Sign in

Brett Shavers

@brettshavers.bsky.social
1.1K followers 220 following 4.7K posts

Fell off a cliff. Swam with sharks. Dined with hitmen. Hung out with crime bosses. Bought and sold a ton of drugs. How the heck am I still here? DFIR USMC 🚓

PostsRepliesMedia
Brett Shavers @brettshavers.bsky.social · 24/09/2026
Forensic examiners usually ask two questions: Is the tool easy to use, and does it work? Country of ownership rarely makes the top ten. brettshavers.com/everyone-sud...
brettshavers.com
Everyone Suddenly Knew Oxygen Forensics Was Guilty – Brett's Ramblings
DOJ alleges hidden Russian ownership and a fake U.S. build. That is not malware, FSB control, or proof the industry already did the work.
000
Brett Shavers @brettshavers.bsky.social · 11/09/2026
"The Complete Guide to DFIR by Someone Who Never Did It" www.linkedin.com/pulse/comple...
linkedin.com
The Complete Guide to DFIR by Someone Who Never Did It
If you use AI to summarize everything you read, let me save you the trouble with this one. Me: Summarize this article in 3 bullet points in an 8th grade reading level.
000
Brett Shavers @brettshavers.bsky.social · 09/09/2026
010
Brett Shavers @brettshavers.bsky.social · 09/09/2026
brettshavers.com/you-suck-at-...
brettshavers.com
You suck at DFIR if you’re vibe-coding forensic apps. – Brett's Ramblings
030
Reposted by Brett Shavers
Magnet Forensics @magnetforensics.bsky.social · 09/07/2026
Join us July 29 at 11:00 AM ET for a live and interactive Ask Me Anything (#AMA) session with seasoned #DFIR practitioners as they tackle your toughest #IncidentResponse questions and share practical guidance from real-world investigations. Register now: ow.ly/RaYh50ZmchU
012
Reposted by Brett Shavers
DFRWS @dfrws.bsky.social · 09/07/2026
🚨All DFIR Investigators Save 10% Discount Code: 10%4DFIR | Register Now dfrws.org Join DFRWS USA at the GMU campus in Arlington, VA for Chain of Infection Detection: A Hands-On Workshop on Cross-Domain Forensic Artifact Correlation. #DigitalForensics #DFIR #CyberSecurity #LawEnforcementTech
011
Reposted by Brett Shavers
Brett Shavers @brettshavers.bsky.social · 11/07/2026
youtu.be/F1pc7SmI1s8?... #DFIR
youtu.be
S2 E6: Brett Shavers and the Investigative Mindset
YouTube video by Parsing The Truth: One Byte at a Time Podcast
021
Reposted by Brett Shavers
Alexis Brignoni🪫 @abrignoni.com · 12/07/2026
🔎 New on the LEAPPs Artifact Browser: click "samples" on any parser to see the test images it was validated against, with row counts. Knowing what a tool was tested against is the work, not a nice to have. leapps.org/artifacts #DFIR
leapps.org
Artifacts — LEAPPs
Browse all artifacts supported by iLEAPP, ALEAPP, RLEAPP, and VLEAPP.
012
Reposted by Brett Shavers
Phill Moore @phillmoore.bsky.social · 12/07/2026
Week 28 - 2026 #DFIR thisweekin4n6.com/2026/07/12/w...
thisweekin4n6.com
Week 28 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Alexis Brignoni at LEAPPs Blog The Apps We Are Not Parsi…
012
Brett Shavers @brettshavers.bsky.social · 11/07/2026
youtu.be/F1pc7SmI1s8?... #DFIR
youtu.be
S2 E6: Brett Shavers and the Investigative Mindset
YouTube video by Parsing The Truth: One Byte at a Time Podcast
021
Reposted by Brett Shavers
Alexis Brignoni🪫 @abrignoni.com · 17/05/2026
🚨 The new LEAPPS.org webpage is online! 🌐 New website design in dark mode as all pages should be. 🌐 Sign up for our mailing list at the end of the home page. Easy way to keep track of the latest happenings in the LEAPPs & LAVA community. 🌐 Much more coming up soon! Check it out: www.leapps.org #DFIR
073
Reposted by Brett Shavers
Phill Moore @phillmoore.bsky.social · 05/07/2026
Week 27 - 2026 #DFIR thisweekin4n6.com/2026/07/05/w...
thisweekin4n6.com
Week 27 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage 3 AI Prompts for More Conf…
023
Reposted by Brett Shavers
Patrick C Miller @patrickcmiller.bsky.social · 06/07/2026
Kali Linux 2026.2 released with 9 new tools, NetHunter updates
bleepingcomputer.com
Kali Linux 2026.2 released with 9 new tools, NetHunter updates
Kali Linux 2026.2, the second release of the year, is now available for download, featuring 9 new tools and numerous Kali NetHunter improvements.
022
Brett Shavers @brettshavers.bsky.social · 15/06/2026
Attribution is not just finding evidence. It is explaining what the evidence supports, what it does not support, and what alternative explanations remain. Live online: Attribution in DFIR training. June 24, 1 PM MDT. www.suspectbehindthekeyboard.com/offers/nFCYq... #DFIR
011
Reposted by Brett Shavers
Alexis Brignoni🪫 @abrignoni.com · 03/06/2026
🎙️New Digital Forensics Now Podcast! We spoke with Heather Barnhart from SANS Institute about her AI Investigative Framework and using LLMs responsibly in #DigitalForensics work. 👉🏽 youtu.be/bTHIw1ob4i4
youtu.be
The AI Investigative Framework Interview with Heather Barnhart
The Digital Forensics Now Podcast S3 - 5 The framework can be found here: https://www.linkedin.com/posts/heather-barnhart-cellebrite_ai-dfir-digitalforensics-ugcPost-7463670252950847488-b7s-
021
Brett Shavers @brettshavers.bsky.social · 09/05/2026
brettshavers.com/brett-s-blog...
brettshavers.com
AI is Eating Itself
Google made answers easy. AI is making us source-blind. “Ask the chatbot and get an answer.” That sounds good until you ask where the answer came from, who created it, who verified it, who updated it....
211
Brett Shavers @brettshavers.bsky.social · 20/04/2026
399 DFIR practitioners are already registered. What can a DFIR practitioner actually do with an LLM in casework without wrecking the case or career? Live webinar. Tues Apr 21. 12PM MT. One time only. www.suspectbehindthekeyboard.com/offers/2QFz3...
000
Reposted by Brett Shavers
Phill Moore @phillmoore.bsky.social · 22/03/2026
Week 12 - 2026 #DFIR thisweekin4n6.com/2026/03/22/w...
thisweekin4n6.com
Week 12 – 2026
Mobile Forensics CheatsheetMobile devices track vast amounts of user activity—often a goldmine of forensic evidence:- Device information- Application usage- Bluetooth and Wi-Fi connections- …and ot…
011
Brett Shavers @brettshavers.bsky.social · 20/03/2026
Incredible stat. Where do you fit, #DFIR? www.dfir.training/blog/56-of-d...
dfir.training
56% are either likely to leave DFIR within 12 months or unsure if they’ll stay.
DFIR Is Burning People Out. Digital forensics has a burnout problem. This isn't new news, but it is important.Forensic Focus and Northumbria University are running an anonymous international well-bein...
220
Brett Shavers @brettshavers.bsky.social · 18/03/2026
www.dfir.training/blog/a-pract... #DFIR
dfir.training
A Practical Map of the DFIR Internet: Marketplaces, FAQs, and Fire Exits
The right DFIR resource at the right moment is worth more than ten bookmarked sites you never learned how to use.No one DFIR website does everything well. And it shouldn’t. Trying to be everything usu...
010
Brett Shavers @brettshavers.bsky.social · 20/02/2026
On Feb 24 at Magnet's FREE virtual summit, @dwmetz.bsky.social and I will be talking about DF and IR, but not about "DFIR", if you know what I mean. magnetvirtualsummit.com/registration... #DFIR
122
Brett Shavers @brettshavers.bsky.social · 03/02/2026
Investigative Decision-Making in #DFIR. Thursday. Feb 5, 2026. 11AM PT. A 24-hour replay, and then it's gone. You will see attribution in a totally different light. www.suspectbehindthekeyboard.com/offers/fUKjJ...
100
Brett Shavers @brettshavers.bsky.social · 22/01/2026
Eventually, human-created content (audio, visual, written word) is going to become really expensive.
010
Reposted by Brett Shavers
CyberVeille @cyberveille-ch.bsky.social · 11/12/2025
📢 Publication du FACT Attribution Framework v1.0 pour relier preuves numériques et attribution humaine 📝 Selon la notice de publication of… cyberveille.ch/posts/2025-12-10-pub… #DFIR #Cyberveille
011
Brett Shavers @brettshavers.bsky.social · 16/01/2026
accurate
010
Reposted by Brett Shavers
Magnet Forensics @magnetforensics.bsky.social · 15/01/2026
Sharing #DigitalEvidence shouldn’t slow a case down. With Portable Case, you can securely share case data—without needing full forensic tools. Learn about some of the most powerful features of Portable Case and see how they can be particularly effective for investigators: ow.ly/9aZQ50XXnmt
011
Brett Shavers @brettshavers.bsky.social · 12/01/2026
The same people who pushed you for speed during the primary incident will ask you, with a straight face, why you didn’t preserve the things they now need. www.linkedin.com/pulse/dfir-t... #DFIR
linkedin.com
The DFIR Three-Body Problem
Let me first interject first this so you don’t miss it - Magnet MVS 2026 The Magnet Virtual Summit 2026 is free (Feb 23–26). When you register, you’re entered to win a full year of Magnet Forensics tr...
242
Reposted by Brett Shavers
Phill Moore @phillmoore.bsky.social · 11/01/2026
Week 02 - 2026 #DFIR thisweekin4n6.com/2026/01/11/w...
thisweekin4n6.com
Week 02 – 2026
No sponsor this week. If your organisation is interested, head over here to find out more. Akash PatelCase Studies: Building Effective Timelines with Plaso (Log2Timeline) Christian Peter“Far over t…
023
Reposted by Brett Shavers
Phill Moore @phillmoore.bsky.social · 04/01/2026
Week 01 - 2026 #DFIR thisweekin4n6.com/2026/01/04/w...
thisweekin4n6.com
Week 01 – 2026
Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod…
022
Brett Shavers @brettshavers.bsky.social · 14/12/2025
Your #DFIR report is fine… until you name a person. brettshavers.com/brett-s-blog...
brettshavers.com
Your DF/IR Tool Can’t Tell You Who Did It. FACT Tells You When You’re Allowed To.
DF/IR doesn’t usually fail on the technical work. It fails at the exact moment someone gets impatient and confuses activity with identity, and then confuses identity with attribution. “This account di...
010
Reposted by Brett Shavers
Phill Moore @phillmoore.bsky.social · 14/12/2025
Week 50 - 2025 #DFIR thisweekin4n6.com/2025/12/14/w...
thisweekin4n6.com
Week 50 – 2025
Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod…
021
Brett Shavers @brettshavers.bsky.social · 09/12/2025
Soundtrack for #DFIR get into the mood. www.youtube.com/playlist?lis...
youtube.com
Tie the Act to the Actor — DFIR Soundtrack (Official Music Video) - YouTube
Track 1: Tie the Act to the ActorTrack 2: Pattern of LifeTrack 3: Tracing Criminals OnlineTrack 4: Investigative MindsetTrack 5: CaseworkTrack 6: Order of Vo...
010
Brett Shavers @brettshavers.bsky.social · 08/12/2025
An Attribution Framework for #DFIR. zenodo.org/records/1774...
000
Reposted by Brett Shavers
Tanya Janca | SheHacksPurple @shehackspurple.bsky.social · 06/12/2025
I was on Darknet Diaries Ep. 165! Learn about dumb buildings with malware, how going to the dentist can get you in hot water, and that sharing breach information can you get buy in with software developers. YouTube: twp.ai/9PYHxj Or any podcast platform
1122
Reposted by Brett Shavers
Magnet Forensics @magnetforensics.bsky.social · 02/12/2025
On Dec 3, join us for our next episode of #LegalUnpacked, where Justin Fitzsimmons will focus on how to draft search warrants specifically designed to uncover evidence of user attribution. Save your spot here: ow.ly/hRSM50XALPi #DFIR
ow.ly
Legal Unpacked E3: Proving who was holding the phone: Drafting warrants that explain the need for user attribution - Magnet Forensics
Knowing what happened on a device is only half the story—proving who was behind the activity is critical.
011
Reposted by Brett Shavers
Phill Moore @phillmoore.bsky.social · 30/11/2025
Week 48 - 2025 #DFIR thisweekin4n6.com/2025/11/30/w...
thisweekin4n6.com
Week 48 – 2025
Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…
023
Brett Shavers @brettshavers.bsky.social · 24/11/2025
If you want to develop how you think, not just what to click in DFIR work, this is it. On-demand course, take it anytime over the next year. One-day opportunity, Black Friday only. Only 50 spots, because I’m only printing 50 signed hardcovers. www.suspectbehindthekeyboard.com/mindset #DFIR
suspectbehindthekeyboard.com
DF/IR Investigative Mindset Course
001
Reposted by Brett Shavers
Magnet Forensics @magnetforensics.bsky.social · 18/11/2025
In this #CustomerStory, find out how Vigo County High Tech CyberCrime Unit is using #MagnetReview to get #DigitalEvidence into the hands of their investigators faster than ever. Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR
011
Brett Shavers @brettshavers.bsky.social · 14/11/2025
I spent two years in litigation hell. Trial was worse. Thirty years of courtroom experience made me cocky, but the court fixed that. This is the first and only time I talk about this case, as this is the case that made me think of quitting DFIR. brettshavers.com/brett-s-blog...
112
Reposted by Brett Shavers
Arsenal Recon @arsenalrecon.bsky.social · 05/11/2025
In case you missed it last week, a new Arsenal Image Mounter (v3.12.331) has been released with a long list of improvements for #DFIR practitioners including Arm on Arm virtualization. You can see some highlights in our Insights article at arsenalrecon.com/insights/qui....
011
Brett Shavers @brettshavers.bsky.social · 03/11/2025
I once beat a 20-year DFIR forensic expert in court. Not because I was better, but because I had a $1,500 certificate. → www.suspectbehindthekeyboard.com/fighting-cit...
suspectbehindthekeyboard.com
Fighting City Hall: DFIR Lessons from a Pro se Plaintiff
020
Reposted by Brett Shavers
Arsenal Recon @arsenalrecon.bsky.social · 03/11/2025
Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com
011
Reposted by Brett Shavers
Phill Moore @phillmoore.bsky.social · 02/11/2025
Week 44 – 2025 #DFIR thisweekin4n6.com/2025/11/02/w...
thisweekin4n6.com
Week 44 – 2025
Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…
012
Reposted by Brett Shavers
Arsenal Recon @arsenalrecon.bsky.social · 02/11/2025
Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR
111
Brett Shavers @brettshavers.bsky.social · 31/10/2025
I got a little luv and a wink today. www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR
020
Brett Shavers @brettshavers.bsky.social · 30/10/2025
I'm charging my client 2x for making me miss this today. www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR
120
Reposted by Brett Shavers
Magnet Forensics @magnetforensics.bsky.social · 30/10/2025
Time is almost up to participate in our State of Enterprise #DFIR survey! Complete the survey before Oct 31 to let us know your thoughts on the latest developments in DFIR along with emerging threats, operational challenges, and areas for improvement: ow.ly/6hV750XgYic
011
Reposted by Brett Shavers
Arsenal Recon @arsenalrecon.bsky.social · 29/10/2025
Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR
011
Brett Shavers @brettshavers.bsky.social · 28/10/2025
Ever wonder what happens when a DFIR investigator ends up on the other side of the case file? I fought city hall, literally, and learned DFIR lesasons no training ever covered. www.suspectbehindthekeyboard.com/fighting-cit...
000