Brett's Ramblings

TikTok is like a big, greasy cheeseburger. We know it is bad for us, but don't care.
Brett Shavers
Digital Forensics
Short version: Any social media platform can be compared to the biggest, greasiest cheeseburger that you can find.  You know that the cheeseburger is unhealthy, but you choose to eat it anyway. TikTok is worse for you than a cheeseburger Many of us mis/use the Internet by installing apps that we know collect our data. We tweet, share, post, re...
Jessica Hyde and I talk about forensic stuff
Brett Shavers
Digital Forensics
Jessica Hyde of Magnet Forensics sat down together (virtually...) to talk about forensics.  In case you missed it, here it is!
Facebook Spoofing: Your Reputation, Investigations, and Massive Data Collection
Brett Shavers
Digital Forensics
A “new” article on imposter Facebook accounts was published today in the Philippines.  I put “new” in quotes because this is not a new issue, but I am glad that more public attention is being given to spoofed social media accounts. I am referring to imposter accounts as “spoofed”, “faked”, and “imposter”, where the account was not created by t...
You do not want to work in DFIR.
Brett Shavers
Digital Forensics
  The fantasy So many people ask how they can start a career in the DF/IR field, which is completely understandable. The glamour is there. Hollywood shows vivid and dynamic computer screens depicting the fascinating work of forensics and incident response, from James Bond flicks to any of the CSI tv show series. And the money! There is so much...
COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.
Brett Shavers
Digital Forensics
The meat and potatoes A bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical aspects of the work has not changed. But what about the investigative aspect?  Oh yes. That part of DFIR has certainly changed. The key change is geolocation, and it is more important than you may realize at first ...
Mini-WinFE 10 and WinFE 10 Updated
Brett Shavers
Digital Forensics
The short story on the newest Mini-WinFE 10 (aka, the download link): Mini-WinFE has been updated and upgraded.  I update WinFE developments (including the downloads for Mini-WinFE) at https://www.patreon.com/posts/34814255.  The Mini-WinFE builder is a free download. Mini-WinFE 10  Are forensic bootable OSs still useful today? Depen...
Eat your broccoli first
Brett Shavers
Digital Forensics
Something good and something not-so-good on learning DFIR The good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and gain skills in this career than most any other professional career. *  Resources are plentiful (such as thousands of websites, hundreds of books, colleges, trade schools, etc..) *&nbs...
The Second Decade of the 2000s is almost over!
Brett Shavers
Digital Forensics
We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown! Whether you were born or have been doing DFIR work during this period, there has been much going on. We’ve gone from “pull the plug and image the entire drive” to “fit the process to the totality of the situation”.  ...
Public Records
Brett Shavers
Digital Forensics
I have an outstanding public records request. It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that I haven't received any public records yet from the request. I have been hired by government agencies as a consultant to help the agency find and produce response records on occasion. Mostly, I was hired because...
The Five Stages of the DFIR Career Grief Cycle
Brett Shavers
Digital Forensics
I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig, that I was honored that he agreed to write the foreword of a book that Eric Zimmerman and I wrote. It stands to figure that I have followed his blog for many years because I learn something every time he writes something. Well…. His l...
Our World is Going to Turn Upside Down with DeepFakes
Brett Shavers
Digital Forensics
The short story Any person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with any other person face and voice. This is known as a “DeepFake” video.  Credibility of videos will no longer exist without some form of analysis, but the assumption that a DeepFake video is credib...
If you are comfortable in DFIR, you might be doing it wrong
Brett Shavers
Digital Forensics
I took a 3-day basic forensic course and embarrassingly enough, the instructor (in front of the class), said that I probably know everything in the course already and this class is probably too basic for me…on the first day…in the first hour…and I was in the first row…I was a little uncomfortable. I spoke to the instructor afterward about the cours...
Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp
Brett Shavers
Digital Forensics
You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits.  In fact, you can probably enjoy the benefit of the lessons more quickly than spending months of being bombarded with ‘training’ every day..recruits have no clue of the value of most lessons that they experience on a daily basis un...
Personality of a computer
Brett Shavers
Digital Forensics
From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the Suspect Behind the Keyboard. I want to expand upon beyond the registry regarding a computer having a personality. The bullet point By examining multiple computers (or a single system) for computer usage and/or ...
Add a Dab of Balance in your DFIR World
Brett Shavers
Digital Forensics
Jessica Hyde’s post of Giving Back in DFIR from 2018 is a great write up on contributing to the DFIR community, and I see her post being relevant for some time to come. One thing that I want to add is that of balancing our time in this line of work. Now, I am not saying that the DF/IR/Infosec world has more stressors than other lines of work, or th...