X-Ways Forensics Practitioners Guide/2E (@XWaysGuide) header
X-Ways Forensics Practitioners Guide/2E (@XWaysGuide) profile picture

X-Ways Forensics Practitioners Guide/2E

@XWaysGuide

There is no better reference for X-Ways Forensics practitioners than this guide. #DFIR #xwaysforensics

xwaysforensics.wordpress.com/
Joined April 2013
  • Tweets1K
  • Following7
  • Followers4.9K
137Media
Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)Photo by X-Ways Forensics Practitioners Guide/2E (@XWaysGuide)
X-Ways Forensics Practitioners Guide/2E retweeted
derek eiri 👻 (@MrEerie) profile picture
derek eiri 👻@MrEerieSep 30
Found Kevin S.' XWF (beta) X-Tension to load .DMG files! github.com/kev365/xways-imag…
Image from derek eiri 👻 (@MrEerie)
3
6
489
X-Ways Forensics Practitioners Guide/2E retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversSep 24
Everyone Suddenly Knew Oxygen Forensics Was Guilty brettshavers.com/everyone-su… #DFIR
Image from Brett Shavers 🙄 (@brettshavers)
5
7
4
20
4,180
X-Ways Forensics Practitioners Guide/2E retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversSep 9
AI can generate 20,000 lines of code faster than you can misunderstand the first 200.
You suck at DFIR if you’re vibe-coding forensic apps.

You suck at DFIR if you’re vibe-coding forensic apps.

Article · @brettshavers
2
3
1
13
1,258
X-Ways Forensics Practitioners Guide/2E retweeted
Phill Moore (@phillmoore) profile picture
Phill Moore@phillmooreAug 16
Week 33 - 2026 #DFIR thisweekin4n6.com/2026/08/16…
Week 33 – 2026

Week 33 – 2026

At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…

thisweekin4n6.com
14
21
1,715
X-Ways Forensics Practitioners Guide/2E retweeted
DFIR Training (@DFIRTraining) profile picture
DFIR Training
@DFIRTrainingAug 16
Writing is not what happens after the investigation. Writing is part of the investigation. linkedin.com/pulse/ai-brain-… via @LinkedIn #DFIR
AI Brain Rot

AI Brain Rot

I was once asked what advice to give to someone who wants to work in DFIR but doesn’t like writing. My answer was (and remains the same today): “Find a different job.

linkedin.com
6
11
976
X-Ways Forensics Practitioners Guide/2E retweeted
Phill Moore (@phillmoore) profile picture
Phill Moore@phillmooreAug 2
Week 31 - 2026 #DFIR thisweekin4n6.com/2026/08/02…
Week 31 – 2026

Week 31 – 2026

At Triangle Wave Security we wanted to automatically hook our spreadsheet of doom into IOC feeds and sandbox results as the incident unfolded. Bulk copy-and-paste just didn’t have the juice a…

thisweekin4n6.com
10
14
1,629
X-Ways Forensics Practitioners Guide/2E retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversAug 1
DFIR Is Drowning in Work That Does Not Matter linkedin.com/pulse/your-mass… #DFIR
Your Massive Forensic Report May Prove Absolutely Nothing

Your Massive Forensic Report May Prove Absolutely Nothing

DF/IR Doesn’t Need More Work. It Needs the Right Work.

linkedin.com
5
9
872
X-Ways Forensics Practitioners Guide/2E retweeted
Phill Moore (@phillmoore) profile picture
Phill Moore@phillmooreJul 26
Week 30 - 2026 #DFIR thisweekin4n6.com/2026/07/26…
Week 30 – 2026

Week 30 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Eoghan Casey at DFRWS Adding Clarity to a Foundational C…

thisweekin4n6.com
11
10
1,253
X-Ways Forensics Practitioners Guide/2E retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6Jul 21
amzn.to/4fcCLQf
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
3
1
7
1,245
X-Ways Forensics Practitioners Guide/2E retweeted
Phill Moore (@phillmoore) profile picture
Phill Moore@phillmooreJul 19
Week 29 - 2026 #DFIR thisweekin4n6.com/2026/07/19…
Week 29 – 2026

Week 29 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Christopher Eng at Ogmini Examining Tailscale Artifacts …

thisweekin4n6.com
10
11
1,587
X-Ways Forensics Practitioners Guide/2E retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6Jul 14
It's now on Kindle! amzn.to/4ymMjj5
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
4
10
877
X-Ways Forensics Practitioners Guide/2E retweeted
DFIR Training (@DFIRTraining) profile picture
DFIR Training
@DFIRTrainingJul 14
5 seats left, then closes forever.
X-Ways Forensics Practitioners Guide/2E (@XWaysGuide) profile pictureX-Ways Forensics Practitioners Guide/2E@XWaysGuideJul 13
You have until Friday. And only a few will be able to get it. xwaysforensics.wordpress.com… #DFIR
The X-Ways Forensics Practitioner’s Course Is Retiring

The X-Ways Forensics Practitioner’s Course Is Retiring

Retiring the practitioner’s guide? More than a decade ago, I delivered the first version of the X-Ways Forensics Practitioner’s course for $148. Since then, the course has gone through multip…

xwaysforensics.wordpress.com
1
2
1,213
X-Ways Forensics Practitioners Guide/2E retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversJun 29
SCOTUS just ruled that grabbing your Location History via geofence is a Fourth Amendment search. supremecourt.gov/opinions/25…
6
1
6
552
X-Ways Forensics Practitioners Guide/2E retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6Jun 24
In 3 hours. suspectbehindthekeyboard.com… #DFIR
🤖 Made with AI
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
4
6
494
X-Ways Forensics Practitioners Guide/2E retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversJun 23
If a suspect's laptop contains incriminating evidence, what exactly are you attributing? The answer matters. Attribution in DFIR. June 24. Live Online. 60 minutes to change your perspective of Attribution in DFIR. suspectbehindthekeyboard.com… #DFIR

Placing the Suspect Behind the Keyboard

DFIR attribution; that is the key to DFIR.

suspectbehindthekeyboard.com
1
2
4
1,064
X-Ways Forensics Practitioners Guide/2E retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversJun 15
Attribution is not just finding evidence. ↳ It is explaining what the evidence supports, what it does not support, and what alternative explanations remain. ↳ Live, online training: June 24, 1 PM MDT. $5 registration. suspectbehindthekeyboard.com… #DFIR
Image from Brett Shavers 🙄 (@brettshavers)
3
5
404
X-Ways Forensics Practitioners Guide/2E retweeted
X-Ways Software (@XWaysSoftware) profile picture
X-Ways Software@XWaysSoftwareMay 25
X-Ways Forensics 21.8, X-Ways Investigator 21.8, X-Ways Imager 21.8, and WinHex 21.8 were just released! Details at x-ways.net/winhex/mailings/.
5
7
625
X-Ways Forensics Practitioners Guide/2E retweeted
Brett Shavers 🙄 (@brettshavers) profile picture
Brett Shavers 🙄
@brettshaversMay 22
AI Found It. You Prove It. Forensics first. AI second. 90 minutes. 90-day replay. PDF edition of DFIR Investigative Mindset included. Registration closes tomorrow at the start of the workshop: May 22. 11AM Mountain time. AI can help find things. You still have to prove them. Register here: suspectbehindthekeyboard.com… #DFIR
Image from Brett Shavers 🙄 (@brettshavers)
4
5
484
X-Ways Forensics Practitioners Guide/2E retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6May 21
Want the foundation in keeping your value against AI? With your registration, you get a PDF version of my book, DFIR Investigative Mindset. Registration ends at 11AM MDT, May 22. suspectbehindthekeyboard.com…
Image from Placing the Suspect Behind the Keyboard (@PSBK4n6)
4
3
376
X-Ways Forensics Practitioners Guide/2E retweeted
Placing the Suspect Behind the Keyboard (@PSBK4n6) profile picture
Placing the Suspect Behind the Keyboard
@PSBK4n6May 21
If AI can summarize your report, draft your timeline, and explain your artifacts faster than you, how much longer will you be paid to do DFIR? 90-minute live workshop tomorrow. AI Found It. You Prove It. 11am Mountain time 90 day replay. Registration closes tomorrow. Register: suspectbehindthekeyboard.com… #DFIR
1
5
6
446
Load more