PSBK Vol. 3 Update: The Casework Book I Wish Existed

This volume has been the hardest thing I’ve written because it’s not a “how to click” book. I have learned that it is much easier to write ‘how to run a tool book’ than it is to write ‘when and why (or if)’ to use a tool or ‘which tool is best to use in a million different situations.’ It’s also taking me longer to write this book than working a string of cases…because it’s harder than working a string of cases..

So, DF/IR Investigative Strategies (ie: volume 3 of Placing the Suspect Behind the Keyboard) is a how to work a case book, from event to adjudication, using whatever tool fits for the problem at hand. Every chapter forces decisions: Which tool? When (or whether) to use it at all? What do you do with what’s in the box and what’s outside the box? I even get into IR territory from a DF vantage point in the book.

To make those decisions real, I picked (and still picking) specific tools to demonstrate strategies that are common in both civil and criminal cases. For the cell-phone triage sequence, I chose ADF Solutions. Not because a vendor comp’d me a license (they didn’t…), but because in this scenario I needed: simplicity, speed to actionable leads, and explainability. ADF fits what I needed for the demonstration I have created.  I have a list of other tools to solve other problems that I’ll talk about in future posts as I finish each chapter.

What makes DF/IR Investigative Strategies different (and painfully difficult to write)

Words Make Habits: Why “DFIR” (brand or integration) vs “DF/IR” (operating model) changes how people learn, build programs, and behave in incidents.

The way we label our work, DFIR vs DF/IR vs IR vs DF, doesn’t just reflect the work. It shapes who we hire, how we train, what we learn, what tools we buy, and how we handle evidence or incidents when it matters most.

The acronym “DFIR” is great marketing but fuzzy governance if its use is imprecise. DF/IR is less catchy but operationally precise regardless of how used. The label you choose shapes perceptions, course design, hiring, tooling and what actually happens to evidence.

Jason Jordaan’s statement sums it up with  “there is actually an inherent contradiction between digital forensics and incident response, because the actual end goals of digital forensics and incident response are actually not the same.” – Rethinking digital forensics in incident response Magnet Forensics

That’s the point:

In DF/IR, decisions stack. Each one points you toward the truth or away from it to a multiple of bad outcomes.

The visual tells a familiar story. You start with a single investigative decision point. Get it right, and you’re on a straight, clean path toward the correct outcome. Get it wrong, and suddenly you’ve branched into a maze of wrong turns, wasted time, and bad conclusions. If you don’t catch yourself and recalculate, you’ll never end up with the right conclusion.

In an investigation, every red arrow represents a misstep:

• Following an unverified lead because it felt right.
• Skipping a key artifact because you assumed it was irrelevant.
• Following an irrelevant artifact because you assumed it was important.
• Relying on a single source of evidence without cross-validation.
• Misunderstanding the context of the data you’re reviewing.
• Rushing and guessing and not taking decisions seriously.

Each of these choices takes you further from the actual answer and just like in the diagram, they rarely lead to the same “wrong” conclusion. Instead, they spawn multiple wrong conclusions, each with their own set of false confidence and wasted resources.

On top of that, the earlier the wrong call, the more work it takes to recover. Small deviations from the right path in the beginning result in big deviations in the end. Some mistakes are irreversible and by the time you realize the error, key data is gone, the system is wiped, or the opportunity to capture evidence has passed.

In DF/IR and just about every other professional training environment, we measure training the same way prisons measure sentences: by time served.

• 1-day course? “That’s 8 hours.”
• 5-day course? “That’s 40 hours.”
• 2-week bootcamp? “80 hours.”

Those numbers are a lie. What you’re actually getting in an “8-hour” class, at best, is 6.25 hours of instruction. Do the math by subtracting breaks and lunch. If your class starts late, ends early, or has goof around time, subtract that time too and you’ll be in the 5-hour range.

Now extrapolate that for a 40 or 80-hour course. 80 hours is actually about 60 hours of training. We’re inflating numbers and calling time-in-seat a substitute for value.

Three types of training

40 hours is 40 hours of good training (good ROI)

Science is precise. DFIR should be too. But by definition, and by practice, it's often anything but.

Context in DF/IR matters more than what you might realize

Harlan Carvey started a thread on the “F” in DFIR.

I agree with what Harlan is talking about. I believe Harlan is the first one, or one of the first, to write DFIR as “DF/IR” way back in the dark DFIR ages of 2010. That slash matters. Digital Forensics exists for adjudication. Incident Response exists for remediation. Interesting enough, Harlan even clarifies this as "DF/IR communities"  and not "DFIR community."

Part 6 of 6 in the DF/IR Talent Pipeline Series

You made it to Part 6!  I hope you got a good nugget or two that helps you in your career or helps you help someone else in their career. I saved the best for last, and this advice is just as valid for the person who is in their first DF/IR class and the person who has worked 20 years in the field.

The Difference Between Good and Great

Most DF/IR professionals are good. Some are great.

And the difference between them?

It’s just 1%. But that 1%? That’s everything.

Part 5 of 6 in the DF/IR Talent Pipeline Series

First off…

I’m not an HR specialist. I don’t sit on HR boards or write recruiting handbooks.

But I’ve been the applicant (more than a few times!). I’ve been the hiring manager. I’ve conducted interviews for both private companies and private contracts. And I’ve read more résumés and job posts than I can remember.

So no, this isn’t HR advice. This is field advice and is 100% my opinion.

Experience under pressure is the difference between training and readiness.

This is Part 4 of 6 of the DF/IR Talent Pipeline Series

You’re Not an Impostor. You’re Just Inexperienced Like the Rest of Us.

If you feel unprepared for real-world DF/IR work or your next case, you’re probably right.

You’ve taken the courses. You’ve passed the certs. You’ve read the books. Maybe you’ve even worked a few cases (or a lot).

Part 1 of 6 in the DF/IR Talent Pipeline Series

The Myth of Entry-Level DF/IR

Search "how to get into DF/IR" and you’ll find a flood of bold promises:

“Land a six-figure DF/IR job with this one cert!”
“Get into forensics right out of school!”
“Law enforcement or bust!”

Let’s get past these.

DF/IR is no longer entry-level.
And no, you’re not making $120K next month because you passed a multiple-choice quiz, watched 10 hours of webinars, or was handed a freshly printed degree.

(And How to Stop Wasting Time on the Wrong Kind)
Part 2 of 6 in the DF/IR Talent Pipeline Series

You’ve taken the training. Watched the videos. Passed the quizzes. Maybe even earned a certificate or two.
Then, when it's time to investigate a real case, answer a hard question, or explain your process under pressure, you freeze. Or you make a poor decision.

That’s the training gap. And it’s wider than most people think.

But here’s the real problem:
It isn’t always the training itself. It’s that you expected it to do something it was never designed to do. You picked the wrong training for what you actually needed. Or you expected a secret formula that doesn’t exist.

I’ve taken “secret” trainings in multi-layered security buildings. I’ve paid thousands for vendor courses, private-sector programs, and spent literal months in public-sector academies. I found that there is no magic. There’s only the work of turning what you learn into something that matters.

Degrees, Surveys, and the Illusion of Readiness

Part 3 of 6 in the DF/IR Talent Pipeline Series

Open your eyes and stop pretending that everyone’s not frustrated with formal education in DF/IR.

Students are frustrated.
They spend four (or more!) years and five (or six!) figures on a degree only to graduate unprepared, confused, and un-hirable. Dear students, stop believing that you can do DF or IR with your degree if you have never done it before. It’s not the same thing.

Employers are frustrated.
They interview candidates with bachelor's and master's degrees in “digital forensics” who can’t define what RAM is. Who list Kali Linux as a programming language. But employers deserve half the blame. S-P-E-L-L what you need precisely so that schools can T-E-A-C-H it.

Educators are frustrated.
The few instructors who actually know what they’re doing are stuck in programs with no budget, no tools, and admin priorities that treat forensic labs like unnecessary expenses. For those who teach out of books having never connected a write blocker in real life, for the love of all that is holy and good, at least spend time at a real site to get hands on experience. It totally shows when you can’t even connect an adaptor or explain what a tool is doing.

Digital forensics and incident response isn’t about collecting artifacts. It’s about proving behavior.

It’s about building timelines, validating sequences, interpreting actions, and tying all of it back to a human. If you think your job is just to find a file, hash a disk, or run a YARA scan, then you’re missing the point.

You’re not building a museum.
You’re not showcasing artifacts.
You’re proving a case.

DF/IR Is Foundation, Not Finish Line

Digital forensics gives you the raw material, the registry keys, the deleted files, the modified timestamps, the browser histories, the $MFT records. But these don’t mean a thing until you turn them into narrative, context, and attribution.

We built incident response to scale.
We built digital forensics to uncover truth.
We built both to support investigations but not replace them.

But somewhere along the way, we stopped investigating.

Have we traded thinking for tools in DF/IR?

Playbooks replaced judgment. Tools became black boxes. Are we still investigating, or just collecting data?

Brian Carrier warned us more than a decade ago:

“Digital investigation tools have become relatively easy to use, which is good... However, it also means that the investigator may not fully understand the results. This could be dangerous when the investigator needs to testify about the evidence and from where it came.” — Carrier, 2005

Too Much Noise in DF/IR

Cutting Through the Chaos to Build a Professional Field

If you work in DF/IR or are responsible for educating, hiring, training, or certifying those who do, this post is for you. The profession is overwhelmed. The system is disjointed. The time for realignment isn’t someday. It’s now.

The Noise Is Real

Digital Forensics and Incident Response (DF/IR) is flooded with content:

• Courses, blogs, YouTube tutorials, newsletters, posts, tweets, chats
• Discord servers, forums, Substacks, and mailing lists
• Dozens of social media platforms
• Webinars, workshops, certifications, conferences, and degree programs

Most of it is well-intentioned. Much of it is necessary. Some of it is excellent. But when it’s all delivered without structure, clarity, validation, or job alignment, it becomes one thing: noise. And noise overwhelms clarity. When everything is important, nothing is.

What Even Is DF/IR?

"DFIR" gets tossed around like it’s one role. It’s not. Here’s a general distinction:

Yes, there's overlap, like DF can support IR, and IR can support DF, and sometimes it is the same thing with different missions.

The Three Failures That Will Define (or Destroy) Your DF/IR Career

Let’s get one thing straight: in digital forensics and incident response, you will screw up. Not “if,” but when.

What separates the pros from the posers isn’t perfection—it’s how they deal with failure. But not all failures are equal. New to DF/IR? You’ll screw up too—and that’s fine, as long as you learn fast. Here’s what the practitioners know: failure comes in three flavors, and each one can bite.

1. Misconduct

You knew better—and you crossed the line anyway.

This is where your credibility dies. You accessed data without a warrant. You withheld exculpatory findings. You lied on the stand. Whether it’s cutting corners or falsifying evidence, you’ve now contaminated every case you’ve ever touched.

In the early days, many of us attended forensic tool training and thought:     “Cool. I’ve been trained in forensics.”

Boy, were we wrong.

What we got was valuable, hands-on experience with a forensic tool, used in real-world cases. But what we didn’t get was a deep understanding of forensic artifacts, system behaviors, or investigative thinking.  We learned how to navigate a product but not how do DF/IR (aka: ‘computer forensics’ back in those days).

We had to learn forensics the hard way through trial and error and on the stand. There were no college degree programs in this field. Books were few and far between. The Internet resources consisted of a few generic websites.  YouTube? Nope. Calling someone for help? Only if you were lucky and knew someone.

If you're in DF/IR, or helping others enter the field, let’s be accurate about something important: Tool training and forensic training are not the same. They serve different purposes. You need both, but you must understand the difference.

Artificial Intelligence (AI) in digital forensics isn't new. If you think AI just showed up in DF/IR, you're about 15 years behind. In 2010, DF and AI was already being discussed. 

"Digital forensics is an area that is becoming increasingly important in computing and often requires the intelligent analysis of large amounts of complex data. It would therefore seem that AI is an ideal approach to deal with many of the problems that currently exist in digital forensics." - Dr. Faye Mitchell (2010)

Fast forward to today, and AI isn't theoretical anymore. It's embedded in the very tools you're using. AI is sorting artifacts, flagging anomalies, and influencing investigations in ways most DF/IR practitioners don't even realize. And if you don't understand what AI is doing under the hood, you're not investigating—you're just pressing buttons and hoping for the best.

AI is a Tool, Not an Investigator

I recently read a great blog post by Harlan Carvey about AI's role in DF/IR, and he not surprisingly nailed it: AI isn't going to replace human investigators. AI doesn't understand DF/IR. It doesn't recognize deception, nuance, or intent. It doesn't have instincts. It doesn't investigate—you do.

Another way to look at it is that AI is not your partner, mentor, or case lead. It's just another forensic tool—like your carving tools, timeline software, and triage applications. Would you blindly trust an untested tool to build your case? Would you blindly trust someone you don't even know? No? Then why are so many investigators treating AI like it's an infallible, all-knowing oracle?

TL:DR Belkasoft Evidence Center lives up to its tagline of "forensics made easier". For a near complete automated case work, it works. An intuitive interface and automated processes make processing practically user-error free. The review I took Belkasoft Evidence Center (BEC) for a test drive, ran it across several images, and validated what I saw ...

You can waste years grinding through free resources, trial and error, and scattered YouTube videos, or you can get trained by experts and start solving real cases now. Self-learning is excellent until it isn't. Until you're stuck. Until you realize that all those "free" hours cost you opportunities, cases, and mistakes you didn't even know you...

Success in Digital Forensics and Incident Response (DF/IR) requires more than just knowing how to use the latest software or hardware. A "tool" in DF/IR is not limited to a specific application or device—it's anything that equips you to solve problems, uncover evidence, and navigate the complexities of an investigation. Whether it's your mindset, t...