The Complete Guide to DFIR by Someone Who Never Did It
If you use AI to summarize everything you read, let me save you the trouble with this one. Me: Summarize this article in 3 bullet points in an 8th grade reading level. For those who actually read what was written, here we go. The Before-LLM time The…
Read More
You suck at DFIR if you’re vibe-coding forensic apps.
I’m talking about the DFIR equivalent of the examiner who clicks a button, gets an answer, and has no idea what happened underneath. I agree that AI is a development tool. Using AI to write code does not make something vibe-coded. A programmer who knows…
Read More
Placing the Suspect Behind the Prompt
We’re headed toward getting really good at proving what the AI did while remaining unsurprisingly bad at proving who put it in a position to do it. We’re building tools to stop the machine, but we also need evidence to identify the person behind it. Ovie…
Read More
Be Wary of Where You Get Your DFIR Knowledge
i wasted $100 so you don’t have to When I write a book, I buy more books. Every time, I end up buying a dozen or more books so I can see what is already in print, cite what is citable, and check whether an idea I think is original already has been…
Read More
Your CTF Has an Expected Answer. Your Investigation Doesn’t.
Capture the Flag (CTF) exercises are one of the ways to learn digital forensics because they make you do the work. You have to find the artifact, understand what it means, sometimes validate it manually, and usually figure out at least one thing you did…
Read More