Brett Shavers's Blog, page 2

Intent, Not Tools, Defines the Discipline

If you work in cybersecurity (in any of the many roles under the cybersecurity umbrella), odds are you think you have a decent grasp of the cybersecurity field. But you might not. You probably have a solid grip on your slice of it, your role, your to...

I'm stepping away from DFIR...

..Review.   Talk about clickbait titles... No, I'm not stepping away from DF/IR, but I am stepping away from DFIR Review. This is a short post of reflecting on DFIR Review. Way back in 2017, I started thinking out loud about a missing piece...

DF/IR Lemonade

Digital forensics and incident response are too often taught like a parts catalog. One module on log analysis. A class on memory forensics. A blog post on timeline creation. A YouTube video on parsing registry hives. A lab on recovering deleted files...

We don’t rise to the level of our DF/IR certs and degrees. We fall to the level of our experience and training.

Everything I’ve written here is not a concept. It’s coming. Want In? Get on the List. Train like it matters. Because in DF/IR, it does. Soon, I’ll be inviting a small group to this first scenario-based cohort. If you want early access or just want to...

The Bitter Pill of DF/IR Hindsight

I once drove hours to hear minutes of a digital forensics presentation, one I felt was a waste of time.  But, that one presentation was two decades ahead of me and taught me a valuable lesson about what happens when you think you know enough. Hi...

The Two Bulls of DF/IR: Why Charging Ahead Still Loses the Case

There are two scenes in the movie Colors that every DF/IR professional could learn from. Sean Penn plays the rookie in both scenes—eager, aggressive, charging downhill. In the first scene, Robert Duvall plays the veteran—calm, methodical, deliberate....

From Why to What: The Decline of Investigative Thinking in DF/IR

We used to ask why. Why would the suspect use this device? Why was this action taken at that time? Why does this one detail feel wrong? Now? We only ask what. What tool recovers deleted files? What script finds the browser history? What keyword pulls...

Your Mood Is Murdering Your DF/IR Investigation and You Don’t Even Know It

TL:DR: Your current mental state is either helping or hurting your case right now. Investigative work isn’t just about what you know. It’s about how well you can think under pressure, and that depends on the state you're in when you sit down to work....

DF/IR was built in a garage

Why DF/IR Professionals Need to Set the Standards Before It’s Done for Us DF/IR wasn’t built in a lab. It was built in a garage. Not a cleanroom. Not a courtroom. Not a classroom. Not a conference room full of policy makers. A garage. By people like ...

Why Acting Like Jack Reacher in DF/IR Will Land You in Court, Not on a Bestseller List

I ran a little experiment for my upcoming book, DF/IR Investigative Strategies. I asked a few DF/IR professionals—none with law enforcement backgrounds—to watch Reacher (Season 3, Episode 2) and tell me what crimes or policy violations they spotted. ...