Before we start this journey together, or even before you start reading my content, you are probably wondering…
> Who AM I?
I’m Maggie — formerly the DFIR-obsessed grad student who wrote the very first version of this page years ago, fully intending to launch a blog… and then never actually launching it.
Since then, life (and career) escalated quickly, now that I look back as I pick this blog up again.
I went from collecting triage, forensic images and mem dumps, for fun → to junior analyst → to senior → to principal/lead → to manager → and now COO of a DFIR-focused company operating in the US & LATAM.
Yes, that’s a quite a jump huh.
No, I absolutely did not plan it.
Oh yeah, I’m still processing it all.
But underneath all of that, I’m still the same person who geeked out over hex values and, solving case after case was peak joy.
Some things don’t change though.
> What is my background?
My DFIR journey didn’t actually begin in a classroom — it started on my bed, rewatching an old episode of Forensic Files.
Not just any episode, either. The one covering the first computer forensics case ever conducted.
At the time, I was deep into Computer Repair, Systems & Network Administration, trying to figure out what came next. The IT world felt huge; I felt small. I didn’t know where I fit.
Then that episode came on.
Suddenly everything I loved — computers, puzzles, justice, problem-solving, helping people — existed in one profession. I remember thinking:
Wait… that’s right! Is this still a thing?
So I started researching. Well, more like spiral-researching.
Every-tab-open researching, if you know what I mean.
Somewhere in the late-night internet rabbit hole, I discovered that my own campus offered a course called Digital Evidence — the real, modern version of exactly what I had just watched.
I enrolled immediately.
And that class didn’t just click; it lit up my entire brain. It made the massive world of IT feel focused, meaningful, and suddenly obvious.
That was the moment I knew:
This is what I want to do.
> Then what?
I finished that semester knowing:
Yup. This is it. This is the thing.
I went all-in:
- left my home country to enroll in a Digital Forensics master’s program
- discovered DFIR
- built a homelab I absolutely over-engineered
- practiced every scenario I could get my hands on
- devoured every book, webinar, blog, and tool I could find
- earned certifications (including CFCE) while juggling school and work
I wasn’t just studying the field — I was consumed by it in the best way possible. I then wasn’t feeling small anymore.
A week before I graduated grad school, I entered DFIR professionally, and started the long but predictable ladder most analysts know:
Junior → Senior → Principal/Lead → Manager.
The part I didn’t expect at all was what came after.
I found myself diving deeper into team-building, problem-solving at scale, operations, strategy, and leadership — still technical at heart, but applied through humans, processes, and decision-making instead of Timelines, EZ-Tools, X-Ways, Axiom, and Volatility.
Eventually that path led me to where I am now:
COO.
I don’t collect triages, image drives or parse logs anymore — I help guide the people who do.
Turns out your role can shift while your technical brain stays wired the same way.
> What am I currently doing?
Today, I juggle between:
- leading and scaling DFIR teams across the US & LATAM
- building operations for a fast growing company in the incident response space
- mentoring analysts and leaders
- still occasionally diving into technical rabbit holes because old habits die hard (or never die!)
The short version?
I’m in leadership now, but I’ve never stopped being a forensic nerd at the core. It’s what I truly love.
> What is the purpose of this blog?
Originally, mevsdfir was meant to be a strictly technical blog — a place to document my learning & journey in DFIR and give back to the community.
But five years passed. Life changed. I changed.
And the site never launched.
So now this space is evolving into something broader and more real, I think.
Expect a mix of:
- tech + leadership reflections
- DFIR nostalgia
- things I’m questioning or learning
- half-baked thoughts I can’t get out of my head
- occasional deep dives
- mildly sarcastic commentary about work, people, and growth
- whatever genuinely feels worth writing about
In other words, it’s still me — just updated firmware. We all know how important it is to update & apply patches!
Thanks for being here.
Let’s see what finally gets launched this time. But, it is definitely getting launched 🙂
Me vs DFIR 