DFIR Training

The official DFIR Training account and most complete #DFIR online resource. Managed by @Brett_Shavers.

[SANS DFIR @sansforensics]

Know where the evidence lives.

This FOR585 poster maps iOS and Android artifacts, retention, acquisition paths, SQLite queries, and free tools for investigating app data, device activity, and mobile malware.

👉 https://t.co/Be3mjvN3Ty

#MobileForensics #DFIR

[Binalyze @binalyze]

Patched PHP2Shell? Now investigate what’s already there.
Jeff Hamm, Binalyze's Forward Deployed Security Architect, on hunting for webshells and persistence left before the patch, with companion Sigma and YARA rules to get you started: https://t.co/lF9Zgsr5I1

[DFIR Training @DFIRTraining]

Finding an artifact isn't the same as investigating a case.

Join Brett Shavers for a FREE live session examining how he develops questions, tests hypotheses, evaluates evidence, and makes investigative decisions in a real, ongoing case.

Oct 28 | 3:30 PM MT
https://t.co/8cZt3cwlcS

[Belkasoft @Belkasoft]

Generic chatbots guess. In forensics, guessing destroys cases.

BelkaGPT is purpose-built for DFIR: 100% offline, directly cites source artifacts, and admits when evidence isn't found instead of hallucinating answers.

Watch the breakdown: https://t.co/6Q7sNswCDA

[DFIR Training @DFIRTraining]

Finding an artifact isn't the same as investigating a case.

Join Brett Shavers for a FREE live session examining how he develops questions, tests hypotheses, evaluates evidence, and makes investigative decisions in a real, ongoing case.

Oct 28 | 3:30 PM MT
https://t.co/8cZt3cwlcS

[DFIR Training @DFIRTraining]

How can I check my car's PHP level? Where is the dipstick?

[Belkasoft @Belkasoft]

Looking for an Oxygen Forensics alternative?

Switch to Belkasoft X without leaving your existing work behind. Match your renewal price, open .ofb images with zero downtime, add computer forensics & offline AI, and order through your existing reseller:
https://t.co/IRanbZ3SsO

[Magnet Forensics @MagnetForensics]

In this new eBook, "No surprises on the stand", you'll get a practical framework to help prosecutors and digital device examiners prepare together, identify issues early and walk into court better prepared.

Download the eBook: https://t.co/LHI6xa1zSY

[Brett Shavers 🙄 @brettshavers]

Blogs aren't long when the content is relevant, and in this case, super-revelant.

DFIR OGs who vent unfiltered, frustrated ramblings are my favorite sources of learning how to get sh*t done without needing to get another degree.

[Belkasoft @Belkasoft]

Belkasoft X v2.12 improves Android agent-based acquisition for modern Android releases. Run the agent via USB flash drives for on-site acquisitions, collect SMS and call logs, and save extracted evidence directly to custom folders.

Explore the highlights: https://t.co/UVkBFr2CRX

[Binalyze @binalyze]

Why hasn't automated triage fixed alert fatigue?

Our 2026 research found that 67% of CISOs using AI for triage still can't completely trust it. 71% believe AI should be powerful for triage but isn't being used correctly.

Read the report: https://t.co/bXR8pbDZxb

[Magnet Forensics @MagnetForensics]

Join us Oct 21 for a special replay of our #AskMeAnything session: Accelerating #IncidentResponse with digital forensics at scale. Learn how #DigitalForensics can help determine root cause, uncover the full scope of an incident, and preserve evidence: https://t.co/KkMIOc8XKt

[Magnet Forensics @MagnetForensics]

Containing a data breach is only the beginning. The bigger question is: What actually happened?

Learn how a forensic-first approach can help organizations scope breaches, guide remediation, and make evidence-backed decisions with confidence: https://t.co/MEHhL4YRDK

#DFIR

[Binalyze @binalyze]

🚨 300 potential threats ignored every day.

Our 2026 State of the SOC Report is featured in Interface Magazine, highlighting why overwhelmed SOCs need more than alerts.
They need investigative clarity.

Read the coverage 👇
https://t.co/HHwGHDXIxq

[Phill Moore @phillmoore]

Week 42 - 2026 #DFIR

https://t.co/quN4os7Qwt

[Brett Shavers 🙄 @brettshavers]

I've never publicly demonstrated a real investigation as records arrive, questions develop, and hypotheses change.

But I am this week.

Get into my head to see how I think when examining evidence, personal accounts, and events.

Challenge what I think by looking at the same evidence. That's what you should be doing at your workplace anyway.

This is how I do it and you'll see it live, for real.
https://t.co/1SlwAPTRPT #DFIR

[DFIR Training @DFIRTraining]

"It's both fascinating and a bit scary." - Brian Carrier
https://t.co/utYvg3u3QR

[Belkasoft @Belkasoft]

What is the best first step in a DFIR case?

Discover more in our article 𝐓𝐢𝐩𝐬 𝐭𝐨 𝐎𝐩𝐭𝐢𝐦𝐢𝐳𝐞 𝐃𝐅𝐈𝐑 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬 𝐓𝐢𝐦𝐞 𝐢𝐧 𝐁𝐞𝐥𝐤𝐚𝐬𝐨𝐟𝐭 𝐗 at https://t.co/WW4AAb3fUM

[ADF Solutions @adfsolutions]

🎤 Join ADF at #TechnoWest on Oct 20!
🔎 11:30 AM PDT — Live Mobile & Computer Triage with David Colvin
🎤 3:15 PM PDT — The First 60 Minutes of Digital Evidence with Richard Frawley
📍 Booth #206
🤝 Book a meeting: https://t.co/aA6mrrUNSe
#DigitalForensics

[Magnet Forensics @MagnetForensics]

The digital forensics community is coming together in San Diego for @technosecurity & Digital Forensics Conference! 🔍

📅 October 20–22
📍 San Diego, CA
👋 Come see us at booth 212!