In the courtroom, an argument rages every time a case touches the digital realm, with a battle between the truth revealed by an unbiased and objective expert and the truth framed by attorneys driven by their client's interests. When a DFIR (Digital Forensics and Incident Response) expert witness steps into the octagon (aka: courtroom), their missio...
As artificial intelligence (AI) becomes more integrated into Digital Forensics and Incident Response (DFIR), it brings both exciting opportunities and significant challenges. While AI tools can accelerate analysis and offer creative insights, they also raise concerns—particularly regarding non-repeatable outputs and hallucinations (AI-generat...
In the DFIR world, our community is built on the knowledge we share. But many feel like they don't have the time or expertise to contribute. Maybe you think you don't know enough or that your input won't matter. I'm here to tell you—that's not true. Every contribution, from the seemingly insignificant to the groundbreaking, is what makes this...
Let me start with this: Competence is the essential baseline in DFIR. No matter how many credentials someone has, if they can't competently do the work, they're incompetent. Competence is what gets the job done. Incompetence leads to failed analysis, wrong conclusions, errors, mistakes, and shoddy, incomplete work. The goal in DFIR is to be compete...
There Is No Value Without Investment In DFIR, having the right tools or the latest training isn't enough. If you're unwilling to go all in, you're wasting your time. In this field, as with anything, you get what you invest in—not just money, but effort, time, and mindset. There Is No Tomorrow Remember in Rocky II when Apollo yells at Rocky, "There ...
TL:DR (Too long; Didn't Read) Knowing your DFIR competence level is the best way to improve your DFIR skills. I want to give you a few quick tips to help you assess your DFIR abilities, spot your strengths, and identify areas for growth. You might not be accurate in what you believe, so let's find out where you stand and how to advance. Tip 1: Know...
I've been looking at AI* for some time and found it amazing and terrifying. AI is everywhere, more so than the "blockchain in everything" phase ever was. I foresee a dramatic shift in DFIR, and I believe that if you don't hop on the AI train now, DFIR will leave you (and your job) behind. This isn't your Daddy's DFIR The integration of AI into DFIR...
The day that you think you know enough is the day to start Craigslisting your DFIR gear I am an advocate of training, whether in DFIR or how to repair electrical wires. It is so much easier for someone to TELL you the way, SHOW you the way, and then help you DO the way. Self-learning is great and necessary, but you will not learn everything with se...
I have had early access to API Forensics' Exponents. I have been testing these "X-tensions" for some time now. X-tensions are, in effect, add-ons to expand functionality with X-Ways Forensics. As usual, when I am asked to test yet-to-be-released software, I tell no one until I can. So here I am telling you! There are quite a few free X-tensio...
When I say “me”, I don’t mean “Brett Shavers”. I mean “me” as when you say it. For example, I blame me for any lack of skill that I ‘wish’ that I had but don’t put the effort to learn. It is easy to say that you want something. It is an entirely different thing to lay down some cash, schedule time, focus your effort, practice...
Let's list some of the prevalent missteps that might be obstructing your journey toward becoming an amazing DFIR practitioner. You can make sure to start on the right path or if you already went down the rabbit hole, you can get out of it today. Error: Skipping the Basics Now, we all love the coolness of cutting-edge tools and the idea of...
Most of us want to be good at DFIR, no matter what small slice of the DFIR pie we do. We take training. We read. We theorize. We test theories. We do the work. But we become stagnant no matter how much more money and time we spend on training and education. This is because we keep to ourselves. We want the same thing: to do good casework! But we do...
Scenario (yes, this really happened): Parents reported their daughter missing. They gave the assigned detective a laptop that their daughter was using prior to being lured from home. The assigned detective conducted his own "triage" of the laptop by turning the laptop on poking around looking for clues. He even logged into the daughter's social med...
I am was not an AXIOM Cyber user. This post is going to give you a few pointers of succeeding in DFIR as an examiner or developer while using Magnet Forensics' AXIOM CYBER application as a case example. These pointers are also self-reminders to me, so everything I say is personal to me as it is potential guidance for you. Before going any fur...
The short story: Belkasoft X gives great value in both cost and features. Acquire, process, and delve into the data with an intuitive interface that cleanly shows automated categorization of forensic artifacts. Although easy to use, this is a true forensic suite that does more than what you might expect for the price of the license.
Belkasoft X is Belkasoft’s top forensic suite, comparable to any other forensic suite that you may be using. In several ways, Belkasoft X is not only on par with most any other forensic tool but exceeds in many areas.
As far as what Belkasoft X does, since it is a forensic suite, it does practically everything that you would expect a forensic suite to do from initial acquisition of evidence to reporting of the entirety of an analysis. This includes not only the basic computer forensics type of cases, but also mobile devices, cloud, and memory forensics. As I said, it is a full forensic suite.
TL:DR Belkasoft Evidence Center lives up to its tagline of "forensics made easier". For a near complete automated case work, it works. An intuitive interface and automated processes make processing practically user-error free. The review I took Belkasoft Evidence Center (BEC) for a test drive, ran it across several images, and validated what I saw ...
