Brett Shavers @brettshavers.bsky.social · 26/09/2026That is all true. I think the premise is accurate (a zero is a zero, a one is a one), but you are correct on interpretation, or maybe even more precise, 'misinterpretation.' We can pile more on top of misinterpretation with conflation, integration, and misdirection using the exact same data. 010
Brett Shavers @brettshavers.bsky.social · 24/09/2026Forensic examiners usually ask two questions: Is the tool easy to use, and does it work? Country of ownership rarely makes the top ten. brettshavers.com/everyone-sud...brettshavers.comEveryone Suddenly Knew Oxygen Forensics Was Guilty – Brett's RamblingsDOJ alleges hidden Russian ownership and a fake U.S. build. That is not malware, FSB control, or proof the industry already did the work. 000
Brett Shavers @brettshavers.bsky.social · 11/09/2026"The Complete Guide to DFIR by Someone Who Never Did It" www.linkedin.com/pulse/comple...linkedin.comThe Complete Guide to DFIR by Someone Who Never Did ItIf you use AI to summarize everything you read, let me save you the trouble with this one. Me: Summarize this article in 3 bullet points in an 8th grade reading level. 000
Brett Shavers @brettshavers.bsky.social · 09/09/2026brettshavers.com/you-suck-at-...brettshavers.comYou suck at DFIR if you’re vibe-coding forensic apps. – Brett's Ramblings 030
Reposted by Brett ShaversMagnet Forensics @magnetforensics.bsky.social · 09/07/2026Join us July 29 at 11:00 AM ET for a live and interactive Ask Me Anything (#AMA) session with seasoned #DFIR practitioners as they tackle your toughest #IncidentResponse questions and share practical guidance from real-world investigations. Register now: ow.ly/RaYh50ZmchU 012
Reposted by Brett ShaversDFRWS @dfrws.bsky.social · 09/07/2026🚨All DFIR Investigators Save 10% Discount Code: 10%4DFIR | Register Now dfrws.org Join DFRWS USA at the GMU campus in Arlington, VA for Chain of Infection Detection: A Hands-On Workshop on Cross-Domain Forensic Artifact Correlation. #DigitalForensics #DFIR #CyberSecurity #LawEnforcementTech 011
Reposted by Brett ShaversBrett Shavers @brettshavers.bsky.social · 11/07/2026youtu.be/F1pc7SmI1s8?... #DFIRyoutu.beS2 E6: Brett Shavers and the Investigative MindsetYouTube video by Parsing The Truth: One Byte at a Time Podcast 021
Reposted by Brett ShaversAlexis Brignoni🪫 @abrignoni.com · 12/07/2026🔎 New on the LEAPPs Artifact Browser: click "samples" on any parser to see the test images it was validated against, with row counts. Knowing what a tool was tested against is the work, not a nice to have. leapps.org/artifacts #DFIRleapps.orgArtifacts — LEAPPsBrowse all artifacts supported by iLEAPP, ALEAPP, RLEAPP, and VLEAPP. 012
Reposted by Brett ShaversPhill Moore @phillmoore.bsky.social · 12/07/2026Week 28 - 2026 #DFIR thisweekin4n6.com/2026/07/12/w...thisweekin4n6.comWeek 28 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Alexis Brignoni at LEAPPs Blog The Apps We Are Not Parsi… 012
Brett Shavers @brettshavers.bsky.social · 11/07/2026youtu.be/F1pc7SmI1s8?... #DFIRyoutu.beS2 E6: Brett Shavers and the Investigative MindsetYouTube video by Parsing The Truth: One Byte at a Time Podcast 021
Reposted by Brett ShaversAlexis Brignoni🪫 @abrignoni.com · 17/05/2026🚨 The new LEAPPS.org webpage is online! 🌐 New website design in dark mode as all pages should be. 🌐 Sign up for our mailing list at the end of the home page. Easy way to keep track of the latest happenings in the LEAPPs & LAVA community. 🌐 Much more coming up soon! Check it out: www.leapps.org #DFIR 073
Reposted by Brett ShaversPhill Moore @phillmoore.bsky.social · 05/07/2026Week 27 - 2026 #DFIR thisweekin4n6.com/2026/07/05/w...thisweekin4n6.comWeek 27 – 2026If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Brian Carrier at Cyber Triage 3 AI Prompts for More Conf… 023
Reposted by Brett ShaversPatrick C Miller @patrickcmiller.bsky.social · 06/07/2026Kali Linux 2026.2 released with 9 new tools, NetHunter updatesbleepingcomputer.comKali Linux 2026.2 released with 9 new tools, NetHunter updatesKali Linux 2026.2, the second release of the year, is now available for download, featuring 9 new tools and numerous Kali NetHunter improvements. 022
Brett Shavers @brettshavers.bsky.social · 15/06/2026Attribution is not just finding evidence. It is explaining what the evidence supports, what it does not support, and what alternative explanations remain. Live online: Attribution in DFIR training. June 24, 1 PM MDT. www.suspectbehindthekeyboard.com/offers/nFCYq... #DFIR 011
Reposted by Brett ShaversAlexis Brignoni🪫 @abrignoni.com · 03/06/2026🎙️New Digital Forensics Now Podcast! We spoke with Heather Barnhart from SANS Institute about her AI Investigative Framework and using LLMs responsibly in #DigitalForensics work. 👉🏽 youtu.be/bTHIw1ob4i4youtu.beThe AI Investigative Framework Interview with Heather BarnhartThe Digital Forensics Now Podcast S3 - 5 The framework can be found here: https://www.linkedin.com/posts/heather-barnhart-cellebrite_ai-dfir-digitalforensics-ugcPost-7463670252950847488-b7s- 021
Brett Shavers @brettshavers.bsky.social · 09/05/2026Thanks. I think two things can be true at the same time.. 1) AI is the best thing to happen to humans. 2) AI is the worst thing to happen to humans. 110
Brett Shavers @brettshavers.bsky.social · 09/05/2026brettshavers.com/brett-s-blog...brettshavers.comAI is Eating ItselfGoogle made answers easy. AI is making us source-blind. “Ask the chatbot and get an answer.” That sounds good until you ask where the answer came from, who created it, who verified it, who updated it.... 211
Brett Shavers @brettshavers.bsky.social · 20/04/2026399 DFIR practitioners are already registered. What can a DFIR practitioner actually do with an LLM in casework without wrecking the case or career? Live webinar. Tues Apr 21. 12PM MT. One time only. www.suspectbehindthekeyboard.com/offers/2QFz3... 000
Brett Shavers @brettshavers.bsky.social · 09/04/2026I think a factor of things. The org, the work, the person, the workload, the training, etc... 110
Reposted by Brett ShaversPhill Moore @phillmoore.bsky.social · 22/03/2026Week 12 - 2026 #DFIR thisweekin4n6.com/2026/03/22/w...thisweekin4n6.comWeek 12 – 2026Mobile Forensics CheatsheetMobile devices track vast amounts of user activity—often a goldmine of forensic evidence:- Device information- Application usage- Bluetooth and Wi-Fi connections- …and ot… 011
Brett Shavers @brettshavers.bsky.social · 20/03/2026Incredible stat. Where do you fit, #DFIR? www.dfir.training/blog/56-of-d...dfir.training56% are either likely to leave DFIR within 12 months or unsure if they’ll stay.DFIR Is Burning People Out. Digital forensics has a burnout problem. This isn't new news, but it is important.Forensic Focus and Northumbria University are running an anonymous international well-bein... 220
Brett Shavers @brettshavers.bsky.social · 18/03/2026www.dfir.training/blog/a-pract... #DFIRdfir.trainingA Practical Map of the DFIR Internet: Marketplaces, FAQs, and Fire ExitsThe right DFIR resource at the right moment is worth more than ten bookmarked sites you never learned how to use.No one DFIR website does everything well. And it shouldn’t. Trying to be everything usu... 010
Brett Shavers @brettshavers.bsky.social · 04/03/2026Late this year at the earliest, but most likely 1st quarter of 2027. It's going to be a very different book from the first two. The first two book point out the buttons and how XWF works. This upcoming book will be how to use XWF on specific case types (fraud, harassment, malware, etc...). 110
Brett Shavers @brettshavers.bsky.social · 20/02/2026On Feb 24 at Magnet's FREE virtual summit, @dwmetz.bsky.social and I will be talking about DF and IR, but not about "DFIR", if you know what I mean. magnetvirtualsummit.com/registration... #DFIR 122
Brett Shavers @brettshavers.bsky.social · 03/02/2026Investigative Decision-Making in #DFIR. Thursday. Feb 5, 2026. 11AM PT. A 24-hour replay, and then it's gone. You will see attribution in a totally different light. www.suspectbehindthekeyboard.com/offers/fUKjJ... 100
Brett Shavers @brettshavers.bsky.social · 22/01/2026Eventually, human-created content (audio, visual, written word) is going to become really expensive. 010
Reposted by Brett ShaversCyberVeille @cyberveille-ch.bsky.social · 11/12/2025📢 Publication du FACT Attribution Framework v1.0 pour relier preuves numériques et attribution humaine 📝 Selon la notice de publication of… cyberveille.ch/posts/2025-12-10-pub… #DFIR #Cyberveille 011
Reposted by Brett ShaversMagnet Forensics @magnetforensics.bsky.social · 15/01/2026Sharing #DigitalEvidence shouldn’t slow a case down. With Portable Case, you can securely share case data—without needing full forensic tools. Learn about some of the most powerful features of Portable Case and see how they can be particularly effective for investigators: ow.ly/9aZQ50XXnmt 011
Brett Shavers @brettshavers.bsky.social · 12/01/2026The same people who pushed you for speed during the primary incident will ask you, with a straight face, why you didn’t preserve the things they now need. www.linkedin.com/pulse/dfir-t... #DFIRlinkedin.comThe DFIR Three-Body ProblemLet me first interject first this so you don’t miss it - Magnet MVS 2026 The Magnet Virtual Summit 2026 is free (Feb 23–26). When you register, you’re entered to win a full year of Magnet Forensics tr... 242
Reposted by Brett ShaversPhill Moore @phillmoore.bsky.social · 11/01/2026Week 02 - 2026 #DFIR thisweekin4n6.com/2026/01/11/w...thisweekin4n6.comWeek 02 – 2026No sponsor this week. If your organisation is interested, head over here to find out more. Akash PatelCase Studies: Building Effective Timelines with Plaso (Log2Timeline) Christian Peter“Far over t… 023
Reposted by Brett ShaversPhill Moore @phillmoore.bsky.social · 04/01/2026Week 01 - 2026 #DFIR thisweekin4n6.com/2026/01/04/w...thisweekin4n6.comWeek 01 – 2026Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod… 022
Brett Shavers @brettshavers.bsky.social · 30/12/2025What a world where we have to edit 3x more than usual to make sure we don't sound like AI, then eventually, we start sounding like AI in our writing... It's almost to the point of having to intentionally plant errors in our writing, but eventually, AI will do that too to avoid sounding like itself. 130
Brett Shavers @brettshavers.bsky.social · 14/12/2025Your #DFIR report is fine… until you name a person. brettshavers.com/brett-s-blog...brettshavers.comYour DF/IR Tool Can’t Tell You Who Did It. FACT Tells You When You’re Allowed To.DF/IR doesn’t usually fail on the technical work. It fails at the exact moment someone gets impatient and confuses activity with identity, and then confuses identity with attribution. “This account di... 010
Reposted by Brett ShaversPhill Moore @phillmoore.bsky.social · 14/12/2025Week 50 - 2025 #DFIR thisweekin4n6.com/2025/12/14/w...thisweekin4n6.comWeek 50 – 2025Strengthen Your Identity Posture Before Attackers Find the GapsIn this cheat sheet, you’ll discover:• The four highest-risk identity categories to remediate today.• A step-by-step ISPM maturity mod… 021
Brett Shavers @brettshavers.bsky.social · 09/12/2025Soundtrack for #DFIR get into the mood. www.youtube.com/playlist?lis...youtube.comTie the Act to the Actor — DFIR Soundtrack (Official Music Video) - YouTubeTrack 1: Tie the Act to the ActorTrack 2: Pattern of LifeTrack 3: Tracing Criminals OnlineTrack 4: Investigative MindsetTrack 5: CaseworkTrack 6: Order of Vo... 010
Brett Shavers @brettshavers.bsky.social · 08/12/2025An Attribution Framework for #DFIR. zenodo.org/records/1774... 000
Reposted by Brett ShaversTanya Janca | SheHacksPurple @shehackspurple.bsky.social · 06/12/2025I was on Darknet Diaries Ep. 165! Learn about dumb buildings with malware, how going to the dentist can get you in hot water, and that sharing breach information can you get buy in with software developers. YouTube: twp.ai/9PYHxj Or any podcast platform 1122
Reposted by Brett ShaversMagnet Forensics @magnetforensics.bsky.social · 02/12/2025On Dec 3, join us for our next episode of #LegalUnpacked, where Justin Fitzsimmons will focus on how to draft search warrants specifically designed to uncover evidence of user attribution. Save your spot here: ow.ly/hRSM50XALPi #DFIRow.lyLegal Unpacked E3: Proving who was holding the phone: Drafting warrants that explain the need for user attribution - Magnet ForensicsKnowing what happened on a device is only half the story—proving who was behind the activity is critical. 011
Reposted by Brett ShaversPhill Moore @phillmoore.bsky.social · 30/11/2025Week 48 - 2025 #DFIR thisweekin4n6.com/2025/11/30/w...thisweekin4n6.comWeek 48 – 2025Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to… 023
Brett Shavers @brettshavers.bsky.social · 24/11/2025If you want to develop how you think, not just what to click in DFIR work, this is it. On-demand course, take it anytime over the next year. One-day opportunity, Black Friday only. Only 50 spots, because I’m only printing 50 signed hardcovers. www.suspectbehindthekeyboard.com/mindset #DFIRsuspectbehindthekeyboard.comDF/IR Investigative Mindset Course 001
Brett Shavers @brettshavers.bsky.social · 21/11/2025I fell in love at first sight. Then I realized the timestamp was in UTC and I was mistaken. 030
Reposted by Brett ShaversMagnet Forensics @magnetforensics.bsky.social · 18/11/2025In this #CustomerStory, find out how Vigo County High Tech CyberCrime Unit is using #MagnetReview to get #DigitalEvidence into the hands of their investigators faster than ever. Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR 011