Late this year at the earliest, but most likely 1st quarter of 2027. It's going to be a very different book from the first two. The first two book point out the buttons and how XWF works.
This upcoming book will be how to use XWF on specific case types (fraud, harassment, malware, etc...).
Thanks for joining!
On Feb 24 at Magnet's FREE virtual summit, @dwmetz.bsky.social and I will be talking about DF and IR, but not about "DFIR", if you know what I mean. magnetvirtualsummit.com/registration... #DFIR
Investigative Decision-Making in #DFIR.
Thursday. Feb 5, 2026. 11AM PT.
A 24-hour replay, and then it's gone.
You will see attribution in a totally different light.
www.suspectbehindthekeyboard.com/offers/fUKjJ...
Eventually, human-created content (audio, visual, written word) is going to become really expensive.
📢 Publication du FACT Attribution Framework v1.0 pour relier preuves numériques et attribution humaine
📝 Selon la notice de publication of…
https://cyberveille.ch/posts/2025-12-10-publication-du-fact-attribution-framework-v1-0-pour-relier-preuves-numeriques-et-attribution-humaine/ #DFIR #Cyberveille
accurate
Sharing #DigitalEvidence shouldn’t slow a case down. With Portable Case, you can securely share case data—without needing full forensic tools.
Learn about some of the most powerful features of Portable Case and see how they can be particularly effective for investigators: ow.ly/9aZQ50XXnmt
haha because true!
The same people who pushed you for speed during the primary incident will ask you, with a straight face, why you didn’t preserve the things they now need.
www.linkedin.com/pulse/dfir-t... #DFIR
What a world where we have to edit 3x more than usual to make sure we don't sound like AI, then eventually, we start sounding like AI in our writing...
It's almost to the point of having to intentionally plant errors in our writing, but eventually, AI will do that too to avoid sounding like itself.
Your #DFIR report is fine… until you name a person.
brettshavers.com/brett-s-blog...
Soundtrack for #DFIR get into the mood.
www.youtube.com/playlist?lis...
An Attribution Framework for #DFIR.
zenodo.org/records/1774...
I was on Darknet Diaries Ep. 165! Learn about dumb buildings with malware, how going to the dentist can get you in hot water, and that sharing breach information can you get buy in with software developers.
YouTube: https://twp.ai/9PYHxj
Or any podcast platform
On Dec 3, join us for our next episode of #LegalUnpacked, where Justin Fitzsimmons will focus on how to draft search warrants specifically designed to uncover evidence of user attribution.
Save your spot here: ow.ly/hRSM50XALPi
#DFIR
If you want to develop how you think, not just what to click in DFIR work, this is it.
On-demand course, take it anytime over the next year.
One-day opportunity, Black Friday only.
Only 50 spots, because I’m only printing 50 signed hardcovers.
www.suspectbehindthekeyboard.com/mindset
#DFIR
I fell in love at first sight.
Then I realized the timestamp was in UTC and I was mistaken.
In this #CustomerStory, find out how Vigo County High Tech CyberCrime Unit is using #MagnetReview to get #DigitalEvidence into the hands of their investigators faster than ever.
Want to dive deeper into their story? Read the written case study here: ow.ly/3MQx50XtNI4 #DFIR
You'd think, right?
I spent two years in litigation hell. Trial was worse.
Thirty years of courtroom experience made me cocky, but the court fixed that.
This is the first and only time I talk about this case, as this is the case that made me think of quitting DFIR.
brettshavers.com/brett-s-blog...
In case you missed it last week, a new Arsenal Image Mounter (v3.12.331) has been released with a long list of improvements for #DFIR practitioners including Arm on Arm virtualization. You can see some highlights in our Insights article at arsenalrecon.com/insights/qui....
I once beat a 20-year DFIR forensic expert in court. Not because I was better, but because I had a $1,500 certificate. → www.suspectbehindthekeyboard.com/fighting-cit...
TBH. I enjoy seeing typos in anything online. It is a subtle hint that a human wrote it and made a human error with a human touch that AI cannot reproduce (yet).
The prose layout of perfected AI content with "em dashes" and "brutal truths" are tiresome and speak to no one.
Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com
