I’m stepping away from DFIR…

..Review.  

Talk about clickbait titles…

No, I’m not stepping away from DF/IR, but I am stepping away from DFIR Review. This is a short post of reflecting on DFIR Review.

Way back in 2017, I started thinking out loud about a missing piece in the digital forensics/incident response (DF/IR) world, something between academic journals and blogs. That thinking turned into talking to several people about a concept.

In June 2018, I published Here’s a potential new method in how you can get your research peer-reviewed, which outlined a practitioner-driven publishing model. It was an idea that I wanted to refine. I described how DF/IR research could be submitted, reviewed, revised, and published, months faster than traditional journals, while still maintaining credibility and structure.

That month, I followed up with Publish your #DFIR research!, digging deeper into why practitioners blog instead of publish. The reasons were obvious: speed, accessibility, relevance. But I argued that we could (and should) create a new process that combined the speed of blogging with the integrity of peer review.

Then Jessica Hyde messaged me about the blog post and we messaged about this peer review concept. We agreed on the need and refined the vision. Jessica took the lead in formally presenting it to DFRWS, who accepted and hosted the initiative. DFIR Review was born.  That sounds much easier than it was…

To be honest, I wanted no part of academia in this peer review process because of speed of review. I wanted practitioners to peer review practitioner work. But, Jessica was right in that we should have a balance of academia and practitioners in the system. 

DFIR Review became the platform I envisioned, even better than I could have dreamed, but I didn’t have the bandwidth to build alone. Jessica handled the heavy lift: coordination, review process, DOI integration, and platform support. DFRWS backed it with the legitimacy and technical support it needed to thrive. I stepped into a supporting, foundational role. 

The Missing Voices

What really pushed me to write those original posts wasn’t just a desire for cleaner citations. It was the silence of skilled practitioners who weren’t sharing what they knew, or who were sharing but their work was being lost on the Internet when others could be citing it, learning from it, and improving it.

In April 2019, I wrote a post titled The #1 Reason that DFIR practitioners don’t post opinions. It boiled down to one thing: Fear.

Fear of being misquoted in court. Fear of being cross-examined with a tweet. Fear of saying the wrong thing and having it live forever. That fear is valid. I’ve had it too. But it comes with a price: our field moves slower because some of the best minds stay quiet. I’ve been on the stand defending my years past written statements, some from 10 years prior to trial, so I especially know.

That’s the problem DFIR Review was designed to help solve by offering a structured, credible space for field practitioners to publish real research without being forced into academic silos or anonymous accounts. When you put your name on your work, it carries weight. I am not a fan of anonymous Internet accounts when there is legitimate information that I could use in casework. DFIR Review helped give practitioners a path to do that with their name and can formally share with the community-at-large.

Why I’m Leaving Now

As of July 2025, I’ve officially stepped away from DFIR Review.

Not because I lost faith in the idea but because of time. I have a few major projects to wrap up, and a few others that just get more work added the more work that I do on them (ie: the more that I find, the more work I get to do…).

DFIR Review has become a self-sustaining platform with really great people keeping it going. It doesn’t need me anymore. That’s a good thing and was my goal all along.

Credit Where It’s Due

Jessica Hyde took the idea and made it operational. DFRWS took the risk and gave it legitimacy. The DFIR community adopted it and made it work. There are lots of names associated with DFIR Review now, and I’m really happy for that.

I’m proud to have helped start the conversation and honored to have played a role in making DFIR Review a reality. To everyone contributing, reviewing, and reading today: thank you.

Keep publishing. Keep writing. Keep building. We need your voice, especially when you put your name on it. I strongly recommend memorializing your amazing DF/IR research on your blog and on DFIR Review. Don’t let your best work fade in a forum thread. Share it. Stand by it. Get credit for it. Say it while standing behind it.