The DFIR Training Blog: Why I’m Doing This
First off , thanks again for being here. The newsletter you just read is meant to be quick. Headlines only.
This blog? This is where I slow down.
Why a Newsletter Now?
I sat on this for a long time, and have sent very few newsletters out. There are already a dozen DFIR mailing lists spitting out every webinar, press release, or a recycled article of a recycled article. I didn’t want to add noise.
But here’s the problem:
- We are drowning in info, not starving.
- The “feeds” are cluttered with irrelevant junk.
- Good events, policies, and tools get lost in the noise.
But now being at over 10,000 newsletter subscribers* at DFIR.training, I can add relevant content beyond what is already available. So I built a signal-only newsletter. Short. Rare. Only when something matters.
The blog is the extension of the newsletter. Here I’ll explain the why behind the updates and probably throw in a spicy opinion here and there.
The Site Upgrade (What It Really Means)
Sure, I said “the site got faster” in the newsletter. What that actually means:
- I gutted the backend, rebuilt the event table logic, and ditched old modules that slowed you down.
- Events are now sorted automatically by date, with instant filtering.
- If you type “Windows,” you’ll see every Windows-related DFIR event. Same for “SANS,” “Magnet,” or “Tokyo.”
It’s not magic. It’s just deliberate design. The point: your time matters more than my design preferences.
Sponsors: Let's be real about sponsorship
Yes, the site runs on sponsor money. No sponsors = no DFIR.training. Unsupported sites grow stale, decay and eventually die when there is no financial support, regardless of how passionate one may be to keep it going. There dozens (hundreds?) of github lists and websites that haven't been updated in months or years, but this isn't one of those.
The DFIR.training model is built for the long term. 2026 will mark its 10-YEAR anniversary!
(yes, it's not yet 2026, but we can see it from here).
But I don’t let just anyone pay to plaster their logo. I only pick vendors whose tools I’d actually stand behind. Magnet, Arsenal, Cyber Triage, ADF, Belkasoft, and others. They’re here because they bring real value. Competing tools welcome, because we all need and use them.
Event Listings: Why Free?
This site only works if it reflects the whole DFIR ecosystem, not just the companies with budgets. I want all trainers to compete because many are not only competent, but they are ahead of the curve in many research aspects. Know something? Teach it.
So: if you’re teaching, hosting, or running a webinar, post it here. Free. Done. https://courses.dfir.training/event-listings
If you want your event to jump out on the list, that’s an option, but it's not necessary to be listed.
Newsletter vs. Blog: The Divide
- Newsletter = targeted headlines.
- Blog = deeper dives with context, rant, analysis, and opinion.
Want the quick update? Stay on the list. Want the long-form “why it matters” take? Read here.
Tools: My Ongoing Surgery
Right now, I’m scrubbing the tool list. It had gotten ugly.
- Old, unsupported projects? Cut.
- New releases and active repos? Added.
If you’ve got a tool that deserves to be here, send it. Community-driven is the only way this list stays honest. This may take some time to get done, so you’ll see changes constantly.
What’s Next
Expect the newsletter maybe once a month, twice if something important can't wait. The blog will get updated when I have something to say that doesn’t fit in a bullet point.
Discounts, specials, giveaways: those go to newsletter subscribers first. That’s the perk of being on the list. If you don’t want to be the first to hear of a limited offer, discounted tools or training, or first run copies of DFIR books, simply unsubscribe and miss out.
Opinions are like noses. Everyone has one and they all smell.
Here’s my intention: I don’t write lies or guesses. I write from what I know, what I’ve seen, what I’ve done, what I believe, and what I’ve been taught (or read, or been trained).
You shouldn’t agree with everything I say. In fact, you probably won’t. That’s the point. The value in reading another perspective isn’t about agreeing. It’s about seeing the problem from another angle so you can sharpen your own position.
If I advocate for a tool, a training, or a process, it’s because I use it and believe in it. You might not. That’s okay. That’s the discussion. And your viewpoint will influence mine, whether I agree or not.
Different viewpoints make better practitioners. That’s a win-win.
— Brett
*The DFIR.training subscriber list is big, but it is also unlimited. Feel free to join if you want advance notice of DFIR things (givaways, discounts, events, books, and my opinion on something you may or may not agree with-but will get something from it).
