Reflections on Forensics Labbing

Lately I’ve been poking into DFIR and working on diversifying my skillset, part of that diversity is getting familiar with forensics. Working in offensive roles, I know what tracks I leave, and how to clean up my mess after, but what is interesting is all of the artifact we as attackers dont necessarily think about off-the-cuff.

Getting into things has been slow-rolling, as you step into this microculture of LEOs, Feds, and mom and pop consulting who’ve been using their tools for a very long time because they “just work”.

The very key difference with a few of these roles has a very slow to evolve component to them: The U.S. Court System. Digital forensics has the added interest solely on the process being repeatable, and having confidence in your abilities and redundancy could be the difference between missed evidence or a false ruling.

It puts you in an interesting position, being given the tools to exonerate or condemn with your tried-and-true tooling that slowly whittles away fresh blood into the field. It’s an interesting field.

I was talking to a friend who’s on the IR side of DFIR, and honestly my deepest talks on DFIR as a whole have been my ethics takes, my readiness to give my all to my work, and my dedication to knowing the tools i carry forward, back and while blindfolded. (Though I don’t suggest doing any forensic analyzing while blindfolded.)

It’s an interesting field im considering dipping my toes in, it’s a niche that is marred with LEOs, corporate interests, and nerds who are pining for new zero-days to pwn and extract data. I hope to take my hacker culture mindset with me as I explore this, and maybe leave my mark one extraction at a time.

-RW