What a year 2020 has been! I am not referring to pandemics, toilet paper shortages, earthquakes, UFOs, politics, or even Tiger King. I am talking about the DFIR stuff! So many things and new ways of working in DFIR.
First off, DFIR Training
The DFIR Training website has finally evolved into an easier to manage platform. The only request was for the Tools page to return to the Explorer-type layout. I tend to agree, however, to keep the site consistent across all resources, it makes more sense to use the same filter method with one database rather than dozens of separate databases and dozens of different search engines. With millions of page views per month , consistency across the site is important.
The more content that is added, the more content that is found to be added. This will be a never-ending process, which is a good sign that there is plenty of DFIR content to curate, categorize, and share! Currently, the number of listings (tools, artifacts, events, etc…) is over 2,800 and I expect that to increase monthly. Translated: lots of content!
Comments might start on the website without creating an account. At one point, comments were open, but spam took too many hours out of the month to manage. With the number of requests about being able to post comments without an account, I’ll give this a try again. With that, the goal will be that you can comment on any listing on the website (that’s over 2,800 listings!). You can give positive or negative comments on tools, training, or anything else that you have an opinion or experience in commenting. Spam will be removed if it gets through this time.
Until March or April, there will be no more new subscriptions to DFIR Training. There are a few hundred active subscribers, and for the first quarter of 2021 I will be providing early access content to those subscribers from 2020 first as a ‘thank you for your support’. There was a Patreon page for DFIR Training, but the page kept getting suspended every time that I tried to give away a book, and it was too difficult for anyone to find the content! The site kept going down or was so slow. And support was horrible. The last suspension cinched me to cancel Patreon and move everything over to www.dfir.training.
Giveaways and Sponsors
Thanks to great sponsors, DFIR Training has given away tens of thousands of dollars of software and hardware! Books too! Giveaways will continue; stay tuned! As to the sponsors, I ask that you check them out to see what they are offering. The only sponsors allowed on DFIR Training are (1) legit DFIR companies with good support and having (2) legit DFIR tools that work.
If your company wants to be a sponsor, send a request for a 2021 Media Kit and let’s talk!
The future of www.DFIR.training
More content. And then some more content. A few cosmetic changes here and there, but then more content. There will be some awesome things coming to www.DFIR.training in 2021 that will be very helpful, useful, and educating for DFIR work.
2020 had plenty of FREE TRAINING everywhere. It was such a swath of training that picking courses and time to take the courses was tough (next to impossible to take all of them). Of course, due to the pandemic and lockdowns, we were home up to 24/7 for months. I appreciate all the people who put out content as it most certainly not only improved mental health but provided growth in skills and knowledge.
Many others gave away plenty in training, webinars, live Zoom sessions, and downloads. If you were like me, you knew that it wouldn’t last forever, and you tried to sneak in as much as possible!
Speaking of Zoom sessions (and YouTube), another shoutout that I have to give is to Jessica Hyde of Magnet Forensics . About mid-year, Jessica asked if I would be the first to be interviewed on Magnet Forensics’ Cache Up. I totally agreed because Jessica! Her interviews since then have been totally awesome and I try to catch each one live if I can. This is one of those 2020 benefits that I hope continues well past 2021.
And again, there were many others providing content via shared screens, YouTube, and other platforms. Kudos to all!
New DFIR Tool and Feature Releases
One of the coolest benefits of running the DFIR Training website is being asked to test software and hardware, whether from sponsors or developers. Unfortunately, there is no physical way to test them all, so I have to be selective. To see some of the cool features of tools before they are released is nice and nicer if I can give away a license to a tool after testing.
Some of the neat tools that I had an opportunity to test over the past years were from:
- Arsenal Recon’s Bypass Data Protection API
- Belkasoft BEC and X
- Deepspar’s Guardonix
- Foxton Forensics Browser History Examiner
- Forensic Notes
There were a few more that didn’t make this list simply because I did not feel comfortable with the results, but I promised to give them another run this coming year.
Books of 2020
Do you wonder what DFIR books were published in 2020? You can check it out here: https://www.dfir.training/books . Books to be printed in 2021 are already being added. This is one way that you can stay up to date with DFIR books by just keeping up with what is being published.
The Workload of 2020
The pandemic did not slow down any work. Government agencies and private companies were still being breached or held hostage with ransomware, and data has been stolen to be sold on the darkweb or pasted online. You didn’t expect this to be less, did you? https://www.zdnet.com/article/the-biggest-hacks-data-breaches-of-2020/
On a Personal Note
My intention in this post was not to minimize the pandemic but to talk about forensics (aka: overall DFIR). Most importantly, I hope that you and your family are doing well. That you are able to work and continue to work through the lockdowns. That good health follows you and yours. I have concern for all humankind, and always wish only the best on people. In this field, we are fortunate compared to so many other careers as we can work remotely, the work is extremely important ("essential"), and the need grows as technology grows.
Although 2021 is a new year, 2020's pandemic will follow us into the new year. If you missed the opportunities in 2020 that were created by the pandemic, you still have the chance to catch them in 2021. The most important opportunity is that of your social circle, both online and in real life. Being cooped up 24/7 is stressful no matter who you are and who you are with. But when your perspective is positive, especially in the face of pressure, stress, and adversity, bonds and relationships become stronger. With that, I hope that your family and friend relationships are stronger, that your social circle's radius is bigger, and that you know everyone is holding their breath, supporting each other, and will finish stronger than when all of this started.
From DFIR Training (Brett Shavers), I wish you a Happy New Year!