A lot of people in DFIR are acting like someone just created AI last week. It’s been here a lot longer than that. I know because I thought one of them sounded ridiculous. Here's my missed-the-AI-boat story.
In 2006, I had lunch with the founder of a California company. This guy flew out to meet me about a business opportunity. I wish I remembered his name. The guy called me out of the blue and flew out the following week. We spoke for about 30 minutes before I decided the idea was a bust and I've never heard from him since.
As he described it, they had built software they were pitching to the Department of Defense. The military would be able to feed data into the system, ask questions, and get answers that could help with operations. He gave me an example of feeding weather data into the system and how the military could ask the program about tactical operations and weather.
He wanted to talk about adding a digital forensics market. I told him that it sounded like science fiction. Actually, I thought it sounded like fantasy. I said “I don't see the military relying on a computer program to tell it what to do.” And certainly, no court is going to accept a Wargames software program with electronic evidence.
I thanked him for lunch and passed. That was twenty years ago...
Sitting here now, that conversation looks a lot less ridiculous than my reaction to it. I've thought about it many times since, and yes, have gone through my emails looking for that person. I was wrong about where this was going. I talked about how evidence from “thinking” software was not going to work in digital forensics.
I don’t believe I made a mistake passing on that offer since I knew nothing about AI, or whatever he called it at the time. But I am certainly curious about what happened to that company.
The public record backs up this timeline. AI-style expert systems were being applied to computer forensics by at least 2006.
That is why, for years now, I have been interested in this technology. Not casually reading a few posts. Not watching one vendor demo and pretending I understand the issue. I mean a dozen chatbots. Too many LLM subscriptions to keep track of. Multiple local LLMs running across multiple machines. Cloud models. Test data. CTF data. Forensic images. Terabytes of downloads collected and tested mostly over the past two years.
I've not (yet) changed my mind on AI touching evidence in legal cases, but some ideas I have of AI in forensics have certainly changed since 2006.
So no, AI in DFIR did not start this year.
It did not start with ChatGPT or when a vendor added an AI button. It did not start when LinkedIn discovered the topic and started beating everyone over the head with the same five posts.
The current wave is new, but the story is not.
AI does not prove who was behind the keyboard. It does not know your warrant. It does not know what you failed to collect. It does not know what alternative explanations you ignored. It does not take the stand.
You do.
That is why this matters. DFIR already has a bad habit of treating tool output like proof. AI makes that worse because AI does not just give output; it creates a story that sounds like proof.
If you are treating AI in DFIR like a new 2026 issue, you are not late to a trend. You are late to a shift that has been ongoing for years.
You do not need to become an AI researcher, worship the machine, or believe every vendor claim. You just need to understand what AI does to casework when you use it appropriately and if you misuse it.
That is why I am teaching:
AI Found It. You Prove It.
Forensics first. AI second.
