What’s New at DFIR Training?

The website is approaching pure awesomeness. Lots of input, some help as well. Here are a few of the most dynamic changes being made that benefit your work directly.

Connecting the dots

This is the goal: Search for “x” and have connectivity to “y” and “z” that directly relate to your search of “x”.  In any professional field, everything is connected to everything. This is the goal of DFIR Training: connect the dots for you. Search for one thing and have everything related to it at your fingertips.

For example, let’s use the Paraben E3: Universal forensic suite as an example in the DFIR Tool database.

https://www.dfir.training/tools-sw-hw/paraben-e3-universal

The tool’s page shows the (1) basic information of the tool, (2) the direct link to the developer or download, (3) whether free or not, (4) link to training, (5) link to legal case references, (6) type of tool, (7) a brief summary of the tool, and (8) videos about the tool. If I can find publicly available tests of the tool, this will also be listed on the same page!

You can see the end goal is to have everything you need about a tool in one place;

-- training events ,

-- court cases and legal references ,

-- tool tests , and

-- video demos .

As of now, completing this for every tool will take lots of time, but the wheel has begun to roll to connect the dots, collect the affidavits and court records, and encourage providers to list their tools, events to support dfir.training.  It will be about a month before I categorize all of the current tools due to the switch from the prior database that I was using. 

If you see a tool that needs to be added, please do ?

Forensic Artifact database example

Let’s take another example using the prefetch artifact.

https://www.dfir.training/artifacts/artifact-prefetch

The artifact listings, like the tool listings, are being populated with information, so you’ll have to be a little patient before the database will always have something that you are looking for. But the intention is to have it like the tools, in that you can get in one place (1) name of artifact, (2) path, (3) operating system, (4) list of forensic tools that can pull the artifact, (5) white papers about the artifact, (6) category, (7) a citable definition for your reports and affidavits, (8) references from blogs, and (9) video tutorials on the artifact.

Again, you can see the point of dfir.training is to tie everything together in a neat package. Need a tool? Search for a tool and have everything you need about it to make a decision as to whether or not to use it based on tool tests, court cases, and function. Researching an artifact? No problem. Citable definitions for your reports or court, tools that can analyze the artifact, and tutorials about the artifact.

If you would like to contribute to the forensic artifacts, you are not only welcome but encouraged! https://www.dfir.training/submit-artifact

Case study released

I have a few new case studies to release on DFIR Training’s Patreon’s page, and with a new subscriber release, here is one of the past case studies that you might gain a bit of insight on how others investigate cases that could benefit your cases.

DFIR Subcontracting work

I have seen more than a few DFIR folks being laid off due to COVID-19. Any loss of any job is disheartening, and maybe to help bridge the gap between jobs, if you are looking for work as a contractor, you can submit a listing on dfir.training and I will help get the word out to companies that could use subcontractors.

Any arrangements will be between a company and the subcontractor, and DFIR Training won’t be involved in any agreements or disagreements.  Simply submit your information on what you are able to sub (expertise, location, etc...) and maybe have some work to help during this COVID-19 disruption of work.

Any company is also free to submit their business (and/or tool) listings too!

Featured tools, events, and listings

Companies that wish to have more exposure are encouraged to have featured listings. For more information, request a media kit https://www.dfir.training/contact-dfir-training to see the options available.

Latest uploads

As of now, you can check for the latest 10 uploads at the resources page ( https://www.dfir.training/resources-dir ).  All of the downloads are available through respective links, such as tool testing uploads will be associated with the respective tools, etc…

DFIR Training supporters!

This website would not exist if not for the DFIR Training Patreons at https://www.patreon.com/DFIRTraining !  My gratitude goes out to each of them, which is why I give everything that I can to them in form of ebooks, courses, and podcasts, of which, I am due this month to release a few courses and podcasts!