About Brett Shavers
I entered digital forensics and incident response in 2003 after a decade in law enforcement, including undercover work involving narcotics, firearms, vice, human trafficking, border smuggling, and terrorism investigations.
While working cases, I pursued digital forensics training and formal education. Much of this was trial and error, personally funding training, and making lots of errors and mistakes while asking a lot of questions. I later proposed and built my agency’s first digital forensics lab. That work led to a career across government and private-sector investigations, including criminal cases, internal corporate matters, civil litigation, and class-action matters.
I later moved fully into the private sector, working as an employee, managing principal, and business owner. Across every role, the constant has been casework: solving real problems, making defensible decisions, and working matters where the details actually matter.
I have been qualified in court as an expert based on practical case experience, not theory alone.
How I Approach the Work
I use whatever tool does what it claims and solves the problem at hand. Results come first. Brand loyalty comes second.
Yes, I wrote two books on X-Ways Forensics. That does not mean I force every problem through one product. When a tool proves itself, I support it. When it no longer does, I move on.
What I Believe About Attribution and Frameworks
Digital evidence does not know who was behind the keyboard. It can show what happened on a device, inside an account, across a network, or within an application. It can show activity, artifacts, timing, access, and sometimes intent. But it does not automatically identify the person responsible.
Attribution is where technical findings become investigative conclusions. I wrote a book just to impress that point (Placing the Suspect Behind the Keyboard).
Frameworks matter because they force discipline. A good framework does not replace judgment. It does not manufacture truth. It gives the investigator a structure for asking better questions, testing competing explanations, documenting reasoning, and showing how a conclusion was reached. That's also the inspiration for creating the FACT Attribution Framework.
Why DFIR.Training Exists
DFIR.Training exists for two reasons:
- To maintain a fast, practical reference I can rely on for casework, research, and resource discovery.
- To make that same resource available to the DFIR community for free.
This site is fully funded by DFIR sponsors (that is why it is free, updated, maintained, and shared!). I encourage you to take a look at their products as I stand behind each one of them, which is why I asked them to be a sponsor.
How to Use This Site
Use DFIR.Training the same way I do: to find practical resources that help solve real problems.
Browse the training, tools, events, and references. If something useful is missing, let me know. If it adds real value, I will include it so others can benefit too.
With every bit and byte,
Brett Shavers
www.brettshavers.com