsense.