Investigative Decision-Making in #DFIR. Thursday. Feb 5, 2026. 11AM PT. A 24-hour replay, and then it's gone. You will see attribution in a totally different light. www.suspectbehindthekeyboard.com/offers/fUKjJ...

Eventually, human-created content (audio, visual, written word) is going to become really expensive.

📢 Publication du FACT Attribution Framework v1.0 pour relier preuves numériques et attribution humaine 📝 Selon la notice de publication of… https://cyberveille.ch/posts/2025-12-10-publication-du-fact-attribution-framework-v1-0-pour-relier-preuves-numeriques-et-attribution-humaine/ #DFIR #Cyberveille

accurate

Sharing #DigitalEvidence shouldn’t slow a case down. With Portable Case, you can securely share case data—without needing full forensic tools. Learn about some of the most powerful features of Portable Case and see how they can be particularly effective for investigators: ow.ly/9aZQ50XXnmt

The same people who pushed you for speed during the primary incident will ask you, with a straight face, why you didn’t preserve the things they now need. www.linkedin.com/pulse/dfir-t... #DFIR

Week 02 - 2026 #DFIR thisweekin4n6.com/2026/01/11/w...

Week 01 - 2026 #DFIR thisweekin4n6.com/2026/01/04/w...

Your #DFIR report is fine… until you name a person. brettshavers.com/brett-s-blog...

Week 50 - 2025 #DFIR thisweekin4n6.com/2025/12/14/w...

Soundtrack for #DFIR get into the mood. www.youtube.com/playlist?lis...

An Attribution Framework for #DFIR. zenodo.org/records/1774...

I was on Darknet Diaries Ep. 165! Learn about dumb buildings with malware, how going to the dentist can get you in hot water, and that sharing breach information can you get buy in with software developers. YouTube: https://twp.ai/9PYHxj Or any podcast platform

On Dec 3, join us for our next episode of #LegalUnpacked, where Justin Fitzsimmons will focus on how to draft search warrants specifically designed to uncover evidence of user attribution. Save your spot here: ow.ly/hRSM50XALPi #DFIR

Week 48 - 2025 #DFIR thisweekin4n6.com/2025/11/30/w...

If you want to develop how you think, not just what to click in DFIR work, this is it. On-demand course, take it anytime over the next year. One-day opportunity, Black Friday only. Only 50 spots, because I’m only printing 50 signed hardcovers. www.suspectbehindthekeyboard.com/mindset #DFIR

In this #CustomerStory, find out how Vigo County High Tech CyberCrime Unit is using #MagnetReview to get #DigitalEvidence into the hands of their investigators faster than ever. Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR

I spent two years in litigation hell. Trial was worse. Thirty years of courtroom experience made me cocky, but the court fixed that. This is the first and only time I talk about this case, as this is the case that made me think of quitting DFIR. brettshavers.com/brett-s-blog...

In case you missed it last week, a new Arsenal Image Mounter (v3.12.331) has been released with a long list of improvements for #DFIR practitioners including Arm on Arm virtualization. You can see some highlights in our Insights article at arsenalrecon.com/insights/qui....

I once beat a 20-year DFIR forensic expert in court. Not because I was better, but because I had a $1,500 certificate. → www.suspectbehindthekeyboard.com/fighting-cit...

Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com

Week 44 – 2025 #DFIR thisweekin4n6.com/2025/11/02/w...

Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR

I got a little luv and a wink today. www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR

I'm charging my client 2x for making me miss this today. www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR

Time is almost up to participate in our State of Enterprise #DFIR survey! Complete the survey before Oct 31 to let us know your thoughts on the latest developments in DFIR along with emerging threats, operational challenges, and areas for improvement: ow.ly/6hV750XgYic

Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR

Ever wonder what happens when a DFIR investigator ends up on the other side of the case file? I fought city hall, literally, and learned DFIR lesasons no training ever covered. www.suspectbehindthekeyboard.com/fighting-cit...

Ever try to out-document a team of Harvard attorneys? It’s like fighting gravity with paper cuts. Still, it works if you know the rules.

DFIR comes down to one thing.

Week 43 – 2025 #DFIR thisweekin4n6.com/2025/10/26/w...

If you got no plans for the weekend....here's this! TERABYTES OF FREE FORENSIC TEST IMAGES AND HUNDREDS OF CTFs! www.dfir.training/downloads/te... #DFIR #digitalforensics

Week 42 - 2025 #DFIR thisweekin4n6.com/2025/10/19/w...

AI Assisted Forensics & Forensics on AI Systems at DFRWS APAC! 🧠 Papers on LLMs timeline analysis, investigating local AI apps, & new comms data tools. See the full program! 👉 Reserve your seat: buff.ly/JV23sUN #research #dfrws #DFIR #apac #digitalforensics #seoul #korea

Week 41 - 2025 #DFIR thisweekin4n6.com/2025/10/12/w...

#DFIR is facing a huge inflection point and no one knows that like those who are living it day in and day out. We’ve just opened our survey for our State of #EnterpriseDFIR Report until Oct 31 and your insights are incredibly valuable: ow.ly/NBsa50X9eCv

Week 40 - 2025 #DFIR thisweekin4n6.com/2025/10/05/w...

The new #MagnetNexus hybrid collection agent gives #DFIR teams the flexibility to collect data from remote endpoints using either cloud-powered workflows with Nexus or on-prem workflows with #AxiomCyber, all with a single, lightweight endpoint agent: ow.ly/kKWr50X6gsW

“Push-button forensics” is often criticized as a threat to expert examiners. In reality, #DFIR tools designed for ease of use aren’t about replacing human expertise but focusing on what matters: in-depth analysis, context, and human judgment. Read more: ow.ly/9gMZ50X4p8v

Week 39 - 2025 #DFIR thisweekin4n6.com/2025/09/28/w...

Don’t miss Magnet Forensics’ Mobile Unpacked with Chris Vance as he unpacks iOS 26’s biggest forensic changes and challenges—register now! www.forensicfocus.com/news/... #MagnetForensics #MobileForensics

Week 38 - 2025 #DFIR thisweekin4n6.com/2025/09/21/w...

Am I the only one who feels this way? www.linkedin.com/pulse/every-...

I want to thank @brettshavers.bsky.social for the opportunity taking his "DF/IR Investigative Mindset" course! This is an amazing course for everyone! Whether you're a vetran or just starting your #DFIR career. I can't recommend it enough. Brett, thank you so much 🙏🏻

When business data is widely distributed, organizations face challenges responding to litigation or regulatory events, such as legal holds for #eDiscovery investigations. In this blog, learn how #DigitalForensics solutions enhance legal holds: ow.ly/yBKZ50WVh4l #DFIR

In this #CaseStudy, discover how Nardello & Co., a global investigations firm, leveraged the speed and flexibility of #MagnetNexus to successfully investigate a remote #CyberIncident on a yacht at sea, all within 12-24 hours: ow.ly/3B7q50WS2Ek #DFIR

🚨 Just hit 1,000+ DF/IR trainings listed. That’s every webinar, course, and conference worth knowing in one place, and in one search box. www.dfir.training #DFIR

Week 34 - 2025 #DFIR thisweekin4n6.com/2025/08/24/w...

*New live hack demo - stealing security question answers w/ AI voice clones* At @defcon.bsky.social I went on ScammerPayback podcast and hacked the host by calling his friends & stealing answers to his bank's password reset questions using a voice clone w/in 10 secs. www.youtube.com/watch?v=xEdZ...