Placing the Suspect Behind the Keyboard: DFIR Investigative Mindset

by Brett Shavers, Lee Harris (editor)

The DFIR Investigative Mindset guides the practitioner in thinking, acting, and solving computer crimes and computer-facilitated crimes like a cybersecurity sleuth. This book takes you on a journey beyond mere tools and techniques, delving into the very essence of investigative work.

The book is written by Brett Shavers, a former law enforcement officer and a veteran DFIR practitioner. He shares his insights and experiences working on various cyber cases, ranging from hacking to espionage to terrorism. He also provides tips and techniques for developing and improving your investigative skills, such as critical thinking, problem-solving, data analysis, evidence correlation, and cognitive skill building.

“When your brain is turned into an investigative mindset, you see everything differently. Distractions are blocked, attention is focused on seeing (and observing!) evidence, and inferences scream out to you.” — Brett Shavers

Why This Book Matters:
Digital forensics isn’t just about analyzing data; it’s about thinking like an investigator. Shavers reveals how the DFIR mindset goes beyond technical skills, emphasizing the importance of understanding motivation, attribution, and the human element behind cyber incidents. Whether you’re a law enforcement professional, a corporate security analyst, or a curious enthusiast, this book will transform how you approach investigations.


Whether you are a newcomer to the field or an experienced forensicator, developing a DFIR investigative mindset will propel your skills exponentially and give you an edge over opposing experts and competitors in the job market.

231 pages, Paperback

First published March 22, 2024

About the author

I've had a fantastic career in law enforcement, starting in a municipal police agency (Renton WA PD) where I took on various roles. I was selected for detectives, later assigned to a state (VNET) task force, and then recruited to a federal (DHS) task force. Along the way, I was appointed as a bicycle patrol officer, SWAT officer, use-of-force instructor, undercover officer, and computer forensics examiner.

My cases spanned coast-to-coast in the USA. I even ventured outside the USA, working undercover and infiltrating international organized crime rings for various alphabet agencies in foreign countries. I’ve bought, sold, and seized tons of drugs, along with seizing hundreds of illegal firearms. I smuggled bulk currency across borders and assumed undercover roles as a drug trafficker, drug manufacturer, arms trafficker, human trafficker, and hit man. But rescuing children from trafficking after witnessing their tragedies made me cry. That changed me more than anything else I’ve ever done.

I’ve also been an adjunct instructor at the University of Washington’s Digital Forensics Program, qualified in courts as an expert witness, appointed as a Special Master, and consulted on digital forensic at every court level. I speak at lots of conferences, write blogs on digital forensics (www.brettshavers.com and www.dfir.training), am an honorary life member and former President of the Computer Technology Investigators Network (https://ctin.org/), and am a founding member of DFIR Review (https://dfrws.org/dfir-review/). I have worked on all kinds of criminal and civil cases, from harassment to national security matters. Of all my training and experiences, my most effective “teachers” have been those I wined and dined with while undercover.

And long, long ago, I served as an active-duty Corporal of Marines (I was in 2/3, for you Devil Dogs out there wondering). Now, I am but a humble member of the Marine Corps League and the Marine Corps Cyber Auxiliary.
You can find me rambling away at www.brettshavers.com.