Brett Shavers

DFIR (as we use it) started as a hashtag.

Tue, 23 Dec 2025 12:37:39 -0800

DFIR (the label) started as a hashtag. It didn’t create digital forensics or incident response, but did create a dominant label for both that became a banner and a massive marketing umbrella. This results in the most dangerous word inside that umbrel...

Your DF/IR Tool Can’t Tell You Who Did It. FACT Tells You When You’re Allowed To.

Sun, 14 Dec 2025 11:13:54 -0800

DF/IR doesn’t usually fail on the technical work. It fails at the exact moment someone gets impatient and confuses activity with identity, and then confuses identity with attribution. “This account did it” becomes “this person did it,” with zero brid...

Fight City Hall: If You Missed the Webinar, You’re Making Mistakes You Don’t Know About

Fri, 14 Nov 2025 09:26:24 -0800

The recording is available today (Friday, November 14, 2025) only. After that, it’s gone permanently. Register to access it here: https://www.suspectbehindthekeyboard.com/offers/S2W6hwau This wasn’t a case study. It wasn’t entertainment. It wasn’t po...