Newsletter
This Week in 4n6
Phill Moore
Every Sunday, roughly three hundred links to the week's digital forensics, incident response, and threat intelligence posts, tools, and talks. The DFIR community's newsletter of record. Adjacent to OSINT, not about it.
Phill Moore has aggregated the digital forensics world weekly since 2016. Each issue sorts the week into forensic analysis, threat hunting and intelligence, events, presentations and podcasts, malware analysis, miscellaneous, and software releases, with a one-line description per link. It is free, with an optional sponsor slot and tip jar.
Worth it if
- You work in DFIR or threat hunting and want everything in one weekly list
- You track tool releases across the forensics ecosystem
- You want conference talks and podcasts collected for you
Skip it if
- You want OSINT tradecraft; there is almost none
- You want commentary; it is a link list by design
What is inside
- 01
Forensic analysis
The week's forensic research and write-ups.
- 02
Threat hunting and intelligence
The largest section, often well over a hundred links.
- 03
Events, talks, malware, miscellaneous, releases
Upcoming webinars, presentations and podcasts, malware analysis, odds and ends, and tool updates.
What you will be able to do
- Follow the DFIR ecosystem without reading forty blogs
- Catch tool releases the week they ship
- Find recorded talks you would otherwise miss
How current it is
Active and weekly, with Week 41 of 2026 published on 11 October 2026.
- Updated
- Week 41, 11 October 2026
- Maintained
- Actively maintained
How to get the most from it
- 01
Search the archive before you research a tool
Ten years of weekly links is a surprisingly good index of the field.
- 02
Read the releases section first
It is short and immediately useful.
Strengths
- Comprehensive
- Reliable for a decade
- Free
Limitations
- DFIR, not OSINT
- No editorial filter
- Volume
Pair it with
FAQ
Questions, answered
Why is a forensics newsletter listed under OSINT?
Because threat-intel and investigation readers use it, and because it is honest to say it is adjacent. It teaches no OSINT.
Is there an RSS feed?
The site is WordPress, so the standard feed path should work, though the page does not advertise one.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days