New Year, New Start: Your DFIR Planning Mission

A new year feels like a reset. It isn’t, unless you make it.

Your personal priorities (family, hobbies, leisure) are yours to define. Protect them deliberately. Those are your rules to make.

But for your DFIR world….if you don’t plan your year, your casework will plan it for you. Your casework will require you to learn what you should have learned yesterday, but under greater time pressure, emergency budgeting, and painful failure points.

We work under rules, regulations, laws, requirements, and expectations, and the reality that your work may be reviewed later (by management, auditors, regulators, opposing counsel, or a jury).

Q: What do you need to be able to do by the end of this year? To develop an answer, make a workable DFIR plan.

1) Start with your reality

• What is your actual ROLE: DF, IR, or both?

• What ENVIRONMENTS: endpoints, cloud/SaaS, mobile, network, logs, Windows, *nix, etc…?

• What STANDARDS matter most: court defensibility, regulatory defensibility, or internal defensibility?

If you skip this, you’ll buy training or learn skills that feel productive but cost you time and money and change nothing.

2) Pick 2–4 fundamentals to level up

Fundamentals are the multiplier. Pick a short list like:

• Windows artifacts + interpretation (not just tool output)

• File systems + timestamps (including how they mislead)

• Evidence handling + documentation habits

3) Choose few specialization tracks (the more you “specialize”, the less you specialize) Examples:

• Mobile examinations

• Memory/malware triage

• Network forensics / threat hunting crossover

One or two tracks per year beats three or four “almost” tracks.

4) Training budget to match your priorities

A simple split that avoids wasted spend (use your own %):

• 60% fundamentals (deep training + books + practice resources)

• 30% specialization (serious courses + focused labs)

• 10% exploration (conference/short workshops)

Conferences are great for trend-scanning, networking, and inspiration. They’re a weak primary strategy for skill acquisition.

Your 2026 DFIR plan

Fail to plan, plan to fail...but not this year!

Outcomes by Dec 31:

1) ____________________________

2) ____________________________

3) ____________________________

Fundamentals:

1) ____________________________

2) ____________________________

3) ____________________________

One or two specialization tracks:

1) ____________________________

2) ____________________________

Budget:

Don't forget to consider free options in any of these: 

• Training: $_____________

• Books: $_____________

• Conferences/workshops: $_____________

• Lab/tools: $_____________

Guardrails (say “no” to):

A hard "no" could be no unpaid conference speaking at commercial events as that is one of the most expensive things you could do to lose money and time. Or no to the virtual conference that doesn't relate to what you actually do.

• ____________________________

• ____________________________

• ____________________________

A new year becomes a new start when your growth is intentional, not accidental.

An accidental new year is when you take on work you’ve never done before, even though your role required and expected it from the beginning. Then it is a mad rush of Internet searches for blogs, white papers, YouTube videos, the shortest training course for the cheapest cost, and bugging everyone you know for “the answers.”

You end up spending 2-5x the cost (time and money) that it costs you to solve what you should have been able to solve in the first place.

Each time that happens, your mistakes, oversights, and errors result in less-than-professional work product.

A planned new year prepares you for what you know is coming, what you need to know, and what you should be able to do when the work comes to your desk.

A few things

•Free training, expensive training, long courses (>40 hours), short courses (<40 hours), books, YouTube videos, blog posts, conferences, and academic papers can be either useful or useless. It all depends on too many factors to blanket them all.

•Chasing tools instead of competence puts you behind eventually

•Specializing in everything results in specializing in nothing

•Skipping writing/documentation is incomplete work 

•If you count ‘valid’ training by coins and certs alone, you might be doing it wrong

•If you do anything during training besides focusing on training, your costs double (lack of learning and lower quality of whatever else you are doing)

Analyze 2025

One way to make 2026 the most effective in learning and building skills is to analze 2025. Find what worked, what didn’t, what it cost you, and rank by usefulness.

If you spent $1,500 on a conference, plus $600 on lodging, $500 on travel, and $200 on meals, call it $2,800, and the only thing you remember is the swag pile sitting in the corner… write that down.

Not in your head. Not “yeah, that was kinda lame.” Put it on paper. With the numbers. Because $2,800 isn’t “professional development.” It’s a receipt for an event you attended.

Now do the same for the other ways we fool ourselves:

•If you travel to a 3-day training course, that is not just 3 days of training. For lost opportunity, be sure to include travel time. That can make a 3-day class actually be 5 days if you include travel.

• If you watched 10 hours of YouTube trying to learn something, and some of it was wrong, you didn’t spend 10 hours. You spent 10 hours + the cleanup. Add the rework. Add the troubleshooting. Add the part where you finally discover the video was confidently incorrect, and now your case or lab is on fire. Add what you could have learned instead.

• If you paid $200 for an online class and it saved you a week of trial-and-error digging through a database, that’s not “spending money.” That’s buying back time. Mark it as time and money well spent.

• If you bought a book that was useless (poorly written, shallow, recycled fluff) don’t just record the price of the book. Record the price of your time. A bad resource doesn’t just waste money.

Most of us evaluate this stuff subconsciously. Some of us complain about it verbally. But we rarely document it like adults with budgets and responsibilities. Walking out of a conference or training class muttering “that sucked” is emotionally satisfying but professionally meaningless.

If you want every year to be an improvement of the prior year, track cost vs. value. Then compare it to your alternatives. Another conference. A focused course. A book that changes how you work or think.

Or honestly? Staying home and doing deliberate practice instead of collecting lanyards.

Tough love

The day you decide you’ve learned “all you need to know,” the day you stop reading DFIR books, stop taking training, stop attending conferences, you haven’t reached mastery. You just declared yourself stagnant.

From that point forward, the only growth you get is whatever happens to fall into your lap at work. If that’s enough for you, fine. That’s your choice to coast.

99% of everything I see online is not for me. I am looking for that 1% that will push me 99% faster, further, and better. I maintain a spreadsheet of every course that I (or my past employers) have paid for, including the time spent and the value ranking I assigned. I’ve not always done that until some years ago, and for the early trainings, I analyzed them by memory based on the certs I received.

My personal chart is much more detailed. I include how many hours a day that I think the training/book/conference will save me, I give it a 5 year benefit, and rate my confidence in that assessment. That then gives me a dollar amount of benefits and break-even time frame. You can easily do the same with what matters to your decision making.

2026 Training

Let me plug the DFIR Training calendar. It's not there just for me, but I do use it every day. It's there so you can find training. The listings are free, so if you train, send it to me to add. You can be right up against every major provider.

The problem with DFIR vendor calendars is that many are absolutely horrendous. They are buried, hard to navigate, and love to bounce you to third-party providers until you don't even know what time zone or who is teaching the class, or if live or virtual or what.  That friction keeps people from signing up.

I merge all of that together into one, coherent calendar to make it easy to plan.

Remember

Proper planning prevents panic purchases.