We Didn’t Start DFIR


I started this back in April and hoped to have it finished for the 4:cast Awards last month. Sadly, life got in the way. This evening I had the time to finish it off. Hope you enjoy it.

Lyrics below:

Harlan Carvey, EnCase, Cellebrite, X-Ways

Champlain, Huber, Exiftool, Ultradock 5

Sysinternals, Paraben, tools from Eric Zimmerman,

iLook, Ackerman, Registry Hives

Elcomsoft, Helix3, Andrew Case, and WinFE

Teel Tech, Mandiant, and then Volatility

Sarah Edwards, Blacklight, imaging with Insight

Santiago, TZWorks, Jonathan Zdzjarski

We didn’t start the fire

It was always burning, since the world’s been turning

We didn’t start the fire

No, we didn’t light it, but we tried to fight it

Log2timeline, Oxygen, Photorec, and Ken Johnson

13Cubed, David Kleiman, Julie Amero

SOF-ELK, Sumuri, Macquisition, Hardcopy

Paladin, SRUM DUMP, Triforce, APOLLO

Larry Daniel, Anthony, acquitted and she walks free

Ovie Carrol, Cyberspeak, and Heather Mahalik

NetWars, CTFs, Jadsoft and IEF

Logicube, Wiebetech, Alejandro Perez

We didn’t start the fire

It was always burning, since the world’s been turning

We didn’t start the fire

No, we didn’t light it, but we tried to fight it

F-Response, SIFT Kit, DumpIt, DFIR Fit,

Jess Hyde, Drive Prophet, Guidance bought by OpenText

AXIOM, Andrew Hoog, Katana’s not very good,

Social Experiment, SQLite Forensics

AccessData, FTK, Paladin, and then there’s Kape

Belkasoft, iLEAPP, HB Gary gets hacked

Don’t forget Brian Moran saying, “who the f*** is Lance?”

Can’t believe it’s Summit time, please submit your abstract

We didn’t start the fire

It was always burning, since the world’s been turning

We didn’t start the fire

No, we didn’t light it, but we tried to fight it

Write Block, Hagen, Cindy’s in a string band,

Shavers, Austin, Kristinn Gudjonsson,

Mark McKinnon is a tool, Photoshopping Lee is cruel.

Backtrack, Gray Key, goodbye to  John McAfee,

Knoppix, XRY, ransomware will make you cry,

DFIR Discord, Clippy won’t win an award.

We didn’t start the fire

It was always burning, since the world’s been turning

We didn’t start the fire

No, we didn’t light it, but we tried to fight it

Challenge coins, Pomeranz, Why not take a class with SANS?

Magnet, Logicube, RegRipper, EnFuse

Brian Carrier, he has really awesome hair,

Larson, lab coat, Don’t forget to place your vote.

Ryan Benson, Troy Schnack, parsing mork with CacheBack

Don’t forget Rob Lee, He’s the DFIR Daddy

Weekly blog by Phill Moore, how do you say Plaso?

Forensic Lunch, Inside the Core, I can’t take it anymore

We didn’t start the fire

It was always burning, since the world’s been turning

We didn’t start the fire

But when we are gone

It will still burn on, and on, and on, and on, and on, and on, and on, and on

We didn’t start the fire

It was always burning, since the world’s been turning

We didn’t start the fire

No, we didn’t light it, but we tried to fight it

We didn’t start the fire


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.