Brett's Ramblings
The #1 factor is not giving up . The #2 factor is talent . Actually, scratch #2. You can make it without talent if you don’t give up. Talent is overrated. <sounds of desks being pounded> Let me explain what I mean before going further. Not giving up has to be the most important, because if you give up, no matter how good you are, you will not...
Short version:
- Bring your A Game
- Don’t hold back
- Be prepared
- Know what you claim to know
- Fight complacency
This week, @taosecurity ( Richard Bejtlich ) wrote an important blog post on managing burnout ( Managing Burnout ). As he mentions in the first sentence, he is not talking only about information security, but burnout in any profession. I’m certainly no expert in preventing burnout, other than regularly bringing myself to the burnout line, because t...
Call me paranoid. It’s okay. I’ve been called worse. Nothing I am saying in this post will harm officer safety and actually should increase it. The public needs to tell cops to stop being online marketing tools. PIOs choose to be a public figure, but the everyday patrol officer is a law enforcement officer, not a marketing tool. Officer safety is r...
Stand by, here comes my opinion on forensic tools (software and hardware) I tend to prefer having the option to pick among a large selection of tools to be highly specific in solving problems. The fewer options I have, the more likely I will be doing an “OK” job instead of doing a “good” job. Worse still, when not having the right tools, I may not ...
The mechanics of digital forensics (and its related cousin, incident response) are fairly easy. A computer is a computer is a computer. Collecting data is collecting data. And an artifact is an artifact. As long as you follow the basic mechanical principles and concepts, you should be able to do the work without impossible obstacles. A most basic e...
For engagements where my clients ask for help in preparing for a ransomware attack, the most asked question is, “ Do you recommend we pay if it happens to us? ” The decision to pay (or not) is based on the specific and unique situation. Are there unaffected backups? Is the encrypted data valuable or can it be re-created? Is the entire network ...
I’m big on attribution in crimes. It is my personality and attitude, which you can probably tell from the things I write and say (and have done ). With that, I completely understand that the “IR” in “ DFIR ” is not primarily about attribution, if it ever is. The IR (Incident Response) is a different job than the DF (Digital Forensics), but st...
Some have found a Patreon page that I created for the DFIR Training website ( http://www.patreon.com/dfirtraining ). Here is a short description of what is going on with me, DFIR Training, and Patreon. First off, Patreon is just a way for you to support DFIR Training (and me!). You simply choose to subscribe at a level of support that you want. Rig...
The short version: Support DFIR Training on Patreon and get this X-Ways Cheats ebook for free! The longer story: One of the most useful things I made for the 101+ Tips & Tricks X-Ways Forensics course was the Ultimate DFIR Cheats! X-Ways Forensics ebook. This is a 118-page book that is a free ebook download in the course, or yo...
For those working in DFIR , there are some who don’t travel, some who travel a lot, and some who travel all the time. Depending on the person, any of these can be enjoyable or exhausting. Right to the point If you travel for business, try to carve out a little time for sanity and lifetime experiences. It may not cross your mind at the time, bu...
If you haven’t seen yet, I started a Patreon page for DFIR Training ( www.dfir.training ). I’ve done this for a few reasons to benefit those interested and me personally. I think if you see the why, you may want to jump over and support the page. If you support the Patreon page, you’ll get access to the training courses that i have created and...
Twitter had some great commented threads on the North Korean government hacker (PARK) who was criminally indicted by the United States. The main point in the threads that I read revolved around whether or not the NK hacker should have been indicted as he was ‘only following orders’. If we assume the attribution of PARK is correct, in that...
Let me get something out of the way: X-Ways Forensics (XWF) is not the only forensic suite I use . It just happens to be one that I use a lot, and I like it a lot. I also like plenty of other forensic suites, but XWF is my go-to, especially for deep dive forensics. To help me learn XWF, I wrote a QuickStart Guide , a book (with Eric Zimmerman...
So, you want to start a brand new, right-out-of-the-box, digital forensics lab in your police department? Want some tips? If you (1) work for a large-sized department, you probably already have a digital forensic lab staffed with full-time, commissioned examiners. But if you (2) work for a small to mid-sized agency, your departmen...
I had the pleasure of talking to a group of high schoolers about digital forensics recently. After showing some neat things to get interest, the fun really started with getting hands-on demonstrations. I decided to use X-Ways Forensics for the hands-on fun (t ip: be sure to register your dongles with X-Ways Forensics insurance feature ). Since the ...
I’ve read some really good material on the importance of taking notes over the years and a recent post written by @mattnotmax is no exception ( Contemporaneous Notes: a forensicator's best friend ). There are plenty of really good DFIR related blog posts on note-taking (like here: https://www.forensicnotes.com/digital-forensics-do...
Low Hanging Fruit: Evidence Based Solutions to the Digital Evidence Challenge When I first saw the title, I thought this was going to be something different (as in “low hanging fruit in digital forensics investigations”), but instead realized that it’s a think-tank report asking to approve a new yet-another-digital-forensics-federal-agency tasked t...
On a couple of private (mostly LEO) email lists that I am on, it seems that emails on the lists are being provided to media outlets, specifically those that relate to breaking into the iPhone. There is not any suspicion as if this is being done, because as I read the articles, I see the actual emails that I have seen in the email lists. Someo...
Working in DFIR requires that you convey information to someone else . There is no way around this requirement. You simply must do it. Whether talking to a client, a supervisor, or a class, you convey information all the time. I am not talking about communication or interpersonal skills, but rather the act of presenting information as an inst...
Let me preface this post: When I worked undercover, I was one of the most paranoid extremists in trying to be as unrecognizable as possible. I worked cases involving dangerous individuals, career criminals, street gangs, and organized crime groups that operated not only locally, but internationally. While undercover, I was searched, followed, ...
Reading through the paper“ Forensic framework to identify local vs synced artefacts ” from DFRWS 2018 Europe, I came across a paragraph with several statements that I had to read twice, actually several times. The paper cited a book that I wrote in 2013 ( Placing the Suspect Behind the Keyboard ). The paper states: “…he fails to make any reference ...
The Reality Winner case is good example where a basic investigative method still works regardless of how much publicity that the same method has received for years prior. In the Winner case, printed documents were tied to Winner based on “microdots”. This article below does a decent job of explaining what micro dots are if you haven’t heard of this...
…because everyone can be an expert. One thing about the DFIR field and all of its ever-encompassing related fields, is that it is physically impossible for any one person to be an expert in the entirety of the field. To even try to be ‘that DFIR expert ’ is to set yourself up for failure. I base my opinion on what I’ve seen over the years, especial...
An incredible new Gmail feature, “ Confidential E-mail Mode ” by Google looks to be one of those wonderful surprises that will be catching people off guard in a bad way. TL:DR version. Send an email using Gmail in which Google puts a link in the body (and removes your e-mail content from the e-mail). The link, in which only the recipient can open, ...
Emotions run deep if you are victimized. Initially, you want blood at any cost. You also willingly accept any potential future regret, as long as you get blood today. And unfortunately, no matter how fast justice may come, it will not be soon enough. This rationale applies to being a victim of any crime and having your computer system hacke...
Occasionally I am asked by police officers working in digital forensics if they should leave their current job to go to the private sector. Luckily, I can now refer them to read Eric Huber’s blog series “ Life After Law Enforcement: Do I Stay Or Do I Go? ” to let not your heart be troubled when making this decision. For the vast majority of every...
Posts List
Tag Cloud
Jimmy Weg
gmail
Windows Forensic Environment
investigations
Virtualization
case studies
Volume Shadow Copy
windows forensic environment
4cast
RegRipper
Hiding Behind the Keyboard
training
bitcoin forensics
winfe
forensics
Placing the Suspect Behind the Keyboard
University of Washington
investigation
X-Ways Forensics Practitioner's Guide
writing
bitcoin
email
Hacker
Bitcoin Forensics
North korea
Registry Forensics
book
windows fe
dfir
privacy
tor browser
X-Ways Forensics
phishing
imaging
surveillance
wiretap
Search Blog
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
Even better, support DFIR Training at Patreon and get access to multiple online courses in digital forensics with included ebooks!
© 2019 Brett Shavers