Brett Shavers
@brettshavers.bsky.social
Fell off a cliff. Swam with sharks. Dined with hitmen. Hung out with crime bosses. Bought and sold a ton of drugs. How the heck am I still here? DFIR USMC 🚓
Pinned
Reposted by Brett Shavers
On Dec 3, join us for our next episode of #LegalUnpacked, where Justin Fitzsimmons will focus on how to draft search warrants specifically designed to uncover evidence of user attribution.
Save your spot here: ow.ly/hRSM50XALPi
#DFIR
Save your spot here: ow.ly/hRSM50XALPi
#DFIR
Legal Unpacked E3: Proving who was holding the phone: Drafting warrants that explain the need for user attribution - Magnet Forensics
Knowing what happened on a device is only half the story—proving who was behind the activity is critical.
ow.ly
December 2, 2025 at 4:20 PM
On Dec 3, join us for our next episode of #LegalUnpacked, where Justin Fitzsimmons will focus on how to draft search warrants specifically designed to uncover evidence of user attribution.
Save your spot here: ow.ly/hRSM50XALPi
#DFIR
Save your spot here: ow.ly/hRSM50XALPi
#DFIR
If you want to develop how you think, not just what to click in DFIR work, this is it.
On-demand course, take it anytime over the next year.
One-day opportunity, Black Friday only.
Only 50 spots, because I’m only printing 50 signed hardcovers.
www.suspectbehindthekeyboard.com/mindset
#DFIR
On-demand course, take it anytime over the next year.
One-day opportunity, Black Friday only.
Only 50 spots, because I’m only printing 50 signed hardcovers.
www.suspectbehindthekeyboard.com/mindset
#DFIR
DF/IR Investigative Mindset Course
www.suspectbehindthekeyboard.com
November 24, 2025 at 3:59 PM
If you want to develop how you think, not just what to click in DFIR work, this is it.
On-demand course, take it anytime over the next year.
One-day opportunity, Black Friday only.
Only 50 spots, because I’m only printing 50 signed hardcovers.
www.suspectbehindthekeyboard.com/mindset
#DFIR
On-demand course, take it anytime over the next year.
One-day opportunity, Black Friday only.
Only 50 spots, because I’m only printing 50 signed hardcovers.
www.suspectbehindthekeyboard.com/mindset
#DFIR
Reposted by Brett Shavers
In this #CustomerStory, find out how Vigo County High Tech CyberCrime Unit is using #MagnetReview to get #DigitalEvidence into the hands of their investigators faster than ever.
Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR
Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR
November 18, 2025 at 9:35 PM
In this #CustomerStory, find out how Vigo County High Tech CyberCrime Unit is using #MagnetReview to get #DigitalEvidence into the hands of their investigators faster than ever.
Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR
Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR
I spent two years in litigation hell. Trial was worse.
Thirty years of courtroom experience made me cocky, but the court fixed that.
This is the first and only time I talk about this case, as this is the case that made me think of quitting DFIR.
brettshavers.com/brett-s-blog...
Thirty years of courtroom experience made me cocky, but the court fixed that.
This is the first and only time I talk about this case, as this is the case that made me think of quitting DFIR.
brettshavers.com/brett-s-blog...
November 14, 2025 at 6:34 PM
I spent two years in litigation hell. Trial was worse.
Thirty years of courtroom experience made me cocky, but the court fixed that.
This is the first and only time I talk about this case, as this is the case that made me think of quitting DFIR.
brettshavers.com/brett-s-blog...
Thirty years of courtroom experience made me cocky, but the court fixed that.
This is the first and only time I talk about this case, as this is the case that made me think of quitting DFIR.
brettshavers.com/brett-s-blog...
Reposted by Brett Shavers
In case you missed it last week, a new Arsenal Image Mounter (v3.12.331) has been released with a long list of improvements for #DFIR practitioners including Arm on Arm virtualization. You can see some highlights in our Insights article at arsenalrecon.com/insights/qui....
November 5, 2025 at 4:44 PM
In case you missed it last week, a new Arsenal Image Mounter (v3.12.331) has been released with a long list of improvements for #DFIR practitioners including Arm on Arm virtualization. You can see some highlights in our Insights article at arsenalrecon.com/insights/qui....
I once beat a 20-year DFIR forensic expert in court. Not because I was better, but because I had a $1,500 certificate. → www.suspectbehindthekeyboard.com/fighting-cit...
Fighting City Hall: DFIR Lessons from a Pro se Plaintiff
www.suspectbehindthekeyboard.com
November 3, 2025 at 8:22 PM
I once beat a 20-year DFIR forensic expert in court. Not because I was better, but because I had a $1,500 certificate. → www.suspectbehindthekeyboard.com/fighting-cit...
Reposted by Brett Shavers
Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com
November 3, 2025 at 2:17 PM
Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com
Reposted by Brett Shavers
Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR
November 2, 2025 at 6:54 PM
Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR
I got a little luv and a wink today.
www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR
www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR
October 31, 2025 at 12:08 AM
I got a little luv and a wink today.
www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR
www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR
I'm charging my client 2x for making me miss this today. www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR
October 30, 2025 at 11:42 PM
I'm charging my client 2x for making me miss this today. www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR
Reposted by Brett Shavers
Time is almost up to participate in our State of Enterprise #DFIR survey!
Complete the survey before Oct 31 to let us know your thoughts on the latest developments in DFIR along with emerging threats, operational challenges, and areas for improvement: ow.ly/6hV750XgYic
Complete the survey before Oct 31 to let us know your thoughts on the latest developments in DFIR along with emerging threats, operational challenges, and areas for improvement: ow.ly/6hV750XgYic
October 30, 2025 at 8:32 PM
Time is almost up to participate in our State of Enterprise #DFIR survey!
Complete the survey before Oct 31 to let us know your thoughts on the latest developments in DFIR along with emerging threats, operational challenges, and areas for improvement: ow.ly/6hV750XgYic
Complete the survey before Oct 31 to let us know your thoughts on the latest developments in DFIR along with emerging threats, operational challenges, and areas for improvement: ow.ly/6hV750XgYic
Reposted by Brett Shavers
Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR
October 29, 2025 at 2:58 PM
Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR
Ever wonder what happens when a DFIR investigator ends up on the other side of the case file?
I fought city hall, literally, and learned DFIR lesasons no training ever covered.
www.suspectbehindthekeyboard.com/fighting-cit...
I fought city hall, literally, and learned DFIR lesasons no training ever covered.
www.suspectbehindthekeyboard.com/fighting-cit...
October 28, 2025 at 6:38 PM
Ever wonder what happens when a DFIR investigator ends up on the other side of the case file?
I fought city hall, literally, and learned DFIR lesasons no training ever covered.
www.suspectbehindthekeyboard.com/fighting-cit...
I fought city hall, literally, and learned DFIR lesasons no training ever covered.
www.suspectbehindthekeyboard.com/fighting-cit...
Ever try to out-document a team of Harvard attorneys?
It’s like fighting gravity with paper cuts.
Still, it works if you know the rules.
It’s like fighting gravity with paper cuts.
Still, it works if you know the rules.
October 28, 2025 at 2:00 AM
Ever try to out-document a team of Harvard attorneys?
It’s like fighting gravity with paper cuts.
Still, it works if you know the rules.
It’s like fighting gravity with paper cuts.
Still, it works if you know the rules.
DFIR comes down to one thing.
October 26, 2025 at 9:11 PM
DFIR comes down to one thing.
If you got no plans for the weekend....here's this!
TERABYTES OF FREE FORENSIC TEST IMAGES AND HUNDREDS OF CTFs!
www.dfir.training/downloads/te... #DFIR #digitalforensics
TERABYTES OF FREE FORENSIC TEST IMAGES AND HUNDREDS OF CTFs!
www.dfir.training/downloads/te... #DFIR #digitalforensics
Forensic Test Images & CTFs
www.dfir.training
October 24, 2025 at 10:05 PM
If you got no plans for the weekend....here's this!
TERABYTES OF FREE FORENSIC TEST IMAGES AND HUNDREDS OF CTFs!
www.dfir.training/downloads/te... #DFIR #digitalforensics
TERABYTES OF FREE FORENSIC TEST IMAGES AND HUNDREDS OF CTFs!
www.dfir.training/downloads/te... #DFIR #digitalforensics
Reposted by Brett Shavers
Week 42 - 2025 #DFIR thisweekin4n6.com/2025/10/19/w...
Week 42 – 2025
Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…
thisweekin4n6.com
October 19, 2025 at 9:42 AM
Week 42 - 2025 #DFIR thisweekin4n6.com/2025/10/19/w...
Reposted by Brett Shavers
AI Assisted Forensics & Forensics on AI Systems at DFRWS APAC! 🧠 Papers on LLMs timeline analysis, investigating local AI apps, & new comms data tools. See the full program!
👉 Reserve your seat: buff.ly/JV23sUN
#research #dfrws #DFIR #apac #digitalforensics #seoul #korea
👉 Reserve your seat: buff.ly/JV23sUN
#research #dfrws #DFIR #apac #digitalforensics #seoul #korea
October 13, 2025 at 4:01 AM
AI Assisted Forensics & Forensics on AI Systems at DFRWS APAC! 🧠 Papers on LLMs timeline analysis, investigating local AI apps, & new comms data tools. See the full program!
👉 Reserve your seat: buff.ly/JV23sUN
#research #dfrws #DFIR #apac #digitalforensics #seoul #korea
👉 Reserve your seat: buff.ly/JV23sUN
#research #dfrws #DFIR #apac #digitalforensics #seoul #korea
Reposted by Brett Shavers
#DFIR is facing a huge inflection point and no one knows that like those who are living it day in and day out.
We’ve just opened our survey for our State of #EnterpriseDFIR Report until Oct 31 and your insights are incredibly valuable: ow.ly/NBsa50X9eCv
We’ve just opened our survey for our State of #EnterpriseDFIR Report until Oct 31 and your insights are incredibly valuable: ow.ly/NBsa50X9eCv
October 9, 2025 at 3:11 PM
#DFIR is facing a huge inflection point and no one knows that like those who are living it day in and day out.
We’ve just opened our survey for our State of #EnterpriseDFIR Report until Oct 31 and your insights are incredibly valuable: ow.ly/NBsa50X9eCv
We’ve just opened our survey for our State of #EnterpriseDFIR Report until Oct 31 and your insights are incredibly valuable: ow.ly/NBsa50X9eCv
Reposted by Brett Shavers
The new #MagnetNexus hybrid collection agent gives #DFIR teams the flexibility to collect data from remote endpoints using either cloud-powered workflows with Nexus or on-prem workflows with #AxiomCyber, all with a single, lightweight endpoint agent: ow.ly/kKWr50X6gsW
Introducing the new Magnet Nexus hybrid collection agent
Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.
ow.ly
October 3, 2025 at 3:37 PM
The new #MagnetNexus hybrid collection agent gives #DFIR teams the flexibility to collect data from remote endpoints using either cloud-powered workflows with Nexus or on-prem workflows with #AxiomCyber, all with a single, lightweight endpoint agent: ow.ly/kKWr50X6gsW