Author | Lightnews

Brett Shavers @brettshavers.bsky.social · 13h

TBH. I enjoy seeing typos in anything online. It is a subtle hint that a human wrote it and made a human error with a human touch that AI cannot reproduce (yet).

The prose layout of perfected AI content with "em dashes" and "brutal truths" are tiresome and speak to no one.

Reposted by Brett Shavers

Arsenal Recon @arsenalrecon.bsky.social · 17h

Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 1d

Week 44 – 2025 #DFIR
thisweekin4n6.com/2025/11/02/w...

Week 44 – 2025

2 1

Reposted by Brett Shavers

Arsenal Recon @arsenalrecon.bsky.social · 1d

Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR

1 1 1

Brett Shavers @brettshavers.bsky.social · 4d

I got a little luv and a wink today.
www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR

2

Brett Shavers @brettshavers.bsky.social · 4d

I'm charging my client 2x for making me miss this today. www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR

1 2

Reposted by Brett Shavers

Magnet Forensics @magnetforensics.bsky.social · 4d

Time is almost up to participate in our State of Enterprise #DFIR survey!

Complete the survey before Oct 31 to let us know your thoughts on the latest developments in DFIR along with emerging threats, operational challenges, and areas for improvement: ow.ly/6hV750XgYic

Reposted by Brett Shavers

Arsenal Recon @arsenalrecon.bsky.social · 5d

Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR

Brett Shavers @brettshavers.bsky.social · 6d

Ever wonder what happens when a DFIR investigator ends up on the other side of the case file?

I fought city hall, literally, and learned DFIR lesasons no training ever covered.

www.suspectbehindthekeyboard.com/fighting-cit...

Brett Shavers @brettshavers.bsky.social · 7d

Ever try to out-document a team of Harvard attorneys?
It’s like fighting gravity with paper cuts.

Still, it works if you know the rules.

Brett Shavers @brettshavers.bsky.social · 8d

DFIR comes down to one thing.

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 8d

Week 43 – 2025 #DFIR
thisweekin4n6.com/2025/10/26/w...

Week 43 – 2025

Your Lab Is Ready: Free Evidence Samples + Free Software to Work Practice Cases.

Brett Shavers @brettshavers.bsky.social · 10d

Need free or demo forensic tools to go through that data? Here you go!

www.dfir.training/blog/your-la...

Yesterday’s release of the free forensic test images and CTFs took off fast. Downloads, shares, and discussions across social media haven’t slowed down. Over 38,000 views in just 2 days. Goodness.Tha...

www.dfir.training

Brett Shavers @brettshavers.bsky.social · 10d

If you got no plans for the weekend....here's this!

TERABYTES OF FREE FORENSIC TEST IMAGES AND HUNDREDS OF CTFs!
www.dfir.training/downloads/te... #DFIR #digitalforensics

Forensic Test Images & CTFs

www.dfir.training

1 1 2

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 15d

Week 42 - 2025 #DFIR thisweekin4n6.com/2025/10/19/w...

Week 42 – 2025

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

3 4

Reposted by Brett Shavers

DFRWS @dfrws.bsky.social · 22d

AI Assisted Forensics & Forensics on AI Systems at DFRWS APAC! 🧠 Papers on LLMs timeline analysis, investigating local AI apps, & new comms data tools. See the full program!

👉 Reserve your seat: buff.ly/JV23sUN
#research #dfrws #DFIR #apac #digitalforensics #seoul #korea

1 5

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 22d

Week 41 - 2025 #DFIR
thisweekin4n6.com/2025/10/12/w...

Week 41 – 2025

2 2

Reposted by Brett Shavers

Magnet Forensics @magnetforensics.bsky.social · 25d

#DFIR is facing a huge inflection point and no one knows that like those who are living it day in and day out.

We’ve just opened our survey for our State of #EnterpriseDFIR Report until Oct 31 and your insights are incredibly valuable: ow.ly/NBsa50X9eCv

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 29d

Week 40 - 2025 #DFIR

thisweekin4n6.com/2025/10/05/w...

Week 40 – 2025

Introducing the new Magnet Nexus hybrid collection agent

2 2

Reposted by Brett Shavers

Magnet Forensics @magnetforensics.bsky.social · Oct 3

The new #MagnetNexus hybrid collection agent gives #DFIR teams the flexibility to collect data from remote endpoints using either cloud-powered workflows with Nexus or on-prem workflows with #AxiomCyber, all with a single, lightweight endpoint agent: ow.ly/kKWr50X6gsW

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

ow.ly

Beyond Push-Button Forensics: The Reality of Forensic Automation

Reposted by Brett Shavers

Magnet Forensics @magnetforensics.bsky.social · Sep 30

“Push-button forensics” is often criticized as a threat to expert examiners. In reality, #DFIR tools designed for ease of use aren’t about replacing human expertise but focusing on what matters: in-depth analysis, context, and human judgment. Read more: ow.ly/9gMZ50X4p8v

The purpose of push-button forensic is to streamline repetitive, time-consuming steps, enabling examiners to focus on what truly matters.

ow.ly

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · Sep 28

Week 39 - 2025 #DFIR
thisweekin4n6.com/2025/09/28/w...

Week 39 – 2025

3 2

Reposted by Brett Shavers

Forensic Focus @forensicfocus.bsky.social · Sep 23

Don’t miss Magnet Forensics’ Mobile Unpacked with Chris Vance as he unpacks iOS 26’s biggest forensic changes and challenges—register now! www.forensicfocus.com/news/... #MagnetForensics #MobileForensics

www.forensicfocus.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · Sep 21

Week 38 - 2025 #DFIR
thisweekin4n6.com/2025/09/21/w...

Week 38 – 2025