Brett's Blog
What is this thing called "Patreon?"
Some have found a Patreon page that I created for the DFIR Training website ( http://www.patreon.com/dfirtraining ). Here is a short description of what is going on with me, DFIR Training, and Patreon. First off, Patreon is just a way for you to support DFIR Training (and me!). You simply choose to subscribe at a level of support that you want. Rig...
The short version: Support DFIR Training on Patreon and get this X-Ways Cheats ebook for free! The longer story: One of the most useful things I made for the 101+ Tips & Tricks X-Ways Forensics course was the Ultimate DFIR Cheats! X-Ways Forensics ebook. This is a 118-page book that is a free ebook download in the course, or yo...
For those working in DFIR , there are some who don’t travel, some who travel a lot, and some who travel all the time. Depending on the person, any of these can be enjoyable or exhausting. Right to the point If you travel for business, try to carve out a little time for sanity and lifetime experiences. It may not cross your mind at the time, bu...
If you haven’t seen yet, I started a Patreon page for DFIR Training ( www.dfir.training ). I’ve done this for a few reasons to benefit those interested and me personally. I think if you see the why, you may want to jump over and support the page. The DFIR Training takes a LOT of time to manage. Nothing is behind a paywall, everything is free t...
Twitter had some great commented threads on the North Korean government hacker (PARK) who was criminally indicted by the United States. The main point in the threads that I read revolved around whether or not the NK hacker should have been indicted as he was ‘only following orders’. If we assume the attribution of PARK is correct, in that...
Let me get something out of the way: X-Ways Forensics (XWF) is not the only forensic suite I use . It just happens to be one that I use a lot, and I like it a lot. I also like plenty of other forensic suites, but XWF is my go-to, especially for deep dive forensics. To help me learn XWF, I wrote a QuickStart Guide , a book (with Eric Zimmerman...
So, you want to start a brand new, right-out-of-the-box, digital forensics lab in your police department? Want some tips? If you (1) work for a large-sized department, you probably already have a digital forensic lab staffed with full-time, commissioned examiners. But if you (2) work for a small to mid-sized agency, your departmen...
I had the pleasure of talking to a group of high schoolers about digital forensics recently. After showing some neat things to get interest, the fun really started with getting hands-on demonstrations. I decided to use X-Ways Forensics for the hands-on fun (t ip: be sure to register your dongles with X-Ways Forensics insurance feature ). Since the ...
I’ve read some really good material on the importance of taking notes over the years and a recent post written by @mattnotmax is no exception ( Contemporaneous Notes: a forensicator's best friend ). There are plenty of really good DFIR related blog posts on note-taking (like here: https://www.forensicnotes.com/digital-forensics-do...
Low Hanging Fruit: Evidence Based Solutions to the Digital Evidence Challenge When I first saw the title, I thought this was going to be something different (as in “low hanging fruit in digital forensics investigations”), but instead realized that it’s a think-tank report asking to approve a new yet-another-digital-forensics-federal-agency tasked t...
On a couple of private (mostly LEO) email lists that I am on, it seems that emails on the lists are being provided to media outlets, specifically those that relate to breaking into the iPhone. There is not any suspicion as if this is being done, because as I read the articles, I see the actual emails that I have seen in the email lists. Someo...
Search Blog
Categories
Posts List
Tag Cloud
windows fe
RegRipper
investigation
Placing the Suspect Behind the Keyboard
case studies
X-Ways Forensics
book
Hiding Behind the Keyboard
4cast
Jimmy Weg
surveillance
gmail
phishing
bitcoin forensics
writing
Volume Shadow Copy
Windows Forensic Environment
forensics
dfir
training
University of Washington
investigations
Registry Forensics
Hacker
tor browser
bitcoin
Virtualization
North korea
privacy
email
Bitcoin Forensics
X-Ways Forensics Practitioner's Guide
windows forensic environment
winfe
wiretap
imaging
Upcoming Events
-
DEC 04
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related
.
© 2018 Brett Shavers