Ask AI. Then Ask the People Doing the Work.

I was browsing the Forensic Focus forum today and came across a question from a college freshman interested in becoming a computer forensic examiner.

The student was interested in traditional forensic work. The question was about what education, certifications, and experience would help get a job doing that work. That’s a reasonable question from someone trying to figure out a career path. A month after posting, there were still no replies.

Read the student’s question on Forensic Focus.

This got me thinking about how much things have changed in this field, especially how we find information and who we ask for help.

Ten or fifteen years ago, you’d post a question on the forum and soon enough, you’d get five different opinions. Today, you can ask ChatGPT and get a fairly decent answer in less than a minute. It can explain the terminology, suggest degrees and certifications, and give you a career path to consider. That’s useful for someone just starting out.

But getting an answer from ChatGPT isn’t necessarily the same as getting the right answer.

The Difference Between AI and Experience

ChatGPT doesn’t have firsthand experience working a criminal case.

An examiner working at a state agency might tell that freshman that a particular certification isn’t nearly as important as people think. Another examiner might completely disagree. Good, because that’s the kind of discussion I want to read.

An AI model can generate an answer based on the data it was trained on and the information it is given. In a public discussion, people can question the answer, provide evidence, and work through the disagreement. Other people get to learn from that exchange, directly from the people contributing to it.

I Miss the Old Forums

I’ve been around Forensic Focus for a long time. In my opinion, it has been the best dedicated digital forensics discussion forum on the Internet. Really, I can’t think of another public forum quite like it.

To be honest, I haven’t posted on Forensic Focus in a long time, other than today. I’m guilty of what I am now typing, but I’m willing to both admit and correct that. I’d forgotten why I used forums in the first place, given the rise of social media. Personally, I don’t think social media pushes DFIR ahead as much as we’re led to believe.

I’d rather see an engaged technical disagreement where people explain their positions than a hundred posts where everyone agrees with each other. The important part was that the conversations were public. Someone could find a discussion years later and learn something from it.

Finding an answer buried in a chat channel from six months ago is a different experience from finding a public forum thread where someone described a problem, several examiners offered solutions, and the original poster came back with what actually worked.

Try finding a LinkedIn post or X post from six months ago that you remember seeing.

What Makes a Forum Worth Returning To?

AI adds another reason why someone might not bother posting a question. If you need to know the difference between a physical acquisition and a logical acquisition, an LLM can probably give you a good explanation in seconds. A forum question might go unanswered because it has been “asked and answered” a dozen times before.

The real value of public forums has changed, and maybe we just haven’t recognized it yet.

We should still answer the beginner questions. But a forum’s value goes well beyond recommending someone’s first certification. It gives us a place to discuss what happens next: what someone encountered in real casework, what they tried, and what they learned.

Of course, asking people to do your homework assignment for you should still be called out.

Why This Matters to DFIR.training

I’ve spent a lot of time building DFIR.training to make resources accessible. Training, tools, events, books, and other information that help people learn and do their jobs without having to spend weeks figuring out where to look.

But a directory of resources and training events isn’t a substitute for a conversation with someone who is actually doing the work. And neither is an AI model. DFIR.training serves one purpose. An engaged forum serves another.

The point is to help people become better at what they do. I think we need more public discussions where experience and knowledge can be challenged, not fewer. By more, I don’t mean more social media platforms where posts are buried ten levels deep in ten minutes, never to be surfaced again.

Those of Us Doing the Work Need to Participate

If a student asks a question and nobody responds, we shouldn’t be surprised when the next student doesn’t bother asking. If an examiner posts a technical question and gets no useful response, they’re probably not going to return. Both may start asking an LLM for everything. If those exchanges never make it back into public discussion, the rest of us lose the opportunity to learn from them.

Forums don’t stay useful just because they have years of archived posts. They stay useful because people participate. That means answering questions, sharing experiences, correcting mistakes, and occasionally admitting that someone else knows something you don’t—which seems to be me most of the time.

We don’t need to abandon AI or pretend we’re going back to how the Internet worked fifteen years ago. Use AI. I do. It can save an enormous amount of time, but check the source.

Sometimes that source is someone who’s been doing the work for twenty years and might tell you that you’re asking the wrong question.

That might be the most useful answer you get.