Derek Eiri
@mreerie.bsky.social
Chicken herder. Corgi keeper. DFIR.
mreerie.com
mreerie.com
Derek follows up on a requested feature for DeepSpar's Guardonix and USB Stabilizer.
NVMe Serial Numbers with the Guardonix & USB Stabilizer
Derek follows up on a requested feature for DeepSpar's Guardonix and USB Stabilizer.
mreerie.com
June 26, 2025 at 1:01 PM
Derek follows up on a requested feature for DeepSpar's Guardonix and USB Stabilizer.
Leveling up some Digital Intelligence swag.
June 18, 2025 at 5:12 AM
Leveling up some Digital Intelligence swag.
Derek explores the macOS native commands used in Andrea Lazzarotto's open-source project, Fuji.
Exploring the macOS Native Commands Behind Andrea Lazzarotto’s Fuji
When Andrea Lazzarotto publicly released Fuji (Forensic Unattended Juicy Imaging), I was actively maturing internal corporate processes to respond to security incidents involving macOS machines. Having experimented with Fuji, it became part of our overall data collection strategy as it is repeatable, accessible and efficient. As of May 2025, Fuji offers three acquisition capabilities: ASR, Rsync, and Sysdiagnose. True to Lazzarotto's goal, Fuji has a user-friendly interface that allows the examiner to logically acquire the entire drive or a single folder that is open source.
mreerie.com
May 26, 2025 at 7:59 AM
Derek explores the macOS native commands used in Andrea Lazzarotto's open-source project, Fuji.
Reposted by Derek Eiri
Check out our latest Insights article "Introducing AIM Remote Agent" for some compelling use cases, screenshots, & photos involving computers booted with WinFE (Windows Forensic Environment) & disks shared over networks with Arsenal Image Mounter. arsenalrecon.com/insights/int.... #DFIR
March 11, 2025 at 1:16 PM
Check out our latest Insights article "Introducing AIM Remote Agent" for some compelling use cases, screenshots, & photos involving computers booted with WinFE (Windows Forensic Environment) & disks shared over networks with Arsenal Image Mounter. arsenalrecon.com/insights/int.... #DFIR
Reposted by Derek Eiri
Thought I’d do something fun. Presenting the DFIR_Toolbar. Basically a toolbar that can be anything you want it to be.
https://malwaremaloney.blogspot.com/2025/01/dfirtoolbar.html
https://malwaremaloney.blogspot.com/2025/01/dfirtoolbar.html
January 3, 2025 at 1:15 AM
Thought I’d do something fun. Presenting the DFIR_Toolbar. Basically a toolbar that can be anything you want it to be.
https://malwaremaloney.blogspot.com/2025/01/dfirtoolbar.html
https://malwaremaloney.blogspot.com/2025/01/dfirtoolbar.html
About 16 years of service. Replaced it with an Insinkerator Badger 5!
December 28, 2024 at 2:01 AM
About 16 years of service. Replaced it with an Insinkerator Badger 5!
Reflecting on 2024
Derek wrote a blog post reflecting on 2024.
mreerie.com
December 27, 2024 at 5:01 PM
Placed a few glow in the dark stars in the kids room. These are nice and bright!
December 20, 2024 at 4:44 AM
Placed a few glow in the dark stars in the kids room. These are nice and bright!
It was great to chat #DFIR with @arcpoint-amy.bsky.social and Amy Moles in this festive themed podcast. Thank you for having me on!
m.youtube.com/watch?v=U0Zs...
m.youtube.com/watch?v=U0Zs...
S2: DFIRmas Podcast: Derek Eiri
YouTube video by ArcPoint Forensics
m.youtube.com
December 12, 2024 at 12:55 PM
It was great to chat #DFIR with @arcpoint-amy.bsky.social and Amy Moles in this festive themed podcast. Thank you for having me on!
m.youtube.com/watch?v=U0Zs...
m.youtube.com/watch?v=U0Zs...
Reposted by Derek Eiri
🎄ArcPoint Forensics DFIRmas Podcast Season 2 Episode 1 is out!
❄️Topic: Validation
🎅Guest: Me!
☃️Subscribe to the channel for more interviews.
🌟Check it out at the link below:
https://buff.ly/4g4U6sk
#DFIR #DigitalForensics #MobileForensics
❄️Topic: Validation
🎅Guest: Me!
☃️Subscribe to the channel for more interviews.
🌟Check it out at the link below:
https://buff.ly/4g4U6sk
#DFIR #DigitalForensics #MobileForensics
S2: DFIRmas Podcast: Alexis Brignoni
Instagram: @4n6_abrignoniYouTube: Alexis BrignoniBlueSky: @abrignoni.comPodcast: Digital Forensics Now (DFN)Resources: https://dfir.pubpub.orgThe Importance...
buff.ly
December 9, 2024 at 6:16 PM
🎄ArcPoint Forensics DFIRmas Podcast Season 2 Episode 1 is out!
❄️Topic: Validation
🎅Guest: Me!
☃️Subscribe to the channel for more interviews.
🌟Check it out at the link below:
https://buff.ly/4g4U6sk
#DFIR #DigitalForensics #MobileForensics
❄️Topic: Validation
🎅Guest: Me!
☃️Subscribe to the channel for more interviews.
🌟Check it out at the link below:
https://buff.ly/4g4U6sk
#DFIR #DigitalForensics #MobileForensics
I wrote a blog post reflecting on what I read from Brett Shavers' book, Placing the Suspect Behind the Keyboard: DFIR Investigative Mindset.
A Reflection on Continual Growth in DFIR: An Investigative Mindset
Derek reflects on continuous improvement of the investigative mindset.
mreerie.com
December 2, 2024 at 12:38 PM
I wrote a blog post reflecting on what I read from Brett Shavers' book, Placing the Suspect Behind the Keyboard: DFIR Investigative Mindset.
I built an L-shaped desk in 2016. I’ve made some changes since then. Fortunately, I’ve made extra H-frame legs so I can keep the table tops independent. But today, I had use case to make a stubby table top to turn the L into a T. Just need to add coats of polyurethane, mount, and call it good.
November 21, 2024 at 2:58 AM
I built an L-shaped desk in 2016. I’ve made some changes since then. Fortunately, I’ve made extra H-frame legs so I can keep the table tops independent. But today, I had use case to make a stubby table top to turn the L into a T. Just need to add coats of polyurethane, mount, and call it good.
Reposted by Derek Eiri
November 20, 2024 at 5:03 PM
Reposted by Derek Eiri
I would like to introduce Lyman. A tool to aid in the creation of “mapping” cstruct files for OneDriveExplorer.
https://github.com/Beercow/Lyman
https://github.com/Beercow/Lyman
November 20, 2024 at 3:15 PM
I would like to introduce Lyman. A tool to aid in the creation of “mapping” cstruct files for OneDriveExplorer.
https://github.com/Beercow/Lyman
https://github.com/Beercow/Lyman
FOR518: Mac and iOS Forensic Analysis and Incident Response, Re: SANS FOR518 OnDemand Experience
Derek completed the SANS FOR518 course. He's thinking differently.
Derek completed the SANS FOR518 course. He's thinking differently.
FOR518: Mac and iOS Forensic Analysis and Incident Response, Re: SANS FOR518 OnDemand Experience
Derek completed the SANS FOR518 course. He's thinking differently.
mreerie.com
November 14, 2024 at 1:42 PM
FOR518: Mac and iOS Forensic Analysis and Incident Response, Re: SANS FOR518 OnDemand Experience
Derek completed the SANS FOR518 course. He's thinking differently.
Derek completed the SANS FOR518 course. He's thinking differently.
Sacramento, CA.
The HTCIA Northern California chapter will have our meeting on 12/05. MSAB will be hosting a lunch and learn with a dash of CTF.
Register here: bit.ly/registerctf
The HTCIA Northern California chapter will have our meeting on 12/05. MSAB will be hosting a lunch and learn with a dash of CTF.
Register here: bit.ly/registerctf
November 13, 2024 at 1:57 AM
Sacramento, CA.
The HTCIA Northern California chapter will have our meeting on 12/05. MSAB will be hosting a lunch and learn with a dash of CTF.
Register here: bit.ly/registerctf
The HTCIA Northern California chapter will have our meeting on 12/05. MSAB will be hosting a lunch and learn with a dash of CTF.
Register here: bit.ly/registerctf
Just a picture of chickens to get this thing started.
November 13, 2024 at 1:41 AM
Just a picture of chickens to get this thing started.