In this webinar series, we’ll have experts bringing their extensive knowledge of the enterprise DFIR space to you! Join us as we identify notable trends in cybercrime, internal investigations, incident response, eDiscovery support, as well as the digital transformation impact on DFIR. We’ll also share valuable tips on how examiners can help protect organizations from damage.

Register for upcoming webinar

Upcoming live webinar

S3:E5 // What to expect when you’re (not) expecting an incident

Every organization has an incident response plan and almost none of them survive contact with a real incident intact.

In this panel, presenters Doug Metz, Jeff Rutherford, and Steve Gemperle will engage in a conversation that covers their combined field experience — across Private Sector, the FBI and the Secret Service — to investigate the gap between “we have a plan” and “we’re ready,” and what actually happens in the first hours of a real one.

Register now

Season 3

On Demand Webinars

On Demand Webinars

S3:E1 // Cyber Unpacked Are you DF, IR, or both? Navigating the overlap between forensics and incident response

Digital forensics and incident response often overlap in practice but differ in intent: DF emphasizes preservation and prosecutorial defensibility, while IR prioritizes speed, containment, and recovery.

About a 1 minute view

February 26, 2026 • About a 1 minute view

hidden

Read More

On Demand Webinars

On Demand Webinars

S3:E2 // IR Beyond Malware: Investigating Business Email Compromise and Fraud

While ransomware grabs headlines, business email compromise (BEC) quietly causes billions in losses every year. For private sector responders, these cases present unique investigative hurdles: social engineering, subtle logins, wire transfers, and abuse of legitimate SaaS features. This presentation dives into the forensic artifacts and investigative playbooks for BEC cases, including Office 365 sign-in logs, forwarding rules, OAuth abuse, and transaction metadata. We’ll explore how to triage compromised accounts, correlate access patterns with financial events, and present findings in a way that supports both containment and legal/regulatory needs. Whether you work in corporate IR, legal, or compliance, this session will equip you with the tools to tackle one of the most common—and costly—forms of corporate compromise.

About a 0 minute view

May 7, 2026

ai , cloud , computer , media , mobile , mtv-africa

Read More

On Demand Webinars

On Demand Webinars

S3:E3 // The burnout equation: Sustaining your SOC and IR teams for the long game

SOC and incident response teams are trained to run toward the fire—but living in constant escalation has a cost.

About a 0 minute view

June 4, 2026

ai , cloud

Read More

On Demand Webinars

On Demand Webinars

S3:E4 // Living off the land: Investigating attacks that leave no malware behind

Modern attackers increasingly rely on tools already present on the systems they compromise — PowerShell, WMI, scheduled tasks, RDP, and other built-in utilities that blend into normal administrative activity. This episode works through the LOLBin problem in three layers: the detection foundation (baselining tool usage and building appropriately scoped alerts), filtering legitimate from malicious usage by parent process, argument structure, and behavioral context, and the forensic reconstruction — the host artifacts that survive when SIEM telemetry is gone. Covers PowerShell ScriptBlock logs, WMI event subscriptions, scheduled task XML definitions, Shimcache, Amcache, prefetch, and RDP/SMB lateral movement artifacts, with Magnet Axiom Cyber for endpoint artifact analysis and Magnet Nexus for enterprise-wide scoping.

About a 0 minute view

July 16, 2026

Read More

Season 2

On Demand Webinars

On Demand Webinars

S2:E1 // Exploring IOCs: Enhancing threat detection and forensics

In this episode of Cyber Unpacked, we explore the critical role of indicators of compromise (IOC’s) in DFIR, focusing on integrating detection rules and frameworks such as YARA, Sigma, and MITRE ATT&CK.

About a 0 minute view

March 17, 2025

computer , corporate , magnet-axiom-cyber

Read More

On Demand Webinars

On Demand Webinars

S2:E2 // The insider threat playbook: A case study in sensitive data exfiltration

Insider threats, particularly those involving intellectual property theft, pose a substantial financial risk to organizations.

About a 0 minute view

May 22, 2025

computer , corporate , magnet-axiom-cyber , magnet-nexus

Read More

On Demand Webinars

On Demand Webinars

S2:E3 // When updates turn rogue: The forensic trail of a supply chain attack

Supply chain attacks are among the most dangerous threats in modern cyber operations — not because they exploit software flaws, but because they exploit trust.

About a 0 minute view

August 28, 2025

cloud , computer , magnet-axiom-cyber , media

Read More

On Demand Webinars

On Demand Webinars

S2:E4 // Voices from the field: Trends, challenges, and what’s next in DFIR

Digital Forensics and Incident Response (DFIR) has evolved rapidly from purely reactive investigations to incorporating proactive approaches that utilize cloud-powered forensics and AI. But while the tools and techniques may have advanced, so too have the complexities: hybrid and remote workforces, supply chain compromises, expanding attack surfaces, and the increasing pressure to collect evidence before it disappears.   In this special episode of Cyber Unpacked, hosts Doug Metz, Senior Security Forensics Specialist, and Jeff Rutherford, Forensic Consultant, bring together a panel of DFIR leaders to explore the state of digital investigations today. We’ll unpack some of the top challenges investigative teams face, from AI’s opportunities and risks to common pitfalls they’ve overcome. They’ll also share how different organizations are adapting, why celebrating internal wins matters, and what trends DFIR leaders should be paying attention to next.   Join us for what’s sure to be a lively discussion on where DFIR is headed, and how you can equip your team to respond with speed, accuracy, and confidence in an ever-evolving technological landscape.

About a 0 minute view

October 9, 2025

Read More

On Demand Webinars

On Demand Webinars

S2:E5 // A Tale of Two Timelines

In digital investigations, time isn’t just a factor — it’s the framework that holds the story together. In this episode, A Tale of Two Timelines, our hosts explore how timeline analysis serves as the backbone of both Incident Response and Digital Forensics. From the urgency of containment to the precision of post-mortem analysis, timelines illuminate what happened, when, and how. On the IR side, Doug demonstrates a streamlined workflow that transforms triage collections into unified, event-driven timelines — automating artifact extraction and correlation to reveal patterns of compromise and recovery. Then, shifting to the forensic lens, Jeff highlights advanced case analysis workflows that visualize activity chronologies, isolate pivotal moments, and export structured data for cross-case correlation. The result: a single cohesive view that bridges rapid response and in-depth examination.   By combining real-time event triage with deep forensic correlation, A Tale of Two Timelines shows how investigators can achieve a clearer picture, faster — and gain a decisive investigative edge.

About a 0 minute view

December 4, 2025

computer , magnet-automate , magnet-axiom , magnet-axiom-cyber , media , mobile

Read More

Season 1

On Demand Webinars

On Demand Webinars

S1:E1 // From zero to YARA hero: Detect malware like a pro

Staying ahead of emerging threats poses a significant challenge for digital forensics and incident response (DFIR) teams.

About a 0 minute view

May 31, 2024

computer , corporate , magnet-axiom , magnet-axiom-cyber , magnet-nexus

Read More

On Demand Webinars

On Demand Webinars

S1:E2 // Uncovering the unseen: Mastering mobile data for internal investigations and eDiscovery

In today's digital landscape, mobile data plays a critical role in internal investigations and eDiscovery.

About a 0 minute view

June 17, 2024

cloud , corporate , mobile

Read More

On Demand Webinars

On Demand Webinars

S1:E3 // Bridging the Gap: Integrating MITRE ATT&CK with Magnet Axiom Cyber

The MITRE ATT&CK framework has been integrated into Magnet Axiom Cyber to help analysts better detect and understand cyber threats.

About a 0 minute view

August 13, 2024

cloud , computer , corporate , magnet-axiom-cyber , mobile

Read More

On Demand Webinars

On Demand Webinars

S1:E4 // Return of the AI: A new hope (or a new threat)

Join Magnet’s Doug Metz, Senior Security Forensics Specialist, and Joe Pochron, Managing Director of Nardello & Co.’s Digital Investigations & Cyber Risk practice, for an in-depth discussion on the impacts of Artificial Intelligence (AI) on cyber investigations within the private sector. We’ll delve into how threat actors are leveraging AI to craft more sophisticated phishing campaigns, the growing necessity for detecting AI-generated images or deepfakes, and the pros and cons of AI-assisted report writing. Also, we’ll explore how Magnet Copilot, an AI-powered tool integrated into Magnet Axiom and Axiom Cyber, enhances your ability to efficiently analyze and interpret vast amounts of digital evidence.

About a 0 minute view

October 11, 2024

corporate , fraud , mobile

Read More

On Demand Webinars

On Demand Webinars

S1:E5 // Forensics in the Cloud: Risks, rewards, and realities for businesses

As DFIR leaders face increasing data volumes, complex infrastructure, and increasing pressure to deliver results faster, many are considering the move to cloud-based forensics solutions. But what does a migration to the cloud look like? Join Doug Metz and Jeff Rutherford for a session designed for leaders looking for real insights and considerations when planning their move to the cloud. This high-level overview won’t just outline the benefits of cloud adoption; we’ll provide a balanced perspective, exploring both the potential advantages and the essential components that may be better suited to remain on-premises. From scalability and collaboration to regulatory considerations and data security, we’ll dive into the practical realities, risks, and rewards of moving your lab to the cloud.

About a 0 minute view

November 22, 2024

cloud , computer , corporate

Read More

Report

2026 State of Enterprise DFIR Report

Exclusive data and insights
Gain access to comprehensive data and expert analysis on the current state of digital forensics. 

Benchmark your performance
See how your investigative strategies and practices compare to your peers. 

Actionable takeaways
Leverage key findings to enhance your processes today and plan for the future. 

Download the report

Related resources