A lot of people in DFIR are acting like someone just created AI last week. It’s been here a lot longer than that. I know because I thought one of them sounded ridiculous. Here's my missed-the-AI-boat story. My first exposure to AI: 2006 In 2006, I had lunch with the founder of a California company. This guy flew out to meet me about a bu
And so, it begins... Some time ago, I wrote, “One day, you’ll be able to point AI at a forensic image and just ask AI questions about what happened on that device.” I certainly was not the only one, or the first one, to say or think this. But we are at that point now. Point and ask.The future is here (again). To be honest, I did not think I wo
If your work can end up in front of a jury, HR, outside counsel, or a regulator, this post applies to you. I’m talking to the investigators who are aggressive enough to use the LLM, but smart enough not to blindly trust it. The Critical Separation: In-the-Tool vs. Outside-the-Tool Not all “AI” in DFIR is the same. 1. In the Tool (Embedded AI) This
DFIR Is Burning People Out. Digital forensics has a burnout problem. This isn't new news, but it is important. Forensic Focus and Northumbria University are running an anonymous international well-being survey for current and former digital forensic investigators, and for people working in digital-forensic environments. If you’ve done the wor
The right DFIR resource at the right moment is worth more than ten bookmarked sites you never learned how to use. No one DFIR website does everything well. And it shouldn’t. Trying to be everything usually means becoming mediocre at all of it. The smarter move is to know what each resource is best at and use it for that purpose. That is how I look
It’s Not Artifact Worship When One Artifact Actually Changes the Case DFIR people tend to break into two religions: Some worship the artifact: “I found it, therefore it’s true.”Others dismiss the artifact: “It’s only one data point; it means nothing.” Both are lazy, or at best, rushed judgment. The DFIR investigative mindset isn’t about loving
A lot of people can “drive,” but they’re still a danger to everyone on the road. It’s the same thing in DFIR: plenty of practitioners can operate tools, generate timelines, and produce reports that look professional while still being a liability to the case. Here’s a maturity curve in three phases, using driving to separate technical operatio
If you use DFIR tools for real work, you already know the feeling: a new feature drops, a bug gets fixed, a parser improves, a workflow changes…and you only find out after you’ve wasted time doing it the old way, or worse, you just submitted a case with an outdated and buggy tool. Most people “stay current” by grazing forums, Discord servers, Linke
A new year feels like a reset. It isn’t, unless you make it. Your personal priorities (family, hobbies, leisure) are yours to define. Protect them deliberately. Those are your rules to make. But for your DFIR world….if you don’t plan your year, your casework will plan it for you. Your casework will require you to learn what you should have learned
DFIR Reflection In the early 2000s, DFIR didn’t feel like a mature, recognized field. Yes, there were a few organizations, a few tools, and a few books, but that’s not where the momentum came from. The real traction came from two channels that don’t show up in a syllabus: Grey literature: PDFs published by the people doing the work.Coffee meet