Automation and AI aren't the same thing. Automation is like a good intern: reliable, predictable, and obedient. It does exactly what you tell it to (by the way, where can I find one of these?). AI? This intern thinks it knows better. It decides what matters based on patterns it learned somewhere else, with zero input from you. And the kicker? You d...
Working in DFIR is humbling. Mistakes happen, and most times, they're painfully obvious in hindsight. When you think you've mastered the basics, one case can unravel everything you thought you knew. Worse, you may not realize how much you don't know until you look back at earlier work and cringe at how much that you didn't know. Growth in DFIR mean...
In the courtroom, an argument rages every time a case touches the digital realm, with a battle between the truth revealed by an unbiased and objective expert and the truth framed by attorneys driven by their client's interests. When a DFIR (Digital Forensics and Incident Response) expert witness steps into the octagon (aka: courtroom), their missio...
As artificial intelligence (AI) becomes more integrated into Digital Forensics and Incident Response (DFIR), it brings both exciting opportunities and significant challenges. While AI tools can accelerate analysis and offer creative insights, they also raise concerns—particularly regarding non-repeatable outputs and hallucinations (AI-generat...
In the DFIR world, our community is built on the knowledge we share. But many feel like they don't have the time or expertise to contribute. Maybe you think you don't know enough or that your input won't matter. I'm here to tell you—that's not true. Every contribution, from the seemingly insignificant to the groundbreaking, is what makes this...
Let me start with this: Competence is the essential baseline in DFIR. No matter how many credentials someone has, if they can't competently do the work, they're incompetent. Competence is what gets the job done. Incompetence leads to failed analysis, wrong conclusions, errors, mistakes, and shoddy, incomplete work. The goal in DFIR is to be compete...
There Is No Value Without Investment In DFIR, having the right tools or the latest training isn't enough. If you're unwilling to go all in, you're wasting your time. In this field, as with anything, you get what you invest in—not just money, but effort, time, and mindset. There Is No Tomorrow Remember in Rocky II when Apollo yells at Rocky, "There ...
TL:DR (Too long; Didn't Read) Knowing your DFIR competence level is the best way to improve your DFIR skills. I want to give you a few quick tips to help you assess your DFIR abilities, spot your strengths, and identify areas for growth. You might not be accurate in what you believe, so let's find out where you stand and how to advance. Tip 1: Know...
I've been looking at AI* for some time and found it amazing and terrifying. AI is everywhere, more so than the "blockchain in everything" phase ever was. I foresee a dramatic shift in DFIR, and I believe that if you don't hop on the AI train now, DFIR will leave you (and your job) behind. This isn't your Daddy's DFIR The integration of AI into DFIR...
The day that you think you know enough is the day to start Craigslisting your DFIR gear I am an advocate of training, whether in DFIR or how to repair electrical wires. It is so much easier for someone to TELL you the way, SHOW you the way, and then help you DO the way. Self-learning is great and necessary, but you will not learn everything with se...
I have had early access to API Forensics' Exponents. I have been testing these "X-tensions" for some time now. X-tensions are, in effect, add-ons to expand functionality with X-Ways Forensics. As usual, when I am asked to test yet-to-be-released software, I tell no one until I can. So here I am telling you! There are quite a few free X-tensio...
When I say “me”, I don’t mean “Brett Shavers”. I mean “me” as when you say it. For example, I blame me for any lack of skill that I ‘wish’ that I had but don’t put the effort to learn. It is easy to say that you want something. It is an entirely different thing to lay down some cash, schedule time, focus your effort, practice...
Let's list some of the prevalent missteps that might be obstructing your journey toward becoming an amazing DFIR practitioner. You can make sure to start on the right path or if you already went down the rabbit hole, you can get out of it today. Error: Skipping the Basics Now, we all love the coolness of cutting-edge tools and the idea of...
Scenario (yes, this really happened): Parents reported their daughter missing. They gave the assigned detective a laptop that their daughter was using prior to being lured from home. The assigned detective conducted his own "triage" of the laptop by turning the laptop on poking around looking for clues. He even logged into the daughter's social med...
Most of us want to be good at DFIR, no matter what small slice of the DFIR pie we do. We take training. We read. We theorize. We test theories. We do the work. But we become stagnant no matter how much more money and time we spend on training and education. This is because we keep to ourselves. We want the same thing: to do good casework! But we do...
I am was not an AXIOM Cyber user. This post is going to give you a few pointers of succeeding in DFIR as an examiner or developer while using Magnet Forensics' AXIOM CYBER application as a case example. These pointers are also self-reminders to me, so everything I say is personal to me as it is potential guidance for you. Before going any fur...
