DFIR Fu

What are we doing wrong and how can we fix it? What happens when badness happens before we could fix things? Where is my data? What is important from a DFIR perspective? All these questions and more will be answered in this presentation. We will cover how the adversary compromises you, and then how to rapidly respond. This is not a “step-by-step”, but rather an overview of how we need to change the current mindset regarding acquisition and analysis of data in an investigation.