About DFIR.com
Practical training in digital forensics and incident response, with case-based learning paths and hands-on labs using SIFT Workstation. The focus is evidence you can explain, reproduce, and defend.
Rob T. Lee
Decades in DFIR. His work spans Air Force cyber operations, federal investigative and intelligence service, and Mandiant, where he helped author the first M-Trends reports. He created SIFT in 2007, coined DFIR, and pioneered timeline analysis as a forensic technique.
Chief AI Officer, Dragos. DFIR.com is independent of Dragos.
SIFT is downloaded about 60,000 times a year, as reported in August 2026,
His aim for DFIR.com: get more examiners and responders trained, sooner, on work that holds up when opposing counsel starts asking questions.
[photo: Rob T. Lee, with alt text]
Contributions to the field
- Digital forensics
Rob’s founder biography describes his work naming digital forensics and incident response.
- Threat intelligence
Included in Rob’s founder biography.
- 2007
An environment for practical forensic investigation.
- Research
A contribution documented in Rob’s founder biography.
- Community
A community forensic investigation challenge.
- Public service
Listed among Rob’s professional credentials.
Named authors. Hand verification.
Every module is written by a named practitioner who still does the work. No ghostwriting, no content farm.
Every command in every lab is run by hand on SIFT before the module ships. The verifier signs off with a date.
Where AI assisted, the module's provenance record says what it contributed and which model was used.
The first signed record publishes with module 00.
sicurity.ai
Same operator, same model, different field. sicurity.ai trains AI and ML security engineers. DFIR.com trains forensic examiners and incident responders.
Last reviewed