12 Jan 2021
By Andrew Rathbun

AboutDFIR Content Update 1/12/2021

The first update of 2021 is here: KAPE Guide - added links to KAPE Target Guide and Template Tools & Artifacts - Android - new entries added Tools & Artifacts - File Systems - new entries added Tools & Artifacts - iOS - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: For those who use Eric Zimmerman's Tools, make sure you're…
Read More
31 Dec 2020
By Andrew Rathbun

AboutDFIR Content Update 12/31/2020

Happy (almost) New Year and with that, the last update of 2020: Annual Industry Reports - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: 2020 was an awesome year for AboutDFIR. We saw the…
Read More
18 Dec 2020
By Andrew Rathbun

AboutDFIR Content Update 12/18/2020

Likely the last site update post of the year: Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added Tools & Artifacts - Linux - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: This week saw the release of the MFT Explorer/MFTECmd Guide. Check…
Read More
17 Dec 2020
By Andrew Rathbun

Introducing AboutDFIR’s MFT Explorer/MFTECmd Guide

Greetings everyone! I’ve been working on a detailed guide geared towards LE/Private Sector examiners who’ve never used MFT Explorer/MFTECmd before as well as anyone looking to learn what the tool is all about. Learning a new tool is intimidating and can be frustrating, but hopefully this guide will make things easier. The MFT Explorer/MFTECmd Guide comes on the heels of the previous guides I put together recently: KAPE, Timeline Explorer, and Registry Explorer/RECmd. All guides,…
Read More
05 Dec 2020
By Andrew Rathbun

AboutDFIR Content Update 12/5/2020

After a short break, we're back: Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I finally put the GCFA behind me and thankfully I passed! I will be…
Read More
21 Nov 2020
By Andrew Rathbun

AboutDFIR Content Update 11/21/2020

After a short break, we're back: Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - File Systems- new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I finally put the GCFA behind me and thankfully I passed! I will be…
Read More
07 Nov 2020
By Andrew Rathbun

AboutDFIR Content Update 11/7/2020

Happy November! A short update this week: Tools & Artifacts - File Systems- new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I am going to be taking my GCFA in a couple weeks so updates may be sparse between now and then. Once I (hopefully) pass the GCFA, look for an update…
Read More
31 Oct 2020
By Andrew Rathbun

AboutDFIR Content Update 10/31/2020

Happy Halloween! A summary of recent updates: KAPE - various updates/fixes Timeline Explorer - various updates/fixes Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: My guide for Registry…
Read More
23 Oct 2020
By Andrew Rathbun

AboutDFIR Content Update 10/23/2020

Greetings! A relatively small update this week: Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: Check out Devon Ackerman's recent appearance on the Forensic Happy Hour with Lee Reiber here! My guide for Registry Explorer/RECmd went up earlier this month! Check it out here as well as my KAPE and Timeline Explorer guides. Look for…
Read More
16 Oct 2020
By Andrew Rathbun

AboutDFIR Content Update 10/16/2020

Greetings! Another week, another content update: Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tool Testing - added Josh Hickman's new Android 11 image AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: Check out Devon Ackerman's appearance on the Forensic Happy Hour with Lee Reiber here! My guide for Registry Explorer/RECmd has been posted!…
Read More
07 Oct 2020
By Andrew Rathbun

AboutDFIR Content Update 10/7/2020

Greetings! Another week, another content update: Tools & Artifacts - Tools - Registry Explorer/RECmd- new guide added! Tools & Artifacts - iOS - new entries added Tools & Artifacts - Linux - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put together an AboutDFIR LinkedIn page AND a Digital Forensics Discord…
Read More
06 Oct 2020
By Andrew Rathbun

Introducing AboutDFIR’s Registry Explorer/RECmd Guide

Greetings everyone! I’ve been working on a detailed guide geared towards LE/Private Sector examiners who’ve never used Registry Explorer/RECmd before as well as anyone looking to learn what the tool is all about. Learning a new tool is intimidating and can be frustrating, but hopefully this guide will make things easier. The Registry Explorer/RECmd Guide comes on the heels of the previous guides I put together recently: KAPE and Timeline Explorer . All guides, current…
Read More
30 Sep 2020
By Andrew Rathbun

AboutDFIR Content Update 9/30/2020

Greetings! Yet another content update: Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put together an AboutDFIR LinkedIn page AND a Digital Forensics Discord Server LinkedIn page. Please follow both if you want to stay…
Read More
24 Sep 2020
By Andrew Rathbun

AboutDFIR Content Update 9/24/2020

Greetings! Yet another content update: Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put together an AboutDFIR LinkedIn page AND a Digital Forensics Discord Server LinkedIn page recently. Please follow both if you want to…
Read More
16 Sep 2020
By Andrew Rathbun

AboutDFIR Content Update 9/16/2020

Greetings! Yet another content update: Challenges & CTFs - complete revamping! Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that covers Timeline Explorer in great detail with lots of animated GIFs to paint a better picture on how to use…
Read More
07 Sep 2020
By Andrew Rathbun

AboutDFIR Content Update 9/7/2020

Greetings! Yet another content update: Social Media - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that covers Timeline…
Read More
05 Sep 2020
By Andrew Rathbun

Join Devon Ackerman on Cache Up

Cache Up is a series ran by Jessica Hyde of Magnet Forensics. Our very own Devon Ackerman will be featured on the Tuesday, September 8th episode at 1100 hours EST. If you can't make it live, then watch the recording on the Magnet Forensics YouTube channel in the Cache Up playlist. See you there! EDIT: Link is now posted here.
Read More
02 Sep 2020
By Andrew Rathbun

AboutDFIR Content Update 9/2/2020

Greetings! Another content update: Tools & Artifacts - iOS - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that covers Timeline Explorer in great detail with lots of animated GIFs to paint a better picture on how…
Read More
02 Sep 2020
By Andrew Rathbun

Introducing the AboutDFIR LinkedIn Page!

This has been a long time coming but there now is an AboutDFIR LinkedIn page for you to follow for the latest blog posts, pages, and new DFIR content! We look forward to connecting with you. Speaking of keeping up to date, don't forget the AboutDFIR RSS Starter Pack exists! Keep up to date with all the most relevant DFIR newsfeeds all in once place!
Read More
26 Aug 2020
By Andrew Rathbun

AboutDFIR Content Update 8/26/2020

Greetings! Short content update this week: Jobs - lots of new jobs added KAPE - fixed potentially broken links in Table of Contents Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that covers Timeline Explorer in great detail with lots…
Read More
21 Aug 2020
By Andrew Rathbun

AboutDFIR Content Update 8/21/2020

Greetings! Short content update this week: Jobs - lots of new jobs added KAPE - added new links, refined a few details, etc AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that covers Timeline Explorer in great detail with lots of animated GIFs to paint a better picture on how to use it! Check it out here. Also,…
Read More
19 Aug 2020
By Andrew Rathbun

Introducing AboutDFIR’s Timeline Explorer Guide

Greetings everyone! I’ve been working on a detailed guide geared towards LE/Private Sector examiners who’ve never used Timeline Explorer before as well as anyone looking to learn what the tool is all about. Learning a new tool is intimidating and can be frustrating, but hopefully this guide will make things easier. This guide for Timeline Explorer comes on the heels of last month's release of the KAPE Guide. It can also be currently located in…
Read More
15 Aug 2020
By Andrew Rathbun

AboutDFIR Content Update 8/15/2020

Greetings! Short update this week: Jobs - lots of new jobs have been posted lately Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that covers KAPE in great detail with lots of animated GIFs to paint a better picture on…
Read More
08 Aug 2020
By Andrew Rathbun

AboutDFIR Content Update 8/8/2020

Greetings! Short update this week: Jobs - lots of new jobs have been posted lately Tools & Artifacts - iOS - new entries added Tools & Artifacts - DVR/Multimedia - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that covers KAPE in great detail with lots…
Read More
04 Aug 2020
By Andrew Rathbun

SANS FOR508: A Review

Introduction I recently attended the SANS DFIR Summit 2020 and took FOR508 with Chad Tilbury. I elected to take the GCFA certification which I am currently preparing for and creating my index similar to how I laid out in a previous blog post. At Kroll, FOR500 and FOR508 are our daily bread and butter so I was very excited to finally take FOR508. LiveOnline Review First things first, let's cover the new format SANS is…
Read More
31 Jul 2020
By Andrew Rathbun

AboutDFIR Content Update 7/31/2020

Greetings! Short update this week: Jobs - lots of new jobs added Tools & Artifacts - iOS - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that covers KAPE in great detail with lots of animated GIFs to paint a better picture on how to use it! Check it out here. Also, if you're not…
Read More
23 Jul 2020
By Andrew Rathbun

AboutDFIR Content Update 7/23/2020

Greetings! Yet another content update: Awards - page updated to reflect 2020 Forensic 4:cast Awards results Social Media - new entries added Tools & Artifacts - macOS - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Windows - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: I recently put out a guide that…
Read More
18 Jul 2020
By Andrew Rathbun

Introducing AboutDFIR’s KAPE Guide

Greetings everyone! I've been working on a detailed guide geared towards LE/Private Sector examiners who've never used KAPE before as well as anyone looking to learn what the tool is all about. Learning a new tool is intimidating and can be frustrating, but hopefully this guide will make things easier. The guide can be found here. It can also be currently located in the site's recently redesigned menu via Tools & Artifacts -> Tools ->…
Read More
18 Jul 2020
By Andrew Rathbun

AboutDFIR Content Update 7/18/2020

Greetings! A smaller update this week:  Annual Industry Reports - new entries added Tools and Artifacts - menu section reworked in preparation for upcoming additions to the site AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: The Forensic 4:cast Awards' were presented today and the community voted the Digital Forensics Discord Server as DFIR Resource of the Year! Thank you to all the support…
Read More
08 Jul 2020
By Andrew Rathbun

AboutDFIR Content Update 7/8/2020

Greetings! A smaller update this week:  Tools & Artifacts - macOS - new entries added Tools & Artifacts - Linux - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: REMINDER! The 2020 SANS DFIR Summit is FREE! Register here! It starts next week so don't miss out. The Forensic 4:cast Awards' will be presented at the end of the 2nd day…
Read More
02 Jul 2020
By Andrew Rathbun

AboutDFIR RSS Starter Pack v2 released!

Greetings! I am happy to share a new version of the AboutDFIR RSS Starter Pack! The AboutDFIR RSS Starter Pack was first introduced earlier this year in March 2020. Since then, lots of new content channels have been created largely thanks to the forced stay-at-home experiment brought on by the COVID-19 pandemic. As always, the AboutDFIR RSS Starter Pack can always be found on its dedicated page on the site. For those who already have…
Read More
02 Jul 2020
By Andrew Rathbun

AboutDFIR Content Update 7/2/2020

Greetings! Yet another content update:  AboutDFIR RSS Starter Pack - v2 released with new feeds! Tools & Artifacts - Windows - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: REMINDER! The 2020 SANS DFIR Summit is FREE! Register here! The Forensic 4:cast Awards'…
Read More
24 Jun 2020
By Andrew Rathbun

AboutDFIR Content Update 6/24/2020

Greetings! A very small content update this week, but there's lots in the pipeline:  Tools & Artifacts - Windows - cleaned up table contents, more changes to come AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: REMINDER! The 2020 SANS DFIR Summit is FREE! Register here! The Forensic 4:cast Awards' nomination period has concluded and voting is open! Cast your final vote here. Feel…
Read More
16 Jun 2020
By Andrew Rathbun

AboutDFIR Content Update 6/16/2020

Greetings! More new content this week:  Annual Industry Reports - more new Annual Reports added Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Videos/Webinars -new entries added AboutDFIR stickers are a thing! If you're interested in one, please let us know! Here's what they look like: BREAKING NEWS! The 2020 SANS DFIR Summit is FREE! Register here! The Forensic 4:cast Awards' nomination period has concluded…
Read More
10 Jun 2020
By Andrew Rathbun

AboutDFIR Content Update 6/10/2020

Greetings! Lots of new content this week:  Annual Industry Reports - many new 2020 Annual Reports added Tools & Artifacts - Windows - new entries added and page overhauled separating Artifacts and Tools Tools & Artifacts - iOS - new entries added Tools & Artifacts - macOS - new entries added Videos/Webinars -new entries added Jobs - new jobs added, old ones purged, and added Date Added to the table Tool Testing - new entries…
Read More
02 Jun 2020
By Andrew Rathbun

AboutDFIR Content Update 6/2/2020

Greetings! Lots of new content this week:  Tools & Artifacts - iOS - new entries added Tools & Artifacts - Android - new entries added Challenges & CTFs - new walkthroughs added Videos/Webinars - added TeelTech's YouTube channel Tool Testing - new entries added A new month brings a new featured page of the month. This month is the AboutDFIR RSS Starter Pack! This was introduced back in March of this year and it's a…
Read More
27 May 2020
By Andrew Rathbun

AboutDFIR Content Update 5/27/2020

Greetings! Lots of new content this week:  DFIR Research - new completed research added, great job Adhirath Kapoor! Tools & Artifacts - macOS - new entries added Tools & Artifacts - iOS - new entry added Tools & Artifacts - Windows - new entries added Tools & Artifacts - File Systems - new entry added Tools & Artifacts - Android - new entries added Tools & Artifacts - Linux - new entries added The Magnet…
Read More
21 May 2020
By Andrew Rathbun

AboutDFIR Content Update 5/21/2020

Greetings! Another short content update this week:  Tools & Artifacts - macOS - new entry added Tools & Artifacts - Windows - new entries added Tools & Artifacts - Android - new entries added Men of #DFIR - various entries updated As stated previously, updates will be sparse this month due to the Magnet Virtual Summit 2020 taking place currently that has been keeping me busy most days of the week. However, look for some…
Read More
14 May 2020
By Andrew Rathbun

AboutDFIR Content Update 5/14/2020

Greetings! A very short content update this week:  Tools & Artifacts - iOS - new entries added Updates will be sparse this month due to the Magnet Virtual Summit 2020 taking place currently that has been keeping me busy most days of the week. However, look for some larger-scale changes to come in June. There's only so much time in the day! However, there's plenty of other things going on right now. Speaking of the Magnet Virtual…
Read More
05 May 2020
By Andrew Rathbun

AboutDFIR Content Update 5/5/2020

Greetings! The first week of May brings new site content as detailed below:  Tools & Artifacts - iOS - new entries added Tools & Artifacts - File Systems - new entries added Tools & Artifacts - Linux - new entries added Tools & Artifacts - Windows - new entries added as well as every 13Cubed video relating to a Windows artifact Challenges & CTFs - new entries added DFIR Research - new entry added under…
Read More
29 Apr 2020
By Andrew Rathbun

AboutDFIR Content Update 4/29/2020

Greetings! A short update this week:  Certifications & Training - new entry added (Harvard's FREE CS50: Introduction to Computer Science course) Tools & Artifacts - Windows - new entries added Tools & Artifacts - iOS - new entries added In case you missed them, check out my latest blog posts: A General Overview of DFIR Resources and A Beginner’s Guide to the Digital Forensics Discord Server!  Make sure you're keeping up on Kevin Ripa's 3MinMax…
Read More
23 Apr 2020
By Andrew Rathbun

AboutDFIR Content Update 4/23/2020

Greetings! This week's update is detailed below:  Some Home Page updates first: New site feedback form added under the Submit menu, let us know what you think here New AboutDFIR Blog Posts Archive added under the Reading menu, check it out here Added More button underneath the last 12 blog posts at the bottom of the home page which will link to the AboutDFIR Blog Posts Archive  Now for the usual content updates: Tool Testing…
Read More
22 Apr 2020
By Andrew Rathbun

A Beginner’s Guide to the Digital Forensics Discord Server

Introduction This post has been a long time coming for me. I will use this post to address all newbie questions I've fielded in regard to the use of Discord, or how to join the server successfully. Believe it or not, we have a lot who join the server but never gain access due to not following through with the brief verification process new members have to go through. This post is aimed to help…
Read More
18 Apr 2020
By Andrew Rathbun

A General Overview of DFIR Resources

Introduction The world of Digital Forensics and Incident Response (DFIR) is so expansive that it's impossible for one person to know it all, let alone a fraction of it. To combat this, one must first be aware of and second utilize the resource that's best catered to the issue at hand. There are multiple resources out there that digital forensic examiners and incident responders should be aware of.  Not all resources are created equal nor…
Read More
14 Apr 2020
By Andrew Rathbun

AboutDFIR Content Update 4/14/2020

Greetings! This week's update is detailed below:  Tool Testing - new memory image added by Alissa Torres Videos/Webinars - new entries added  Certifications & Training - new entries added (Hal Pomeranz' Intro to Linux Forensics course) Tools & Artifacts - macOS - new entries added Tools & Artifacts - Windows - new entries added Social Media - multiple new Discord servers added Jobs - multiple new jobs posted Brian Carrier, the author of File System…
Read More
09 Apr 2020
By Andrew Rathbun

AboutDFIR Content Update 4/9/2020

Greetings! This week's update is detailed below:  Tools & Artifacts - Windows - new entries added Tools & Artifacts - iOS - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - DVR/Multimedia - new entries added Challenges & CTFs - new entries added Podcasts - new entries added If there's something you think should be on the website, let us know! Per usual, you can reach me via…
Read More
04 Apr 2020
By Andrew Rathbun

AboutDFIR Content Update 4/4/2020

Greetings! This week's update is detailed below:  Social Media - new entries added Tools & Artifacts - Android - new entries added Tools & Artifacts - iOS - new entries added Certifications & Training - new entries added Tool Testing - new entries added Tune in to this upcoming Monday's episode of "Life Does Not Have a Ctrl+Alt+Del" hosted by Heather Mahalik where I am the featured guest! I will be talking about the Digital…
Read More
27 Mar 2020
By Andrew Rathbun

AboutDFIR Content Update 3/27/2020

Happy Friday! This week's update is detailed below:  Mobile/Tablet home page menus fixed, sorry for the inconvenience Awards - page updated to reflect that nominations for the Forensic 4:cast Awards are now open Tools & Artifacts - Android - new blog posts added Tools & Artifacts - File Systems - new blog posts added Tools & Artifacts - iOS - new blog posts added Tools & Artifacts - Linux - new blog posts added In…
Read More
19 Mar 2020
By Andrew Rathbun

Introducing the AboutDFIR RSS Starter Pack!

Greetings! I am excited to share something that has been in the back of my mind for a while now. Introducing the AboutDFIR RSS Starter Pack! Basically, this is a curated list of blogs, DFIR vendor websites, and other cyber security related websites categorized for your convenience. A simple import into your Feedly account (or RSS app of choice) and you're up and running! This is the first iteration of this project and will be…
Read More