A Beginner’s Guide to the Digital Forensics Discord Server

By Andrew RathbunOn April 22, 2020November 8, 2020

Introduction

This post has been a long time coming for me. I will use this post to address all newbie questions I’ve fielded in regard to the use of Discord, or how to join the server successfully. Believe it or not, we have a lot who join the server but never gain access due to not following through with the brief verification process new members have to go through. This post is aimed to help those who are new to Discord, and/or the Digital Forensics Discord Server, in hopes that it will provide them with a better understanding of how it all works, as well as achieving a higher success rate of getting new members in upon their first attempt joining!

Also, if this is your first time on AboutDFIR, stay awhile and listen! Let us know what you like or want to see more of here! Be sure to also check out my recent blog post relating to all the DFIR resources here!

Joining the Digital Forensics Discord Server

There are multiple ways to join the server. They are as follows:

Sending a blank email to digitalforensicsdiscord@gmail.com, or
Clicking this link

Regardless of which method used, it’s highly advised to create your Discord account prior to using one of the above links. It’ll make things much smoother when it comes to joining this server (or any, for that matter).

Gaining Access to All Channels Within the Digital Forensics Discord Server

Once you have joined the server, a bot will automatically assign you a role. Roles in Discord allow Administrators and Moderators to set channel permissions in the server based on which role someone has. They also allow members to be labeled according to who they are, what they do, etc. In the Digital Forensics Discord Server, once you have a role assigned, you have access to all the channels in the server. Roles serve as a way to label a member given that there are Law Enforcement, Private Sector, various vendors, and people who work on specific DFIR-related projects or tools. The labeling allows the community to know each person’s skill set, involvement, or relation to the DFIR field. One role doesn’t have more access or privileges over another, outside of the Moderators role.

For instance, someone who works in Law Enforcement in France, but is also a part-time instructor for a forensic vendor, would be labeled with the following roles: Law Enforcement [France] and DFIR Instructor. Someone who works for a vendor would be assigned the role of their respective employer. Someone who works in the Private Sector for a company such as Kroll but is also the developer for a popular open-source tool would be labeled with the following roles: Private Sector and *insert name of the tool here*.

To gain access to the channels and content in the server, you will need to post your role in the #role-assignment channel. Please include a brief background of what you do and who you are to the extent that you feel comfortable. Based on what you post will determine what role(s) you are assigned. If any further verification is required by the Moderators, you will be asked to email digitalforensicsdiscord@gmail.com from your work or school email address.

The important thing about role assignment is to be PATIENT! Time zones are a real thing and sometimes the moderators and I wake up to multiple unassigned people despite posting their brief biographies in the #role-assignment channel. We are human and we get to it as quickly as we can. So if you don’t get access within a few minutes, check back the next day and you are almost guaranteed to have been assigned a role and thus access has been granted to you. If you still don’t have access after a day, private message one of the Moderators.

If you do not post in the #role-assignment channel and thus a role isn’t assigned to you, you will be purged from the server by an automated bot and you will have to join again in an attempt to gain access to the server once more. We do this so the member count isn’t artificially inflated with members who are sitting in New Members role limbo.

Member Conduct in the Digital Forensics Discord Server

Ah yes, what would a professional community such as the one found in the Digital Forensics Discord Server be without a set of rules? Here are the rules for the server:

Be polite, respectful, and professional. This server consists largely of working professionals who utilize this server to solve real problems for real cases they are currently working on. A lot of progress is accomplished here and we do not want this jeopardized by unprofessional, toxic posting habits.
Do not share any sensitive information that you wouldn’t want the media to share with everyone. For those in LE, it would be wise to leave out identifying details about a case (suspect/victim’s name, address, etc).”
No discussion of sensitive topics commonly protected by NDA such as GrayKey’s capabilities. If you see something that you think violates the terms of an NDA, please notify the Moderators.
Do not spam the server with sales pitches or posting behavior that is counterproductive to the purpose of the server. If you’re unsure on how to act in this server, lurk for a few days to witness the culture of the server. It’s a professional server with lots of working professionals where low content posting/trolling won’t be received well.
Please note you may be kicked out of this server for any behavior the mods feel is threatening to the community in any way. There is no probable cause or due process here. This rule is very rarely utilized but it’s here simply as a fair warning to everyone. Being here is a privilege, not a right.
If you belong to a vendor, please keep the mudslinging about other vendors off the public channels. Mudslinging comments and other conduct unbecoming will be swiftly deleted. Let’s keep this channel professional and the water warm for everyone regardless of vendor affiliation.
There is an #off-duty channel designated for anything non-DFIR related. All DFIR related conversations should occur in the appropriate channels.
Any members who do not conduct themselves professionally or in a manner that threatens the wellbeing of the server, or its membership, shall be temporarily placed in Discord Jail. This is a role created specifically for temporarily removing all access to the main channel list. Once in there, the member will be given a dedicated channel for which to have a conversation with the Moderators to figure out a resolution to the behavior that caused being placed in Discord Jail. This is used very sparingly but exists only for those most extreme circumstances.
English only, please. Any extensive conversation in any other language should be conducted over DM.

Revised: 19MAY2020

How to Best Utilize the Digital Forensics Discord Server using Discord

Discord is an awesome chat application. Let’s go over some of the best ways to utilize it while in the Digital Forensics Discord Server.

DFIR Channels

The server boasts approximately 25 DFIR-related channels at the time of this writing. This will fluctuate given current events, trending topics of interest, and member requests. Channels that are inactive for extended periods of time are subject to being archived and removed from the channel list. If anyone has a suggestion for a channel, please let us know!

There are many channels relating to various sub-disciplines within DFIR. Topics ranging from mobile forensics, computer forensics, incident response, password cracking, and many more are all available for your perusal.

Using the Search

I created this for those who are using Discord via the desktop client or the web browser. This is a ridiculously narrow search but it’s meant to show how you can string elements of a search together to narrow down the search. Discord’s search is VERY useful for locating previous solutions to problems others have experienced. The entire history of the server is at your disposal! See below:

Quoting Messages

I created this for those who are using Discord via the desktop client or the web browser.

For those on Android/iOS, utilize any right-click equivalents (long pressing, etc) to locate the context menus that’ll give you the option to quote.

Muting Channels or Categories

I created this for those who are using Discord via the desktop client or the web browser.

For those on Android/iOS, utilize any right-click equivalents (long pressing, etc) to locate the context menus that’ll give you the option to mute.

Managing Notifications

I created this for those who are using Discord via the desktop client or the web browser. You can manage notifications for each individual server you’re a member of. This is highly recommended to avoid notification overload!

After you navigate here, you will be presented with the following:

Make adjustments as you deem necessary to fit your personal preferences.

Tagging Moderators/Vendors/Existing Members in a Message

I created this for those who are using Discord regardless of the client they’re using (desktop client/web browser/mobile app). All apps function identically as the only requirement is the @ symbol to mention a member or role.

What Else?

If anyone has any requests for How-To GIFs, please let me know and they will be added here as appropriate.

Frequently Asked Questions

The following questions have been asked of me throughout the past 2+ years of the life of the Digital Forensics Discord Server. These questions and answers are mirrored in the server’s #faqs channel. They are posted here for your benefit, as well.

When was this server created?

March 26, 2018

Where can I view stats about the server?

Here!

What options are there for bolding, underlining, inserting code, etc into my posts on Discord?

Please visit this site for all you need to know.

I see some users posting links to specific posts but I’m not seeing how to do that. Help?

You need to enable Developer Mode for this feature as seen here.

How come when someone DM’s me, I can’t see the role they’re assigned in the Digital Forensics Discord Server?

I don’t know, ask Discord! That’s just one of the quirks in Discord that I cannot control. Roles are server-specific, not Discord-wide. Currently, you have to click on their profile to see what their username is in the server, then search for that user in the server, and click on their profile in the server to see the assigned server-specific role. In addition, you can click on anyone’s profile image or username while viewing a channel in a server to see what roles that person is assigned.

How do I follow a thread on Discord like I can on Forensic Focus and other forums?

You can’t. Discord is a live chat room, basically. The best one can do to maintain thread continuity is to paste links to a particular post that they’re referring to in a reply. Hopefully, in the future, Discord will provide a better solution for this, but for now, it’s simply the nature of the beast with Discord. Forums have their pros and cons, as does Discord. They each serve their own purpose and it’s best for the individual to understand the nature of each so they can be leveraged most effectively for your needs.

I’m trying to find a solution for a specific model of a phone or a device, what are my options?

Here are your options for this scenario: Search this server in the search bar for your specific model (i.e. try searching SM-G930V and Galaxy S7 for best results) Try searching other resources linked here. If you are working on a phone, then Google Groups and Forensic Focus are always good options. If you are working on a computer, Forensic Focus and Reddit are always good options.

I’m very new to this field and I don’t feel comfortable asking a “stupid question” that seems way below the level of discussion I’m seeing in the channels. What advice do you have for me?

There is no such thing as a stupid question besides the one that goes unasked. All the smart people you’re seeing chatting in this server knew nothing at one point in time and built up their knowledge through various means. This server is just one way to do that. Ask your question and we are more than happy to help regardless of how “basic” it may be. The important thing is that you get the correct information that helps your case and hopefully rids the world of some evil. Post your question in the respective channel for the greatest likelihood that a subject matter expert sees it!

How do I pin a message that I feel may be important or useful to someone in the future?

Currently, only moderators can pin messages. If you see a message that should be pinned to a channel, please let one of @Moderators know and we can get it pinned!

I see a term that I don’t recognize but I can’t find anything anywhere on the internet to learn more about it. What advice do you have?

I would say try the following: Search the server using the search bar for that specific term. If nothing, try here. If it’s not listed there, let me know and I’ll get it added. But next, if Google failed you, just ask in one of the channels! Documentation is very important in this field and if something isn’t documented, let’s work together to make sure it is documented somewhere.

How do I keep up with new developments in this server?

Keep your eyes posted on #announcements for any news relating to this server.

I suspect a user might not be who they say they are or they may be a detriment to this server, what should I do?

PM one of the @Moderators and explain the situation. We will take the steps necessary to remove that person’s access to the server until they can be looked into further.

What’s the story on switching to AboutDFIR for content hosting?

Glad you asked! Devon Ackerman approached me in September 2019 with an offer to combine resources with AboutDFIR. This meant using AboutDFIR as an official storage repository for knowledge, guides, files, or anything else we wanted to host. I was all about it, given that I was a fan of AboutDFIR prior to this conversation. The mods and I all agreed that AboutDFIR would provide a better solution to the content previously hosted on the Shared Google Drive. As of this writing, 95% of what was hosted on the Shared Google Drive has been migrated to AboutDFIR, and then some.

AboutDFIR’s content has been growing exponentially and will continue to do so. Long term and in the now, it’ll serve as a better venue for any content created by the members of this server (walkthrough guides, blog posts, etc). If anyone has a walkthrough guide they want to be hosted on AboutDFIR, just let me know. This will provide the author more exposure via AboutDFIR rather than being pigeonholed in the Shared Google Drive which was only accessible to those who were members of this server. AboutDFIR will provide a wider audience and more exposure to the great work our members do to help further the DFIR community. Additionally, if anyone has a blog that they want to be featured on AboutDFIR, let me know! This will get you more exposure and a seat next to some of the biggest names in the community. AboutDFIR also gives more exposure to the server which means more members from different backgrounds to potentially provide you with a solution to your problem. As you can see, there are a lot of benefits to the partnership. Hopefully, this better explains the transition to AboutDFIR and the history behind it.

What companies/vendors are currently in this server?

You can @ the following companies/vendors at any time. Here’s a list current as of 2020APR4:

@Amped Software @Andriller @Arsenal Recon @Atola Technology @Autopsy @Belkasoft @Binalyze @BlackBag Technologies @CAINE @Cellebrite @Control-F @Elcomsoft @GetData @Grayshift @Hancom @Hashcat @Hashtopolis @iNPUT-ACE @iPad Rehab @Magnet Forensics @Metaspike @MSAB @NW3C @OpenText @Oxygen Forensics @Sanderson Forensics @SANS Forensics Institute @SCG Canada @Search.org @Spyder Forensics @SUMURI @TeelTech

What can I do to help support the server’s growth?

If you find it in your kind heart to do so and you support Discord via Discord Nitro, please consider using your Server Boosts on this server! As of October 2020, we now have a vanity invite URL: https://discord.gg/digitalforensics.

CategoriesDigital Forensics Discord Server