And so, it begins...
Some time ago, I wrote, “One day, you’ll be able to point AI at a forensic image and just ask AI questions about what happened on that device.”
I certainly was not the only one, or the first one, to say or think this. But we are at that point now. Point and ask.The future is here (again). To be honest, I did not think I would see it this soon. But here we are.
Spend a few minutes on this. You will not regret it.
Cyber Triage shared a useful DFIR + AI project list. Going through these links is one of the best snapshots of where we are with DFIR + AI right now. This is where the market is going, and this is where the workflow is changing.
If for no other reason, be at least be familiar with the direction that DFIR + AI is headed. I went through each of these links and rethinking about DFIR + AI.
View Cyber Triage’s LinkedIn Post
I consider today’s AI to be like a 1967 Shelby Cobra 427, one of my favorite sports cars ever built.
That car had a huge engine, an extremely light body, no power steering, no power brakes, no ABS, and no traction control. The driver’s input (aka: prompt!) decided whether it won a race or ended up wrapped around a tree.
That is AI in DFIR.
Your specific use of AI decides whether your DFIR skills are boosted or busted.
DFIR + AI is no longer just about asking a chatbot to summarize notes, clean up a report, or help draft a timeline. The bigger shift is the connection between AI systems, forensic tools, evidence stores, triage platforms, timelines, and investigative workflows.
The question is no longer, “Can AI help DFIR?” or “Will AI hurt DFIR?”
The answer is yes. To both. The better question is this: Can this AI-assisted workflow preserve the discipline needed for defensible forensic work?
That issue is not new. Brian Carrier made the larger point nearly twenty years ago in File System Forensic Analysis. The technology has changed. The principle has not.
“...so that they are not constrained by their tools.”
Carrier’s point was that investigators need to understand how things work beneath the tool interface. Knowing how and why digital evidence exists helps an examiner testify about it, sanity-check tool output, and recognize when a tool result does not make sense.
That applies directly to DFIR + AI. Carrier was not arguing against tools. He was arguing against being controlled by them.
With traditional forensic tools, the risk was that an examiner might click through a workflow without understanding the underlying evidence. With AI-assisted workflows, the risk expands.
Now the examiner may receive a confident explanation, a smoothly written summary, or a suggested conclusion that sounds reasonable before it has been verified.
Carrier made the warning more directly in Chapter 1:
“...the investigator may not fully understand the results.”
That warning lands harder now because the trap is easier to fall into and you won't even realize it until it is too late.
AI in DFIR is fast, but speed is not the standard. Verified accuracy is.
That is why Cyber Triage’s list is useful. It gives practitioners a snapshot of where DFIR + AI work is happening right now. Some of these projects are community-driven. Some are commercial. Some are experimental. Some are tied to MCP workflows. Some are built around triage, investigation, or response.
This list is a signal.
DFIR + AI is moving from isolated chatbot use into connected investigative workflows. You cannot stop it but you can use it with control. This is where we need to pay attention.
Read Cyber Triage’s Original LinkedIn Post
Source: Brian Carrier, File System Forensic Analysis. Boston: Addison-Wesley Professional, 2005.
*Question: Did Brian Carrier travel back in time to 2005 to write File System Analysis and plant these seeds for DFIR?.....