Brett's Ramblings

Recent News

The most neglected skill in DFIR is….

The one that is just as important as any technical skill: The DFIR Investigative Mindset. Personally, I’ve been harping on this concept since 2013. It has been written about as early as 2005 as “investigative mindset”, and written about using differe...

Continue reading

I read an article today about a “writer” who used ChatGPT to write their book. A little further digging found that apparently, there are hundreds of books on Amazon that are written by AI and marketed as such. I can only imagine how many “writers” th...

Pure luck? One day in patrol, my district partner and I were having coffee on break (imagine that…cops were having coffee…) while I was watching a known high-crime corner. I spotted a drug deal, actually several and said "Look, a drug deal” while par...

TL: DR (this is the important part) One day, your DFIR profession may be negatively affected by your behavior in your private life, judged by a third party’s ethical standard. And your creativity to solve cases will be restricted by only being allowe...

    We use cutting-edge tools to uncover the story of what happened on computing systems. This is awesome! But we often ignore attribution, which is difficult. I understand. Digital forensics alone can hardly identify the suspect ...

I recently posted a webinar on the DFIR Investigative Mindset, which is a snippet of a program I’ve occasionally taught internally over the past years.  I distilled a major component of the DFIR Investigative Mindset for this post into seven wor...

Mistakes in any career field are inevitable. And much like car accidents, the severity of a mistake can range from a simple ‘oops’ to something more disastrous and permanent.  In the DFIR field, errors and mistakes will usu...

In this thing of ours, the world of digital forensics, there is one thread that ties us all together: the truth. All else is malleable.  Processes improve. Technology changes. Laws are added. Training morphs.  But the thing that remains unc...

In 2013, I wrote a book and throughout the book, wrote of telling the truth as it relates to your investigations. One area of telling the truth that I should have covered more, was ensuring that your team also tells the truth. The only statement...

I recently finished a lawsuit, and it was the most time consuming process I’ve ever experienced.  I have been involved in lawsuits for about 30 years as a defendant, lay witness, expert witness, and now as plaintiff.  Let me brea...

I have a good friend who is a natural with people.  He makes you feel like you have known him all your life after having just met minutes prior.  I am totally not like that. Seems like many in this computing industry as a whole are generall...

I sometimes carried up to 10 cell phones at one time for work. Each phone had its own purpose. One or two of these phones were used for case calling criminal targets in one country. Another phone was used to call another target in a different country...

I believe that most every book begins by seizing upon the spark of an idea before the idea fades.  This book, the one that Mark Spencer and I are writing, is no different. But first, let me give credit where credit is due, for I will never take ...