Opening the case file
Why I'm starting a DFIR blog, and what's coming next on the road to GCFA.
Every investigation starts the same way: you open a case, write down what you know, and start documenting everything. This blog is that, applied to my own learning.
Why write in public?
I work in security, and the part of the job that pulls at me most is digital forensics and incident response: reconstructing what actually happened on a box from the traces left behind. I’m now working toward the GCFA (SANS FOR508), and the fastest way I know to really learn something is to explain it.
So the things I study, the CTFs I play and the investigations I practice will end up here as write-ups.
What to expect
- Write-ups on what I’m working through: CTFs like HTB Holmes, tools I’m testing, and lessons from the road so far.
- A GCFA write-up once I’ve passed, covering how I studied and what actually mattered on the exam.
- A cheat sheet of the FOR508 concepts I keep coming back to, searchable like an index.
- Interactive bits: timelines you can filter, flashcards, and small tools when they help explain something.
Status
Case is open. Evidence is being collected. Next up: a write-up on finishing my degree at WGU.