Forensics and investigation

Everything I've written on forensics and investigation, with the research pieces first. Each one ends with something you can do on Monday.

Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.

What's in a five-angle short

Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.

1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
4What good looks like: the result that would tell you it worked, and the number I'd watch.
5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.

Filter these articles

Research & Analysis Forensics and investigation · 17 min

Which Cloud Logs Must You Preserve Before an Incident?

Identify cloud logs needed to investigate account compromise, test collection and retention, and preserve evidence without overstating what it proves.
Short Forensics and investigation · 2 min

Chain of custody

I would not begin chain of custody by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
Short Forensics and investigation · 2 min

Cloud forensics

I would not begin cloud forensics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
Short Forensics and investigation · 2 min

Disk forensics

I would not begin disk forensics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
Short Forensics and investigation · 2 min

Don't turn it off: what to do in the first ten minutes

The instinct is to pull the plug. Sometimes that's right. Often it destroys the evidence that would tell you what happened and how far it went.
Short Forensics and investigation · 2 min

Email investigations

I would not begin email investigations by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
Short Forensics and investigation · 2 min

Forensic reporting

I would not begin forensic reporting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
Short Forensics and investigation · 2 min

Fraud evidence

I would not begin fraud evidence by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
Short Forensics and investigation · 2 min

Malware triage

I would not begin malware triage by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
Short Forensics and investigation · 2 min

Memory forensics

I would not begin memory forensics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
Short Forensics and investigation · 2 min

Network forensics

I would not begin network forensics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
Short Forensics and investigation · 2 min

Timeline reconstruction

I would not begin timeline reconstruction by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...