Fight City Hall: If You Missed the Webinar, You’re Making Mistakes You Don’t Know About

The recording is available today (Friday, November 14, 2025) only. After that, it’s gone permanently.

Register to access it here: https://www.suspectbehindthekeyboard.com/offers/S2W6hwau

This wasn’t a case study. It wasn’t entertainment. It wasn’t polished for conference consumption. It was an autopsy of my own case, and I have never, and never intend to examine any of my cases again. I do this one because not only was it mine (no client involved, just me), but I learned things that I believe we all should have been taught at some point in our education and training path.

The presentation is about the procedures you trust can collapse when the system around you stops behaving the way the textbooks insist it should, and when you’re forced to face your errors that you didn’t know you made and continued forward.

I’ve worked criminal and civil cases for decades. I’ve testified, been cross-examined, been challenged, deposed, attacked, and blindsided. I thought I understood how the system worked. I was wrong.

And I learned that in the worst possible way: standing alone, pro se, fighting a government agency tied into almost two dozen others, an agency whose litigation budget of hundreds of thousands of dollars exceeded mine by hundreds of thousands of dollars.

More than 500 people registered for the webinar. Most showed up. Many others have watched the recording. One of live attendees, I am told, may have been from the agency itself. I sanitized everything; names, identifying markers, the entire chain because this isn’t about the agency. It’s about your cases. Your workflows. Your assumptions. Your documentation. And the moment you get hit with something you never prepared for.

The survey responses were blunt. All said the hour was worthwhile. Nearly all pointed to the same pattern:

“I had no idea my workflow was that fragile.”

And yes, mine was too. Not anymore, tho.

Below are the failures people admitted they now see in their own work because of this case. If you work DFIR long enough, you will run into these. Whether they destroy your case, or your credibility, depends entirely on whether you see the danger ahead of time.

1. You Assume Evidence Will Still Exist When You Request It

This is the most common, most dangerous assumption in DFIR, private sector work, criminal investigations, and corporate matters. Don’t assume something will exist when you want to seize it or have it produced.

In this case, systems “died,” devices disappeared, logs weren’t preserved, and critical records evaporated between request and production. I took for granted that automated processes were happening in the background. They weren’t. That was one of my mistakes because I hinged part of my case on it.

2. Your Report Structure Will Collapse Under Adversarial Pressure

This one hurts because it happened to me several times in this case.

One phrase taken from one half of one sentence from a five-page article I wrote a decade earlier, was ripped out of context and used against me.

Most DFIR reports aren’t written to survive adversarial dissection. They’re written for internal clarity or team readability. A hostile attorney doesn’t care about your clarity.
They care about your vulnerability.

3. Chain-of-Custody Weak Points Are Not “Minor Issues.” They Are Attack Surfaces.

People treat CoC gaps like paperwork annoyances.

They’re not. They are the easiest path for an adversary to rewrite your narrative.

If you leave a gap, someone else will fill it, frame it, and narrate it, and not in your favor. They don’t need to lie. They just reinterpret what you didn’t document well enough. I believed my words were tight. But they weren’t tight enough. Again, my mistake.

4. Your Terminology Probably Isn’t Defensible

If you cannot define your own terms with precision, under oath, then your terms are not yours. They belong to whoever challenges and redefines them.

One definition I assumed was universally understood was twisted using an obscure 1990s interpretation found online and used in a motion against me. It didn’t matter that I was right. What mattered is that I had left room for reinterpretation.

Vagueness is a luxury that DFIR practitioners cannot afford.

5. You Are Preparing for Friendly Questions, Not Hostile Ones

Most people prepare for cross-examination like they prepare for a job interview. Friendly questions. Predictable paths. Soft landings. That’s not what happens in court.

The most dangerous cross-examination isn’t aggressive. It’s friendly. Conversational. Disarming.

And then, right when you’re relaxed, you realize that you already stepped into a trap you didn’t see coming.

6. Your Workflow Has Failure Points You Can’t See Yet

My mistakes weren’t extreme. They were benign, typical, subtle:

• assumptions
• definitions
• phrasing
• scope
• documentation

These are the things people say “don’t matter” because nothing bad has ever happened when they ignored them. Until it does. You don’t feel the fault line until you’re standing on it.

This Case Won’t Happen to You Exactly Like It Happened to Me. But Parts of It Will.

• a missing system
• a missing device
• an uncooperative custodian
• contradictory logs
• a judge who doesn’t seem concerned
• ambiguous report language
• evidence mischaracterized
• opposing counsel twisting your decade-old writing
• a chain-of-custody gap inflated into a credibility problem

Everyone in DFIR will face some version of this. Most won’t recognize the danger until it’s too late.

Why the Recording Is Only Available Today

This webinar is not being archived, repackaged, sold, reused, or repeated. The content carries legal risk and professional risk if taken out of context. It only works when delivered in full context. Anything less becomes misleading.

A third-party platform scraped the webinar already without permission, chopped it into incoherent “chapters,” and tried to monetize it. I filed a DMCA takedown. Their versions are incomplete and context-destroying.

If you see any copies elsewhere, skip them. They are wrong, contextless, and legally dangerous. I am not an attorney, this presentation contains zero legal advice. You are getting the perspective of a DFIR practitioner’s case, end-to-end, presented to DFIR practitioners.

The recording disappears tonight. This isn’t short notice; it’s the last notice.

? https://www.suspectbehindthekeyboard.com/offers/S2W6hwau

Because of this case, I created PSBK CASEWORK.  

It’s a full, end-to-end investigative case, from first lead to courtroom, and applies to both civil and criminal casework. It includes reasoning, attribution, documentation, defensibility, and the exact structure that prevents the disasters from the webinar. It’s a DFIR casework workshop taught like I wish I had been taught.

Includes a limited-print, hardcover prerelease of 
Placing the Suspect Behind the Keyboard: DF/IR Investigative Strategies.

? https://www.suspectbehindthekeyboard.com/psbk-casework

— Brett Shavers