Brendon Roberts · via linkedin
🎓 milestoneGraduated: B.S. Cybersecurity & Information Assurance
- school
- Western Governors University
- conferred
- 2026-09-29
- while working
- full-time SOC
Brendon Robertscybersecurity analyst · DFIR// digital forensics · incident response · write-ups
Learning DFIR in public, one artifact at a time.
I’m Brendon, a cybersecurity analyst working in SOC operations and incident response. I’m going deeper into forensics and working toward the GCFA. Here I write up what I study, the cases and CTFs I work through, and what I learn from them.
analyst@sift: ~/casefiles
latest write-ups
all write-ups →GCFA notes: evidence of execution
Prefetch, Amcache, Shimcache, BAM and UserAssist. What each proves, where it lives, and how they fit on one timeline.
Opening the case file
Why I'm starting a DFIR blog, and what's coming next on the road to GCFA.
recent posts
all posts →Brendon Roberts · via linkedin
🚩 ctfFirst CTF: Hack The Box Holmes CTF 2026
- team rank
- 476th / 5,637
- solved
- 42 / 111
- points
- 3,925
- dates
- Sep 17–21, 2026
Brendon Roberts · via linkedin
🛡 certificationPassed the ISC2 SSCP
- exam passed
- 2025-12-27
- cert
- Systems Security Certified Practitioner
currently studying
full journey →GCFA · SANS FOR508: Advanced Incident Response, Threat Hunting & Digital Forensics15% overall