Our website may use cookies to improve and personalize your experience and to display advertisements (if any). Our website may also include cookies from third parties like Google Adsense or Google Analytics. By using the website, you consent to the use of cookies. We’ve updated our Privacy Policy. Please click on the button to check our Privacy Policy.

AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

Andrew Rathbun

Andrew Rathbun

…is a current contributor to the DFIR Definitive Compendium Project as of 2019 and is currently a Senior Associate with Kroll’s Cyber Risk division. He was previously a Forensic Computer Examiner with the US Department of Health and Human Services – Office of Inspector General. With the federal government, Andrew (@bunsofwrath12) led and assisted in the identification, acquisition, preservation, and analysis of electronically stored information (ESI) in support of various white-collar crime investigations involving health care fraud. Prior to this, he was a patrol officer for 4 years and Detective for 3 years with the Michigan State University Police Department. He served in the Investigative Division’s Digital Forensics and Cyber Crime Unit (DFCCU) where he conducted digital forensic examinations on computers and mobile devices as well as general criminal investigations. As a passion project, Andrew co-founded and currently serves as an administrator for the Digital Forensics Discord Server that continues to grow and serve as a real-time resource for digital forensic examiners worldwide. To join, please send a blank email to digitalforensicsdiscord@gmail.com. Andrew is most notably known for his involvement in a unique case that involved using a dead victim’s fingerprint to unlock a Galaxy S6 that was important to a homicide investigation. Andrew also served in the United States Marine Corps Reserve as a Rifleman (0311). He served one combat tour to Fallujah, Iraq in 2006-2007 with his infantry unit based out of Lansing, Michigan. Andrew has been previously published in PoliceOne as well as collaborated, edited, and contributed to various instructional guides used within the Digital Forensic and Incident Response community. Andrew earned a Bachelor’s degree in Criminal Justice/Sociology from Western Michigan University located in Kalamazoo, Michigan; as well as a Master’s degree in Human Resources Administration from Central Michigan University located in Mount Pleasant, Michigan. Feel free to connect with Andrew on LinkedIn!