If you work in DFIR, you are an investigator.

To think otherwise is to do yourself and your cases a disservice. By this, I mean that the most basic task in the DFIR field is to find out what happened, and this is the purest definition of an investigator: find the truth of the matter .

https://www.dictionary.com/browse/investigator

Your specific job function may be completely different from many others in the same field, that is to say the DF might be a world apart from the IR. But for any practical discussion, the entire purpose of DF/IR is to employ an investigative process to uncover, discover, analyze, and interpret clues in order to reassemble the past. Whether the “past” is a breached system or reconstructing a crime that was committed using a computing device, the investigative intention is the same.

If you already had investigative training before getting into DFIR, you

My Goal for you:  Become a DFIR Earth Mover.

I don’t think that most of us in DFIR are working to be “famous”. Actually, I don’t personally know anyone who has a goal to be famous in this field. Everyone I know just wants to be good today at what they do and to be a little better at it tomorrow.

That has also been my daily goal too: Learn a little more today than I knew yesterday. Prevent mistakes that I made yesterday from happening today. Share a little something that I learned with someone else to make their world a little better than it was before.

There are many in this thing we call “DFIR” who I call DFIR Earth Movers. They are my role models, my quiet mentors, and where I hope to be in achieving my personal goals.  Most, I have never met in real life

We have plenty of negative news in the media, and our lives have changed. I foresee the future of our workplaces and education evolving into something drastically different. We are already seeing the amazing ability to operate businesses with more remote workers than ever thought possible. Educational institutions seamlessly flipped a switch and turned classrooms into online learning, effectively eliminating all the problems associated with travel on the roadways.

Gain New Skills and Knowledge. Make Your Own Experience. Increase Your Competence.

Many of us have no choice but to work from home during this pandemic.  Some of us may not even have working-from-home as an option. But both situations can benefit from the changes the world is going through, specifically in being granted more time and more opportunity to learn .

The important stuff

If your employer is trying to find ways to pay you if you have been sent

One of the coolest things about the DFIR field is the research! For those with time to research some minute detail of forensics, there is no cooler job in the world! Unfortunately, many of us don’t have near the time to research as much as we could, even though there are so many topics and sub-topics and sub-sub-topics that could use a good drilling down to figure out.

We have a plethora of students and researchers who have the time (and sometimes, it is part of their job or homework) to conduct the research that this field needs. The one thing that I have found when you have the time to research is deciding what to research. For some reason, when I am up to my elbows in data, I come up with a dozen topics that I want to research as soon as I get the time. Then….I get

I recently did a case study for a class, using a real case from one of the students in class.  When I get to do this on a real case, it is quite the opportunity to both learn and teach.  I review cases often, both as a peer reviewer and for personal training exercises, but when I say, “real case”, I mean that is where I get to see the entire case and have access to the investigator/examiner.

Three Types of #DFIR Case Studies

The depth of any case study is limited only by the amount and veracity of the case information. Do not discount any of the following types as not being as good as another because as you will see, each type of source material can give you different types of real benefits.

1-Training/Educational/Commercial-Fictional cases, or real cases that are fictionalized.

These types of cases are generally

We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown! Whether you were born or have been doing DFIR work during this period, there has been much going on.

We’ve gone from “pull the plug and image the entire drive” to “fit the process to the totality of the situation”.  Processes and methods have grown exponentially in what we keep learning about digital forensics. Whether we are triaging terabytes of data prior to collection or doing live examinations involving volatile memory, the field has grown quickly over the past two decades compared to simply imaging hard drives (which we still do of course).

Let’s fly over just some of the highlights of only a few of the areas. Keep in mind that there is so much that has happened, that I only selected a few

How do you know if you improved your skill and knowledge base over the past years, or even over the past week? Did you even improve anything from yesterday? And if you did, how do you know?  Are you better working the DFIR today than yesterday? There is something you can do to check.

Pit yourself against your most fearsome opponent: Yourself !

We are our own worst enemy in many facets of life. We are the most critical of ourselves compared to anyone, even compared against the most overprotective parents or the strictest music teacher you’ve ever had or seen. We are tough on ourselves. Let’s take that toughness and use it for a benefit!

To see how much you have grown and developed in DFIR skills, block out a day to check yourself against a younger version of yourself. If you have a case or analysis from years