DFIR Competence: Are You Truly Skilled or Just Fooling Yourself?

TL:DR (Too long; Didn't Read) Knowing your DFIR competence level is the best way to improve your DFIR skills. I want to give you a few quick tips to help you assess your DFIR abilities, spot your strengths, and identify areas for growth. You might not be accurate in what you believe, so let's find out where you stand and how to advance. Tip 1: Know...

Continue reading

Evolve Your DFIR Skills or Die (figuratively)...

I've been looking at AI* for some time and found it amazing and terrifying. AI is everywhere, more so than the "blockchain in everything" phase ever was. I foresee a dramatic shift in DFIR, and I believe that if you don't hop on the AI train now, DFIR will leave you (and your job) behind. This isn't your Daddy's DFIR The integration of AI into DFIR...

Continue reading

Take a step back so you can jump forward

The day that you think you know enough is the day to start Craigslisting your DFIR gear I am an advocate of training, whether in DFIR or how to repair electrical wires. It is so much easier for someone to TELL you the way, SHOW you the way, and then help you DO the way. Self-learning is great and necessary, but you will not learn everything with se...

Continue reading

I have a confession to make…

I have had early access to API Forensics' Exponents. I have been testing these "X-tensions" for some time now. X-tensions are, in effect, add-ons to expand functionality with X-Ways Forensics. As usual, when I am asked to test yet-to-be-released software, I tell no one until I can. So here I am telling you!  There are quite a few free X-tensio...

Continue reading

You can blame me on your lack of DFIR competence

 When I say “me”, I don’t mean “Brett Shavers”. I mean “me” as when you say it.  For example, I blame me for any lack of skill that I ‘wish’ that I had but don’t put the effort to learn.  It is easy to say that you want something. It is an entirely different thing to lay down some cash, schedule time, focus your effort, practice...

Continue reading

6 Common Mistakes in Your DFIR Training Path

headache

Let's list some of the prevalent missteps that might be obstructing your journey toward becoming an amazing DFIR practitioner. You can make sure to start on the right path or if you already went down the rabbit hole, you can get out of it today. Error: Skipping the Basics Now, we all love the coolness of cutting-edge tools and the idea of...

Continue reading

Being Naked in Digital Forensics

Most of us want to be good at DFIR, no matter what small slice of the DFIR pie we do. We take training. We read. We theorize. We test theories. We do the work. But we become stagnant no matter how much more money and time we spend on training and education. This is because we keep to ourselves. We want the same thing: to do good casework! But we do...

Continue reading

Digital triage can do more than save you time. It may save a life.

Scenario (yes, this really happened): Parents reported their daughter missing. They gave the assigned detective a laptop that their daughter was using prior to being lured from home. The assigned detective conducted his own "triage" of the laptop by turning the laptop on poking around looking for clues. He even logged into the daughter's social med...

Continue reading

I am now an AXIOM Cyber user.

 I am was not an AXIOM Cyber user. This post is going to give you a few pointers of succeeding in DFIR as an examiner or developer while using Magnet Forensics' AXIOM CYBER application as a case example. These pointers are also self-reminders to me, so everything I say is personal to me as it is potential guidance for you. Before going any fur...

Continue reading