Yesterday’s release of the free forensic test images and CTFs took off fast. Downloads, shares, and discussions across social media haven’t slowed down. Over 38,000 views in just 2 days. Goodness. That tells me something important: practitioners don’t just want datasets to play with; they want real data to practice on and tools to make sense
Every few years, we declare digital forensics dead. Each new technology was supposed to end investigations forever. None did. They just changed where the evidence lived and how examiners had to think. But AI is different. It’s the first to challenge both the evidence and the examiner. 1991–Late 1990s – The First Encryption Panic When Phil Zimmerman
Somewhere between certification badges, shiny dashboards, and endless webinars, the DF/IR mission got lost. We built an industry obsessed with what a tool can do instead of what a case requires. Now, we measure competence by how many tools we can operate instead of how well we can tell the story they uncover. Scroll any job posting and you'll see a...
First off , thanks again for being here. The newsletter you just read is meant to be quick. Headlines only. This blog? This is where I slow down. Why a Newsletter Now? I sat on this for a long time, and have sent very few newsletters out. There are already a dozen DFIR mailing lists spitting out every webinar, press release, or a recycled art
PSBK Vol. 3 Update: The Casework Book I Wish Existed This volume has been the hardest thing I’ve written because it’s not a “how to click” book. I have learned that it is much easier to write ‘how to run a tool book’ than it is to write ‘when and why (or if)’ to use a tool or ‘which tool is best to use in a million different situations.’ It’s also
Words Make Habits: Why “DFIR” (brand or integration) vs “DF/IR” (operating model) changes how people learn, build programs, and behave in incidents. The way we label our work, DFIR vs DF/IR vs IR vs DF, doesn’t just reflect the work. It shapes who we hire, how we train, what we learn, what tools we buy, and how we handle evidence or incidents when
In DF/IR, decisions stack. Each one points you toward the truth or away from it to a multiple of bad outcomes. The visual tells a familiar story. You start with a single investigative decision point. Get it right, and you’re on a straight, clean path toward the correct outcome. Get it wrong, and suddenly you’ve branched into a maze of wrong turns,
In DF/IR and just about every other professional training environment, we measure training the same way prisons measure sentences: by time served. 1-day course? “That’s 8 hours.”5-day course? “That’s 40 hours.”2-week bootcamp? “80 hours.” Those numbers are a lie. What you’re actually getting in an “8-hour” class, at best, is 6.25 hours of instructi
Science is precise. DFIR should be too. But by definition, and by practice, it's often anything but. Context in DF/IR matters more than what you might realize Harlan Carvey started a thread on the “F” in DFIR. I agree with what Harlan is talking about. I believe Harlan is the first one, or one of the first, to write DFIR as “DF/IR” way back in the
Part 6 of 6 in the DF/IR Talent Pipeline Series You made it to Part 6! I hope you got a good nugget or two that helps you in your career or helps you help someone else in their career. I saved the best for last, and this advice is just as valid for the person who is in their first DF/IR class and the person who has worked 20 years in the fiel