DF/IR is not dying. It’s just harder than ever.
The cybersecurity competence bar’s dropped so low it’s in the basement. Companies don’t want experts; they want button-pushers who’ll work cheap. DF/IR’s soul, placing the suspect behind the keyboard, is getting lost in the automation and artificial…
Read More
Think You Don’t Need WinFE? Wait Until You Do.
In 2008, Troy Larson gave me the build instructions for WinFE (Windows Forensic Environment). Troy figured out how to make a Windows winpe boot in a forensically sound manner with registry changes. At the time, the concept of a Windows-based forensic…
Read More
The way you look at devices will affect what you find on them.
Every DF/IR investigator has missed something. It is virtually impossible to find every bit of relevant evidence. Some are gone forever, others are comingled in a sea of electronic data that is easy to miss, and some have been intentionally hidden.…
Read More
Are you a DF/IR Expert Witness or Just a Useful Pawn?
There’s a hard line between working toward an objective and chasing a result, and if you don’t know which one you are doing, you are already lost. The most glaring issue I see when peer reviewing DF/IR reports* is when the examiner/analyst/investigator…
Read More
Cross-examination will Go in Raw, Wreck Your Credibility, and Leave You Begging for a Safe Word
TL:DR “Opinions are like assholes; everyone has one, and they all stink.” – One of my Bootcamp Drill Instructors Expect your credibility to be attacked in court. Opposing counsel isn’t just looking to poke holes in your findings but to obliterate your…
Read More
How Mistakes Shape DF/IR Investigations
Every investigation hinges on one critical factor: human error. As a DF/IR investigator, your ability to spot and exploit those errors while avoiding your own is what separates success from failure, and you from your adversary. Let me show you how to…
Read More
The Human Element of DF/IR (YOU!)
The clock is racing. A global breach is unraveling on one side of the room; millions siphoned in real-time, systems crashing, and reputations crumbling by the second. On the other, the unthinkable: a child has been taken. A predator lured her online, and…
Read More
Do IT Pros Make the Best DF/IR Investigators?
The field of DF/IR attracts professionals from all walks of life, from law enforcement, academia, private industry, and even IT pros. One of the trends over the years is the number of IT professionals transitioning into the world of digital forensics and…
Read More
I paid $250,000 to learn forensics…and still don’t know forensics…
I have a confession: I’ve spent over $250,000 in my career on learning digital forensics and incident response (DF/IR) and for the licenses, subscriptions, and renewals. From college courses to certification programs, training courses, conferences,…
Read More
Thinking Beyond Tools: Elevate Your DF/IR Skills with an Investigative Mindset
I am proud to announce that I will be delivering the keynote presentation at Magnet Forensics’ Magnet Virtual Summit (MVS) 2025 on February 11, 2025. The title of my session is: “Thinking Beyond Tools: Elevate Your DF/IR Skills with an…
Read More