A New DFIR Investigative Mindset Book Challenge is Coming…

I’m bringing back the DFIR Investigative Mindset book challenge one more time.

I planned to make this a one-time event with 1,000 signups. Here is the wrench in that plan:  Of the 1,000 that signed up, only 787 completed the challenge.  The remaining either couldn’t attend, forgot, or failed the challenge. I didn’t expect anyone to fail or miss the challenge. Many of these have asked for a repeat and I said….sorry, but no…

After a dozen emails and a phone call, I decided to repeat this challenge because many who missed it were doing good DFIR casework and couldn’t get away. I appreciate the types of cases they work on, and I think this challenge will help them work those case types better, which will be better for society.

If this is the first time you are hearing of the DFIR Investigative Mindset book challenge, I am offering two hours of legitimate investigative mindset training. By answering a few questions, you will earn a certificate of completion and a copy of the DFIR Investigative Mindset book.

TL:DR (too long:didn’t read)

By not developing or improving an investigative mindset, your skills in working cases are stunted, period. This challenge will give you the headstart that you don’t have. The challenge will be either the last week of November or the first week of December.

Get notified first when I open registration: https://www.suspectbehindthekeyboard.com/dfir-mindset-challenge

If you registered for the prior book challenge but missed it, I will send you an email notice for this one; there is no need to send me your email again and your spot is confirmed if you register immediately when I send you the notice.

Think Tech Skills Are Enough? Think Again.

Over the years, I’ve watched DFIR shift from using technology to solve cases to simply getting lost in the technical weeds. We became experts with tools, scripts, and data, but we lost sight of the fundamental objective: solving cases.

Technology is a tool, not the goal.

If you’re not up to date on a particular DFIR skill, it’s either because you don’t need it in your role or you’ve chosen not to learn it. The information is there. It is only your effort, or lack thereof, that determines if you have the technical skills. But what about the investigative part? Where can you find that? Has our effort toward tools made us lose our roots in investigating cases and incidents?

The Hardest Part: Everything Else in DFIR

Placing a suspect at the keyboard requires more than finding artifacts; it’s about attributing actions to a human being. It demands technical expertise, yes, but also critical thinking, a deep understanding of legal boundaries, and an unshakable commitment to ethics. Missteps in evidence handling can turn solid findings to garbage, rendering months of work meaningless.

Our mission in DFIR isn’t about recovering data and printing reports. It’s about building airtight narratives that hold bad actors accountable for their actions. Each piece of evidence must fit the larger picture. Our casework demands we think critically, act ethically, and stay relentlessly focused.

Join me in this Transformative Challenge

If you’re ready to take your skills to the next level and transform your role in DFIR, keep an eye out. I’ll provide more details soon about the next DFIR Investigative Mindset challenge. This isn’t just another training—it’s an invitation to reshape how you fundamentally approach digital forensics casework.

This time, however, there will be a lower limit. The prior challenge involved 1,000 participants, and to be candid, that’s more packing and shipping than I want to manage for a long time. This time, the challenge will be open to those who couldn’t show up previously, plus an additional 100 spots. So, if you missed out, this is your chance.

This means that 213 spots are reserved for those who could not make it, and an additional 100 spots are for those who did not sign up for the first challenge.

Until then, I’ll continue shipping books from the prior challenge, at about 100 books a day…

My goal and purpose

I am an investigator at heart. I have plied my trade as a patrol officer, detective, task force officer, undercover operative, digital forensic detective, and digital forensic consultant to private law firms and government agencies.

My purpose is to nudge the DFIR field back to its investigative roots in order to solve cases. I believe we have begun to drift away from the purpose of using DFIR as a tool to solve cases rather than something that has limited impact.

I know what it is like to not have any idea or run out of ideas when working a case. I also know how to break through roadblocks, obstacles, and be creative to develop innovative ideas to solve the unsolvable. You can too.

You will look at cases differently with this challenge. I promise.