Author | Lightnews

Reposted by Brett Shavers

Arsenal Recon @arsenalrecon.bsky.social · 2h

Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com

1 1

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 1d

Week 44 – 2025 #DFIR
thisweekin4n6.com/2025/11/02/w...

Week 44 – 2025

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

thisweekin4n6.com

2 1

Reposted by Brett Shavers

Arsenal Recon @arsenalrecon.bsky.social · 22h

Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR

1 1 1

Brett Shavers @brettshavers.bsky.social · 3d

I got a little luv and a wink today.
www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR

2

Brett Shavers @brettshavers.bsky.social · 3d

I'm charging my client 2x for making me miss this today. www.youtube.com/watch?v=K5D1... @abrignoni.com @charpy4n6.bsky.social #DFIR

1 2

Reposted by Brett Shavers

Magnet Forensics @magnetforensics.bsky.social · 3d

Time is almost up to participate in our State of Enterprise #DFIR survey!

Complete the survey before Oct 31 to let us know your thoughts on the latest developments in DFIR along with emerging threats, operational challenges, and areas for improvement: ow.ly/6hV750XgYic

1 1

Reposted by Brett Shavers

Arsenal Recon @arsenalrecon.bsky.social · 5d

Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR

1 1

Brett Shavers @brettshavers.bsky.social · 5d

Ever wonder what happens when a DFIR investigator ends up on the other side of the case file?

I fought city hall, literally, and learned DFIR lesasons no training ever covered.

www.suspectbehindthekeyboard.com/fighting-cit...

Brett Shavers @brettshavers.bsky.social · 6d

Ever try to out-document a team of Harvard attorneys?
It’s like fighting gravity with paper cuts.

Still, it works if you know the rules.

1

Brett Shavers @brettshavers.bsky.social · 7d

DFIR comes down to one thing.

1

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 8d

Week 43 – 2025 #DFIR
thisweekin4n6.com/2025/10/26/w...

Week 43 – 2025

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

thisweekin4n6.com

1 1

Brett Shavers @brettshavers.bsky.social · 9d

Need free or demo forensic tools to go through that data? Here you go!

www.dfir.training/blog/your-la...

Your Lab Is Ready: Free Evidence Samples + Free Software to Work Practice Cases.

Yesterday’s release of the free forensic test images and CTFs took off fast. Downloads, shares, and discussions across social media haven’t slowed down. Over 38,000 views in just 2 days. Goodness.Tha...

www.dfir.training

Brett Shavers @brettshavers.bsky.social · 9d

If you got no plans for the weekend....here's this!

TERABYTES OF FREE FORENSIC TEST IMAGES AND HUNDREDS OF CTFs!
www.dfir.training/downloads/te... #DFIR #digitalforensics

Forensic Test Images & CTFs

www.dfir.training

1 1 2

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 15d

Week 42 - 2025 #DFIR thisweekin4n6.com/2025/10/19/w...

Week 42 – 2025

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

thisweekin4n6.com

3 4

Reposted by Brett Shavers

DFRWS @dfrws.bsky.social · 21d

AI Assisted Forensics & Forensics on AI Systems at DFRWS APAC! 🧠 Papers on LLMs timeline analysis, investigating local AI apps, & new comms data tools. See the full program!

👉 Reserve your seat: buff.ly/JV23sUN
#research #dfrws #DFIR #apac #digitalforensics #seoul #korea

1 5

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 22d

Week 41 - 2025 #DFIR
thisweekin4n6.com/2025/10/12/w...

Week 41 – 2025

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

thisweekin4n6.com

2 2

Reposted by Brett Shavers

Magnet Forensics @magnetforensics.bsky.social · 25d

#DFIR is facing a huge inflection point and no one knows that like those who are living it day in and day out.

We’ve just opened our survey for our State of #EnterpriseDFIR Report until Oct 31 and your insights are incredibly valuable: ow.ly/NBsa50X9eCv

1 1

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · 29d

Week 40 - 2025 #DFIR

thisweekin4n6.com/2025/10/05/w...

Week 40 – 2025

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

thisweekin4n6.com

2 2

Reposted by Brett Shavers

Magnet Forensics @magnetforensics.bsky.social · Oct 3

The new #MagnetNexus hybrid collection agent gives #DFIR teams the flexibility to collect data from remote endpoints using either cloud-powered workflows with Nexus or on-prem workflows with #AxiomCyber, all with a single, lightweight endpoint agent: ow.ly/kKWr50X6gsW

Introducing the new Magnet Nexus hybrid collection agent

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

ow.ly

1 1

Reposted by Brett Shavers

Magnet Forensics @magnetforensics.bsky.social · Sep 30

“Push-button forensics” is often criticized as a threat to expert examiners. In reality, #DFIR tools designed for ease of use aren’t about replacing human expertise but focusing on what matters: in-depth analysis, context, and human judgment. Read more: ow.ly/9gMZ50X4p8v

Beyond Push-Button Forensics: The Reality of Forensic Automation

The purpose of push-button forensic is to streamline repetitive, time-consuming steps, enabling examiners to focus on what truly matters.

ow.ly

1 1

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · Sep 28

Week 39 - 2025 #DFIR
thisweekin4n6.com/2025/09/28/w...

Week 39 – 2025

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

thisweekin4n6.com

3 2

Reposted by Brett Shavers

Forensic Focus @forensicfocus.bsky.social · Sep 23

Don’t miss Magnet Forensics’ Mobile Unpacked with Chris Vance as he unpacks iOS 26’s biggest forensic changes and challenges—register now! www.forensicfocus.com/news/... #MagnetForensics #MobileForensics

www.forensicfocus.com

1 1

Reposted by Brett Shavers

Phill Moore @phillmoore.bsky.social · Sep 21

Week 38 - 2025 #DFIR
thisweekin4n6.com/2025/09/21/w...

Week 38 – 2025

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

thisweekin4n6.com

1 1

Brett Shavers @brettshavers.bsky.social · Sep 16

Am I the only one who feels this way?
www.linkedin.com/pulse/every-...

Every Monster Leaves Teeth Marks. Some Go to the Bone.

I just came across a job ad for an ICAC digital forensic examiner. For minutes, I thought about applying.

www.linkedin.com

Reposted by Brett Shavers

Ali Hadi | B!n@ry @binaryz0ne.bsky.social · Sep 14

I want to thank @brettshavers.bsky.social for the opportunity taking his "DF/IR Investigative Mindset" course! This is an amazing course for everyone! Whether you're a vetran or just starting your #DFIR career. I can't recommend it enough.

Brett, thank you so much 🙏🏻

1 1 3