Investigative Decision-Making in DFIR: Defensible Conclusions & Attribution

What & Why

A DFIR case can fail even when the forensics are technically correct because the decisions, wording, and attribution logic weren’t defensible. This live session is about keeping your conclusions tied to what you can actually prove and avoiding the report language that folds under challenge. How to climb the attribution ladder with a CASEWORK mindset to keep your case from going off the rails.

We’ll walk through a recent public case where the wording in a DF report/testimony made an attribution claim stronger than the underlying evidence supported.

When & Where

  • DATE: Thursday, February 5, 2026
  • TIME: 11 AM  (Pacific time)
  • VENUE: Live, online
  • 24-hour replay.

Who

  • Brett Shavers to discuss how good forensics can lead to a bad case

  • For anyone who needs to defend attribution claims to leadership, counsel, clients, or court

  • Live attendance is capacity-limited (Zoom). Register early as live seats go to the first attendees who join.
    All registrants get the 24-hour replay. If the live room is full when you join, you’ll still receive the replay link by email.