I’m stepping away from DFIR…
..Review. Talk about clickbait titles… No, I’m not stepping away from DF/IR, but I am stepping away from DFIR Review. This is a short post of reflecting on DFIR Review. Way back in 2017, I started thinking out loud about a missing…
Read More
DF/IR Lemonade
Digital forensics and incident response are too often taught like a parts catalog. One module on log analysis. A class on memory forensics. A blog post on timeline creation. A YouTube video on parsing registry hives. A lab on recovering deleted files.…
Read More
We don’t rise to the level of our DF/IR certs and degrees. We fall to the level of our experience and training.
Everything I’ve written here is not a concept. It’s coming. Want In? Get on the List. Train like it matters. Because in DF/IR, it does. Soon, I’ll be inviting a small group to this first scenario-based cohort. If you want early access or just want to…
Read More
The Bitter Pill of DF/IR Hindsight
I once drove hours to hear minutes of a digital forensics presentation, one I felt was a waste of time. But, that one presentation was two decades ahead of me and taught me a valuable lesson about what happens when you think you know enough.…
Read More
The Two Bulls of DF/IR: Why Charging Ahead Still Loses the Case
There are two scenes in the movie Colors that every DF/IR professional could learn from. Sean Penn plays the rookie in both scenes, eager, aggressive, charging downhill. In the first scene, Robert Duvall plays the veteran, calm, methodical, deliberate.…
Read More
From Why to What: The Decline of Investigative Thinking in DF/IR
We used to ask why. Why would the suspect use this device? Why was this action taken at that time? Why does this one detail feel wrong? Now? We only ask what. What tool recovers deleted files? What script finds the browser history? What keyword pulls…
Read More
Your Mood Is Murdering Your DF/IR Investigation and You Don’t Even Know It
TL:DR: Your current mental state is either helping or hurting your case right now. Investigative work isn’t just about what you know. It’s about how well you can think under pressure, and that depends on the state you’re in when you sit down to…
Read More
DF/IR was built in a garage
Why DF/IR Professionals Need to Set the Standards Before It’s Done for Us DF/IR wasn’t built in a lab. It was built in a garage. Not a cleanroom. Not a courtroom. Not a classroom. Not a conference room full of policy makers. A garage. By people like us,…
Read More
Why Acting Like Jack Reacher in DF/IR Will Land You in Court, Not on a Bestseller List
I ran a little experiment for my upcoming book, DF/IR Investigative Strategies. I asked a few DF/IR professionals—none with law enforcement backgrounds—to watch Reacher (Season 3, Episode 2) and tell me what crimes or policy violations they spotted. Then…
Read More
Coming in 2025: Placing the Suspect Behind the Keyboard: DF/IR Investigative Strategies, Volume 3
After dozens of rewrites, fresh starts, and scrapped chapters, I’ve finally locked into the version of Placing the Suspect Behind the Keyboard: DF/IR Investigative Strategies (Vol. 3) that I know needs to be written. And yes, you’ll be able to…
Read More