About This Blog

Thank you for stopping by my blog! I am Damien Attoe an avid Digital Forensics Practitioner, Researcher and Teacher.  

My DFIR Career

I started my Digital Forensics career in 2010, where I was fortunate enough to get an internship at NW3C while I was in college. Since then, my passion for digital forensics has grown exponentially. From 2012 - 2017 I worked as a forensic consultant at AccessData (now Exterro), before moving to my current employer Spyder Forensics at the beginning of 2018. 

For the bulk of my career I focused on corporate investigations and eDiscovery, but over the past few years I have transitioned into a part-time trainer for Spyder where I teach the Advanced Database Forensics and Dark Web Forensics courses. That being said, I still manage a professional services team and do investigations for a select few clients. 

While I have been in the background for 15 years just watching things going on in the industry, I decided that 2025 was the year that I wanted to be a contributor vs a watcher. I created this blog as an area where I can post my own personal research and other insights that I believe might be useful to the DFIR community.

Blog Content

Over the years I have done a lot of different types of examinations, but my main area of focus for the last 5 years has been Database Forensics and Artifacts associated with the use of Dark Web applications. Expect to see a lot of database related content like SQLite, LevelDB etc... and privacy related apps.

Just to be clear: This is a PERSONAL blog and doesn’t not necessarily represent the opinions of my employer.

Whilst I enjoy deep diving into artifacts to figure out the inner workings of an application, I understand that there are varying levels of technical expertise. I want this blog to be place where all can take some new knowledge and apply it to their examinations, so I will attempt to present it in a way that everyone regardless of experience can learn.

During my research I will primarily use open-source tools, or python scripts that I write to convey concepts and ultimately produce a meaningful output. I will upload any code or queries that I write to the Digital4n6withDamien repository on the Spyder Forensics GitHub which is where I upload some of the code I developed at work. I got permission to do so, so It’s easier than managing 2 GitHub accounts.

Disclaimer: Just because something is published online doesn’t make it accurate. You should ALWAYS validate the accuracy of the information I provide, and if I get something wrong, please don’t hesitate to reach out to me on social media and let me know so I can correct it.

What you won’t find here:

• I will not be posting any research conducted in-house at Spyder Forensics. That material goes into courses, presented at conferences or published on the Spyder Forensics articles page. 
• I will not endorse, criticize or compare any commercial tools. All tools have their strengths and weaknesses, but the purpose of my content is to educate and go beyond the tool's capabilities. 
• I will not post or share any material related to techniques, exploits, or other mechanisms that could undermine law enforcement's ability to combat crime or put the general public at risk of compromise.