The most innovative DFIR book in a decade is coming
Yes, that is a big claim, but it is true. And it is not the book that I have coming out next month. The book coming out next month was practically finished last year but not wrapped up because of being busy. Stepping into the Breach The book…
Read More
The most neglected skill in DFIR is….
The one that is just as important as any technical skill: The DFIR Investigative Mindset. Personally, I’ve been harping on this concept since 2013. It has been written about as early as 2005 as “investigative mindset”, and written about using different…
Read More
ChatGPT destroys the planet
I read an article today about a “writer” who used ChatGPT to write their book. A little further digging found that apparently, there are hundreds of books on Amazon that are written by AI and marketed as such. I can only imagine how many “writers” that…
Read More
DAIR: Digital Analysis/Incident Response?
Pure luck? One day in patrol, my district partner and I were having coffee on break (imagine that…cops were having coffee…) while I was watching a known high-crime corner. I spotted a drug deal, actually several and said “Look, a drug deal” while…
Read More“I am neither a digital forensics practitioner nor do I play one on television.”
TL: DR (this is the important part) One day, your DFIR profession may be negatively affected by your behavior in your private life, judged by a third party’s ethical standard. And your creativity to solve cases will be restricted by only being allowed…
Read More
The DFIR Investigative Mindset
We use cutting-edge tools to uncover the story of what happened on computing systems. This is awesome! But we often ignore attribution, which is difficult. I understand. Digital forensics alone can hardly identify the suspect…
Read More
DFIR is a mindset, not a skillset.
I recently posted a webinar on the DFIR Investigative Mindset, which is a snippet of a program I’ve occasionally taught internally over the past years. I distilled a major component of the DFIR Investigative Mindset for this post into seven words:…
Read More
This is an evidence storage device.
Mistakes in any career field are inevitable. And much like car accidents, the severity of a mistake can range from a simple ‘oops’ to something more disastrous and permanent. In the DFIR field, errors and mistakes will usually…
Read MoreIn this thing of ours, the world of digital forensics, there is one thread that ties us all together
In this thing of ours, the world of digital forensics, there is one thread that ties us all together: the truth. All else is malleable. Processes improve. Technology changes. Laws are added. Training morphs. But the thing that remains…
Read More
The truth hurts. But the other option is worse.
In 2013, I wrote a book and throughout the book, wrote of telling the truth as it relates to your investigations. One area of telling the truth that I should have covered more, was ensuring that your team also tells the truth. The only statement in…
Read More