I just went through 400 DFIR books spanning 46 years to get some stats on where we came from, where we are, and maybe some ideas on where we are going. This wasn’t easy. Some books that I have are no longer in print. Some books that I used to have, I can’t find online anymore (and don’t really remember much about them...which doesn’t help looking for them).

Digital evidence is now part of nearly every investigation. The problem is no longer whether the evidence exists. The problem is whether agencies can collect, process, analyze, share, and explain it fast enough to keep a case moving. Magnet Forensics is asking public safety professionals to share where those processes are working—and where they are...

If your work can end up in front of a jury, HR, outside counsel, or a regulator, this post applies to you.

I’m talking to the investigators who are aggressive enough to use the LLM, but smart enough not to blindly trust it.

The Critical Separation: In-the-Tool vs. Outside-the-Tool

Not all “AI” in DFIR is the same.

1. In the Tool (Embedded AI)

This is built into your forensic products (think ranking, labeling, or grouping data). It’s under the vendor’s control. It’s great for speed, but the risk is passive over-trust. Just because the tool labeled it "Highly Relevant" doesn’t mean it’s your smoking gun. It points to clues. That is all it does insofar as it affecting your investigation. 

2. Outside the Tool (The Practitioner’s LLM)

This is a large language model such as ChatGPT, Gemini, or Claude used outside the forensic product. You direct it. You decide the task. It can help organize notes, compare theories, draft questions, improve report language, or assist with scripting. The risk here is active overtrust. It looks right, sounds right, and will fool you if you let it.

DFIR Is Burning People Out. 

Digital forensics has a burnout problem. This isn't new news, but it is important.

Forensic Focus and Northumbria University are running an anonymous international well-being survey for current and former digital forensic investigators, and for people working in digital-forensic environments. If you’ve done the work, this applies to you.

The early data is ugly. In the first 80 completed responses, 36% said they were likely to leave the profession within 12 months. Another 20% were unsure. Nearly half had more than 10 years in the field. That means experienced people are looking for the door.

It’s not just traumatic material. Backlogs, time pressure, poor management support, and work-life strain are all hitting hard. Nearly 90% also reported no structured psychological supervision, or only getting it on an ad hoc basis. That's not support.

The survey is anonymous. No name. No employer. No identifying information. It takes about 30 minutes. IP tracking and cookies are disabled. You can finish it during a lunch break. No excuses.

 DFIR people tend to break into two religions:

• Some worship the artifact: “I found it, therefore it’s true.”
• Others dismiss the artifact: “It’s only one data point; it means nothing.”

Both are lazy, or at best, rushed judgment.

The DFIR investigative mindset isn’t about loving or hating artifacts. It’s about using them correctly: an artifact is a clue, not a conclusion. Most single artifacts should change your questions, not your verdict. But there are special situations where one well-verified data point can genuinely teach you a lot because it changes what’s possible, what’s plausible, or what hypotheses you even need to consider.

If your goal is to do defensible DFIR, not just produce output, you need to know the difference.

Two mindset rules before we start

1) It proves a capability exists (kills “that can’t happen”)

One verified artifact can destroy an absolute claim like: “That system can’t do that,” “that user couldn’t have done that,” or “that control would have blocked that.”

A lot of people can “drive,” but they’re still a danger to everyone on the road. 

It’s the same thing in DFIR: plenty of practitioners can operate tools, generate timelines, and produce reports that look professional while still being a liability to the case.

Here’s a maturity curve in three phases, using driving to separate technical operation from investigative competence. In practice, there are blurred lines, not clear-cut distinctions in these phases. But generally….

Phase 1 – Tactical:   “I Never Crashed, Therefore I Can Drive”

These folks can run the tools. They can pull data. They can spit out timelines that look like museum exhibits or the printout of the moon landing log from a NASA printer. But they confuse motion with skill. Their core belief is usually: “If I collect more, I’ll be safer.” 

Reality: Collecting more usually means more artifacts you didn’t validate, more assumptions you didn’t justify, and more claims you can’t defend. Adding hay doesn’t help you find the needle. It just gives you more hay to explain.

If you use DFIR tools for real work, you already know the feeling: a new feature drops, a bug gets fixed, a parser improves, a workflow changes…and you only find out after you’ve wasted time doing it the old way, or worse, you just submitted a case with an outdated and buggy tool.

Most people “stay current” by grazing forums, Discord servers, LinkedIn posts, X threads, and whatever community happens to mention tool updates or changes. That approach fails for one simple reason: it’s scattered. You will miss things, and you won’t even know what you missed. And if you do see something important, if you don't screenshot it, bookmark, or otherwise save it on the spot, you will have to scroll for a long time to find it.

Case in point, I just spoke to someone who is 2 versions behind in updates in a tool and he never knew (ergo, inspiration of this post).

My fix is boring but effective: subscribe to updates directly from the tool developers you actually use. Newsletters, release emails, events, and vendor update channels are the closest thing to “first notice” you can get without living online. 

Why newsletters beat the scavenger hunt

Vendor updates (email newsletters, release notes emails, product update blasts) win because:

A new year feels like a reset. It isn’t, unless you make it.

Your personal priorities (family, hobbies, leisure) are yours to define. Protect them deliberately. Those are your rules to make.

But for your DFIR world….if you don’t plan your year, your casework will plan it for you. Your casework will require you to learn what you should have learned yesterday, but under greater time pressure, emergency budgeting, and painful failure points.

We work under rules, regulations, laws, requirements, and expectations, and the reality that your work may be reviewed later (by management, auditors, regulators, opposing counsel, or a jury).

Q: What do you need to be able to do by the end of this year? To develop an answer, make a workable DFIR plan.

In the early 2000s, DFIR didn’t feel like a mature, recognized field. Yes, there were a few organizations, a few tools, and a few books, but that’s not where the momentum came from. The real traction came from two channels that don’t show up in a syllabus:

• Grey literature: PDFs published by the people doing the work.
• Coffee meetups: small, informal circles comparing notes on real cases, real artifacts, and real constraints.

That combination, informal “oral tradition” plus written, shareable documentation, is a big reason DFIR became a repeatable investigative discipline instead of a pile of one-off heroics.

The coffee meetings were DFIR’s first scaling mechanism

Before “monthly chapter meetings” were common (or even available locally), a lot of learning happened in tiny groups:

• 3–5 people over coffee from different organizations
• lunch meetings when a weird case was assigned
• ad-hoc gatherings when a new tool showed up, or an old tool failed in a new way

Those meetups mattered because DFIR wasn’t born in a classroom. It was born when devices started showing up from scenes, desks, and evidence rooms, sometimes from situations you don’t forget but want to. People had to improvise, then compare notes, then tighten the approach into something repeatable.

I occasionally see online comments and posts co-mingling bootable forensic OSs and forensic virtual machines as if they’re the same thing. But recently, I reviewed an expert report that did exactly that (described a workflow that wasn't what it proclaimed to be). They’re not the same. Therefore, this post.

A bootable forensic OS is not a forensic virtual machine.
A forensic virtual machine is not a bootable forensic OS.

They solve different problems, have different risk profiles, and belong in different categories on your tools list and in your SOPs. Calling them both “VMs” is a bad mental model.

The concepts here are basic, but getting the terms and definitions right is not.

This post is going to:

Yesterday’s release of the free forensic test images and CTFs took off fast.  Downloads, shares, and discussions across social media haven’t slowed down. Over 38,000 views in just 2 days. Goodness.

That tells me something important: practitioners don’t just want datasets to play with; they want real data to practice on and tools to make sense of it.

TERABYTES OF FORENSIC TEST IMAGES
HUNDREDS OF CTFs

https://t.co/dsUPfRNMxH #DFIR #CTF pic.twitter.com/Su4YFzbWAf

— DFIR Training (@DFIRTraining) October 23, 2025

So let’s talk about the next step. You have access to a universe of data, but now what? How to access it? For tools you don’t have, there are free and free-for-a-time-limit tools you can use.

Every few years, we declare digital forensics dead. Each new technology was supposed to end investigations forever. None did. They just changed where the evidence lived and how examiners had to think.

But AI is different. It’s the first to challenge both the evidence and the examiner.

1991–Late 1990s – The First Encryption Panic

When Phil Zimmermann released PGP (Pretty Good Privacy) in June 1991, the forensic evidence forecast was simple:

Somewhere between certification badges, shiny dashboards, and endless webinars, the DF/IR mission got lost. We built an industry obsessed with what a tool can do instead of what a case requires. Now, we measure competence by how many tools we can operate instead of how well we can tell the story they uncover. Scroll any job posting and you'll see a...

First off , thanks again for being here. The newsletter you just read is meant to be quick. Headlines only. 

This blog? This is where I slow down.

Why a Newsletter Now?

I sat on this for a long time, and have sent very few newsletters out. There are already a dozen DFIR mailing lists spitting out every webinar, press release, or a recycled article of a recycled article. I didn’t want to add noise.

But here’s the problem:

PSBK Vol. 3 Update: The Casework Book I Wish Existed

This volume has been the hardest thing I’ve written because it’s not a “how to click” book. I have learned that it is much easier to write ‘how to run a tool book’ than it is to write ‘when and why (or if)’ to use a tool or ‘which tool is best to use in a million different situations.’ It’s also taking me longer to write this book than working a string of cases…because it’s harder than working a string of cases..

So, DF/IR Investigative Strategies (ie: volume 3 of Placing the Suspect Behind the Keyboard) is a how to work a case book, from event to adjudication, using whatever tool fits for the problem at hand. Every chapter forces decisions: Which tool? When (or whether) to use it at all? What do you do with what’s in the box and what’s outside the box? I even get into IR territory from a DF vantage point in the book.

To make those decisions real, I picked (and still picking) specific tools to demonstrate strategies that are common in both civil and criminal cases. For the cell-phone triage sequence, I chose ADF Solutions. Not because a vendor comp’d me a license (they didn’t…), but because in this scenario I needed: simplicity, speed to actionable leads, and explainability. ADF fits what I needed for the demonstration I have created.  I have a list of other tools to solve other problems that I’ll talk about in future posts as I finish each chapter.

What makes DF/IR Investigative Strategies different (and painfully difficult to write)

Words Make Habits: Why “DFIR” (brand or integration) vs “DF/IR” (operating model) changes how people learn, build programs, and behave in incidents.

The way we label our work, DFIR vs DF/IR vs IR vs DF, doesn’t just reflect the work. It shapes who we hire, how we train, what we learn, what tools we buy, and how we handle evidence or incidents when it matters most.

The acronym “DFIR” is great marketing but fuzzy governance if its use is imprecise. DF/IR is less catchy but operationally precise regardless of how used. The label you choose shapes perceptions, course design, hiring, tooling and what actually happens to evidence.

Jason Jordaan’s statement sums it up with  “there is actually an inherent contradiction between digital forensics and incident response, because the actual end goals of digital forensics and incident response are actually not the same.” – Rethinking digital forensics in incident response Magnet Forensics

That’s the point: