DFIR Training Blog



Year End Review for DFIR Training!

What to Expect with DFIR Training in 2019?


Everything you need for DFIR is ending up on www.DFIR.training.  Software. Hardware. Artifacts. Resources. References. Citations. Forms. Templates. Affidavits. Keyword lists. Forensic Test Images. White papers. Books. Jobs. Videos. Podcasts. Infographics. Blogs. RSS feeds. Events. Research. And Community!

What's coming in 2019?

More tool listings!

Of course.  More categories too since there are just so many tools to search through. If you don’t see a tool, let me know and I will add it. No tool too big or too small. Currently, there are 1,400 tool listings in 238 categories. Even cooler is that all tools are cross-referenced between the categories :)

The one field that I recently added for license type (commercial, free, multi-license) is still be populated, but when finished, you can search for tools with a filter by license type. I should have started this early on rather than when the tools hit 1,400 in number. But it will be done for all the tools. As of now, searching for a specific license will give incomplete results. 

Forensic artifacts!

I started a forensic artifact database of sorts previously, but it was too complicated and time consuming to put together and manage. So, not only did I now make it easier to manage, but easier to find what you are looking for. As of today, the database is incomplete, but artifacts are being added and eventually, you will have a serious start for looking for artifact resources.

Here is the basic template for the forensic artifact database:

  1. Description– general description (with cited source)
  2. Tools– software developed specifically for that artifact
  3. White Papers– selected white papers specifically for that artifact
  4. Videos– videos specific to that artifact
  5. Keywords– so that you can search the database for keywords and find relevant artifacts
  6. References– selected references for the specific artifact

The DFIR BookShare Challenge

So far, so good, except I’m running out of author signed books! If you are a DFIR book author and want to join in, send me a note ! I want your book! They are going out all over the world and is having a good impact on the community for those who are passing them around.

Book reviews will be published from January as well. Editing what I wrote, finishing up others that I started. And learning that writing a review of a book takes more effort and time than reading the book itself!

Training Listings

The intention of the training listings is to have as many training providers post their training as possible. Trying to find DFIR training is not as easy as you would think, as you have to go to individual providers, or find incomplete listings. So, this endeavor hopes to capture them all to make it easier for everyone to find relevant training. You can help by suggesting to vendors to post their training at DFIR Training.

How about that Patreon Page?

Check out what is going on at the DFIR Training Patreon page for next year: https://www.patreon.com/posts/year-end-review-23648997 .  I created several tiers of membership, and as each tier sells out, that only leaves the next higher tier to join. But once you join at a tier, you can stay at that price for as long as you want.

Your membership on Patreon gives you access to lots of courses and freebies, which I suggest taking a look at the Year End Review post on Patreon. In just a few weeks, membership went from zero to 135, 10 books were shipped out to one tier membership level, and new courses are being added in January, February, March, and more!

As a side note, everything on www.dfir.training is still free and the DFIR Training Patreon page is simply going way further with benefits , rewards , and exclusive content for members.  Completion of the courses gives you printable proof of training that may make your employer happy with training hours and something you can prove on your CV/resume; something you can't get with Youtube videos.

Software comparisons/reviews

2019 is the year that I start software comparisons and reviews. I will also be doing comparisons on the Patreon page in more detail, but generally, I will have the basic reviews available on dfir.training. If you are a developer and want to have your tool compared, send me a note ! I have a few apps on the desk to get through first, but I’ll take as many that I can do.

Here’s the plan: I’m picking two or more tools that do the same thing (or one same specific thing) and comparing both of them. What I like, what I don’t like, the output, the ease of use, speed, etc… The more tools the better and I’ll simply just rank them as I compare them. Also, I am not averse to having some prep time with a developer to make sure that I do not miss a feature or misstate something about a tool. My goal is accuracy and honesty.

My goal for you

To build up DFIR Training to be your most valuable resource for all things DFIR. That’s it in a nutshell.  Although I enjoy adding to the website, it does take time. But with the traffic and emails I receive about the site, it makes the effort much more worthwhile.  I do intend to add more advertisers on the website to cover expenses and time, but those to be added are truly those companies doing great work in DFIR that you should know about anyway. But don’t worry. No popups. No spam email. Nothing that will get in the way of searching for something you need in DFIR and finding it quickly and easily.

About Advertising on DFIR Training

Send me an email and I’ll send over a Media Kit. Let me help you pick out what will be the best for what you are looking for.  You won’t find a more targeted audience that the visitors to DFIR Training, especially in the numbers. The numbers..quite amazing.


Some visitor stats for those interested in just how many people use DFIR Training.

Alexa (Alexa makes it easy to compare traffic, so you can see how dfir.training compares to other related websites).


Patreon Ranking (continual upward trend!)


Raw stats (excluding bots)


Written by :Brett Shavers

{rscomments option="com_rsblog" id="57"}