Every Monster Leaves Teeth Marks. Some Go to the Bone.
I just came across a job ad for an ICAC digital forensic examiner. For minutes, I thought about applying. Talk about a strong pull the requirements had/have on me… To be honest, I still think about constantly…I used to chase monsters like that job calls…
Read More
DF/IR Isn’t About Computers. It’s About Hunting Humans.
Data is the trail. Humans are the quarry. This is my opinion response to a solid LinkedIn post that asks a very important question: “How do we fix DF/IR so different paths don’t lead to different answers?” (paraphrased) Humans first. Technology second.…
Read More
Lazy* police work results in arresting an innocent person.
Aka: The Machine did its job. The lazy* human did not. https://petapixel.com/2025/08/28/new-york-police-nypd-facial-recognition-tech-blunder-leads-to-62-man-jailed-for-crime-by-56-suspect/ Stop Worshipping the Magic Box Here’s the creeping cancer…
Read More
Courtroom Trials Are the Final Exam for Your Work. Why Haven’t You Attended One?
Every digital forensic examiner, eDiscovery professional, and evidence handler eventually faces the same reality: the courtroom is where your work either stands or collapses. Yet, many in our field have never even sat through a trial, hearing, or…
Read More
Tech skills are cheap. Legal knowledge is priceless. Mindset is everything.
Tech Skills Question: Is there an easy way to find out if the Windows registry can be found in memory, and if so, can you collect it and if so, exam it with a forensic application? Answer: Yes, yes, and yes. A quick Internet search will give you URLs,…
Read MoreFrom Bailiff to Juror #12: How Every Courtroom Role Scores Your DFIR
Every face in the courtroom judges you and not just the one wearing the robe. I’ve reflected on my courtroom experience and giving you the highlights of perspectives of a DF/IR practitioner from every angle of the court that I sat. On Thursday, August…
Read MoreDF/IR Paralysis: What to Do When You Don’t Know What to Do
If you are like me, you have found yourself biting off more than you can chew, wading in water that was deeper than you thought, and reached a point of ‘what do I do now?”. And it happens more than once (am I oversharing…?). Things like staring at a 10TB…
Read More
How Sitting in 14 Legal Roles Created My DFIR Investigative Mindset
The DFIR investigative mindset no one teaches you but everyone judges you by. Most people in DFIR hear “investigative mindset” and think it means one of three things: Be curious. Think like a criminal. Ask better questions. That’s beginner-level thinking…
Read More
Intent, Not Tools, Defines the Discipline
If you work in cybersecurity (in any of the many roles under the cybersecurity umbrella), odds are you think you have a decent grasp of the cybersecurity field. But you might not. You probably have a solid grip on your slice of it, your role, your tools,…
Read More
I’m stepping away from DFIR…
..Review. Talk about clickbait titles… No, I’m not stepping away from DF/IR, but I am stepping away from DFIR Review. This is a short post of reflecting on DFIR Review. Way back in 2017, I started thinking out loud about a missing…
Read More