Blogs aren't long when the content is relevant, and in this case, super-revelant. DFIR OGs who vent unfiltered, frustrated ramblings are my favorite sources of learning how to get sh*t done without needing to get another degree.

I've never publicly demonstrated a real investigation as records arrive, questions develop, and hypotheses change. But I am this week. Get into my head to see how I think when examining evidence, personal accounts, and events. Challenge what I think by looking at the same evidence. That's what you should be doing at your workplace anyway. This is how I do it and you'll see it live, for real. brettshavers.com/dont-follow… #DFIR