399 DFIR practitioners are already registered.

What can a DFIR practitioner actually do with an LLM in casework without wrecking the case or career?

Live webinar. Tues Apr 21. 12PM MT. One time only.
www.suspectbehindthekeyboard.com/offers/2QFz3...

I think a factor of things. The org, the work, the person, the workload, the training, etc...

Week 12 – 2026 Mobile Forensics CheatsheetMobile devices track vast amounts of user activity—often a goldmine of forensic evidence:- Device information- Application usage- Bluetooth and Wi-Fi connections- …and ot…

Week 12 - 2026 #DFIR
thisweekin4n6.com/2026/03/22/w...

56% are either likely to leave DFIR within 12 months or unsure if they’ll stay. DFIR Is Burning People Out. Digital forensics has a burnout problem. This isn't new news, but it is important.Forensic Focus and Northumbria University are running an anonymous international well-bein...

Incredible stat. Where do you fit, #DFIR?
www.dfir.training/blog/56-of-d...

A Practical Map of the DFIR Internet: Marketplaces, FAQs, and Fire Exits The right DFIR resource at the right moment is worth more than ten bookmarked sites you never learned how to use.No one DFIR website does everything well. And it shouldn’t. Trying to be everything usu...

www.dfir.training/blog/a-pract... #DFIR

Late this year at the earliest, but most likely 1st quarter of 2027. It's going to be a very different book from the first two. The first two book point out the buttons and how XWF works.

This upcoming book will be how to use XWF on specific case types (fraud, harassment, malware, etc...).

Thanks for joining!

On Feb 24 at Magnet's FREE virtual summit, @dwmetz.bsky.social and I will be talking about DF and IR, but not about "DFIR", if you know what I mean. magnetvirtualsummit.com/registration... #DFIR

Investigative Decision-Making in #DFIR.
Thursday. Feb 5, 2026. 11AM PT.
A 24-hour replay, and then it's gone.
You will see attribution in a totally different light.
www.suspectbehindthekeyboard.com/offers/fUKjJ...

Eventually, human-created content (audio, visual, written word) is going to become really expensive.

📢 Publication du FACT Attribution Framework v1.0 pour relier preuves numériques et attribution humaine
📝 Selon la notice de publication of…
cyberveille.ch/posts/2025-12-10-publica... #DFIR #Cyberveille

accurate

Sharing #DigitalEvidence shouldn’t slow a case down. With Portable Case, you can securely share case data—without needing full forensic tools.

Learn about some of the most powerful features of Portable Case and see how they can be particularly effective for investigators: ow.ly/9aZQ50XXnmt

haha because true!

The DFIR Three-Body Problem Let me first interject first this so you don’t miss it - Magnet MVS 2026 The Magnet Virtual Summit 2026 is free (Feb 23–26). When you register, you’re entered to win a full year of Magnet Forensics tr...

The same people who pushed you for speed during the primary incident will ask you, with a straight face, why you didn’t preserve the things they now need.
www.linkedin.com/pulse/dfir-t... #DFIR

Week 02 – 2026 No sponsor this week. If your organisation is interested, head over here to find out more. Akash PatelCase Studies: Building Effective Timelines with Plaso (Log2Timeline) Christian Peter“Far over t…

Week 02 - 2026 #DFIR
thisweekin4n6.com/2026/01/11/w...

Week 01 – 2026 Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod…

Week 01 - 2026 #DFIR
thisweekin4n6.com/2026/01/04/w...

What a world where we have to edit 3x more than usual to make sure we don't sound like AI, then eventually, we start sounding like AI in our writing...

It's almost to the point of having to intentionally plant errors in our writing, but eventually, AI will do that too to avoid sounding like itself.

Your DF/IR Tool Can’t Tell You Who Did It. FACT Tells You When You’re Allowed To. DF/IR doesn’t usually fail on the technical work. It fails at the exact moment someone gets impatient and confuses activity with identity, and then confuses identity with attribution. “This account di...

Your #DFIR report is fine… until you name a person.
brettshavers.com/brett-s-blog...

Week 50 – 2025 Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod…

Week 50 - 2025 #DFIR
thisweekin4n6.com/2025/12/14/w...

Tie the Act to the Actor — DFIR Soundtrack (Official Music Video) - YouTube Track 1: Tie the Act to the ActorTrack 2: Pattern of LifeTrack 3: Tracing Criminals OnlineTrack 4: Investigative MindsetTrack 5: CaseworkTrack 6: Order of Vo...

Soundtrack for #DFIR get into the mood.
www.youtube.com/playlist?lis...

An Attribution Framework for #DFIR.
zenodo.org/records/1774...

I was on Darknet Diaries Ep. 165! Learn about dumb buildings with malware, how going to the dentist can get you in hot water, and that sharing breach information can you get buy in with software developers.
YouTube: https://twp.ai/9PYHxj
Or any podcast platform

Legal Unpacked E3: Proving who was holding the phone: Drafting warrants that explain the need for user attribution - Magnet Forensics Knowing what happened on a device is only half the story—proving who was behind the activity is critical.

On Dec 3, join us for our next episode of #LegalUnpacked, where Justin Fitzsimmons will focus on how to draft search warrants specifically designed to uncover evidence of user attribution.

Save your spot here: ow.ly/hRSM50XALPi

#DFIR

Week 48 – 2025 Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

Week 48 - 2025 #DFIR
thisweekin4n6.com/2025/11/30/w...

DF/IR Investigative Mindset Course

If you want to develop how you think, not just what to click in DFIR work, this is it.

On-demand course, take it anytime over the next year.
One-day opportunity, Black Friday only.
Only 50 spots, because I’m only printing 50 signed hardcovers.

www.suspectbehindthekeyboard.com/mindset

#DFIR

I fell in love at first sight.
Then I realized the timestamp was in UTC and I was mistaken.

In this #CustomerStory, find out how Vigo County High Tech CyberCrime Unit is using #MagnetReview to get #DigitalEvidence into the hands of their investigators faster than ever.

Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR

You'd think, right?

I spent two years in litigation hell. Trial was worse.

Thirty years of courtroom experience made me cocky, but the court fixed that.

This is the first and only time I talk about this case, as this is the case that made me think of quitting DFIR.

brettshavers.com/brett-s-blog...