Some DFIR tools are terrible…if not used correctly. I saw an engaging discussion online about tool choices that inspired this post about tools. I particularly enjoyed how someone gave an example of how tools are referred. I changed the example a little, but the more I look at it, the more I can remember this happening all the time: Person 1: What tool can I use for “X”? Person 2: Use this one.…

Few clichés are more worn out than the tired “think outside the box”. I still stay it, but when I do, I say it to literally mean do not conduct an analysis solely within the physical box (CPU). Remember, everything that happens with data has happened because a person or persons made it happen. People do not live in a box. They live and operate in the outside world. People are behind actions.…