Attribution is key.
PSBK Newsletter
Only that which helps you tie the act to the actor.
DFIR Investigation Resources
The only resource dedicated to DFIR casework focusing on attribution
If you can't place a person at a place and time with a device, are you really DFIRing?
Tools are just tools.
Work a case. Don't be a tool.
Tool monkey?
Put on your DFIR investigator hat. Join in the discussion of attribution and the methods to make a case. Identify the suspect. Tie the devices to the suspect. Prove the case. Tools can't do that: only you can.
