A lot of people can “drive,” but they’re still a danger to everyone on the road. 

It’s the same thing in DFIR: plenty of practitioners can operate tools, generate timelines, and produce reports that look professional while still being a liability to the case.

Here’s a maturity curve in three phases, using driving to separate technical operation from investigative competence. In practice, there are blurred lines, not clear-cut distinctions in these phases. But generally….

Phase 1 – Tactical:   “I Never Crashed, Therefore I Can Drive”

These folks can run the tools. They can pull data. They can spit out timelines that look like museum exhibits or the printout of the moon landing log from a NASA printer. But they confuse motion with skill. Their core belief is usually: “If I collect more, I’ll be safer.” 

Reality: Collecting more usually means more artifacts you didn’t validate, more assumptions you didn’t justify, and more claims you can’t defend. Adding hay doesn’t help you find the needle. It just gives you more hay to explain.

This phase requires constant supervision, mentorship, and monitoring to reduce the risk of incidents.

Tools: Most tools are used simply for extraction and output. The danger is not the tool but treating the output as the “case.”

Rare outlier: the Apprentice.

That’s the person who realizes early: “I’m not as good as I think I am. I don’t even know what I don’t know.” They seek mentorship and get coached before the inevitable crash teaches them the hard way. Hire or mentor this person. They are gold.

Phase 2 – Principled: “I Can Drive Safely Because I Follow the Rules of the Road.”

Most people graduate to this phase after getting into a fender bender or seeing one, or having a peer review that exposes a weak conclusion, or a supervisor who asks “so what?” and they have nothing, or experience a case that gets them punched in the nose with basic scrutiny.

Principled practitioners start doing the expected work by separating evidence from inference, validating artifacts, and scoping with intent instead of dumping everything they can extract.

The trap: they can mistake process for judgment. They become checklist loyalists. If the playbook didn’t mention it, they don’t see it. If the procedure says “done,” they stop thinking. Process reduces risk. It doesn’t replace a brain.

This phase is generally less supervised during casework, as long as everything stays in the box.

Tools: Here, the tools start serving process: validation, repeatability, and scoping. This is where the practitioner starts asking why something exists or doesn’t exist.

Phase 3 - Wise: “I Drive Like Everyone Else Is About to Do Something Stupid.”

Wise practitioners don’t just “drive better.” They manage risk.

They assume that their work will be challenged by someone smart and motivated, opposing experts will pull their work apart, they’re missing something, and that the easy explanation is probably the wrong one.

Instead of hunting artifacts like trophies, they design the argument and then try to destroy it. They can say, “Prove me wrong,” because they already tried to prove themselves wrong first. They’re the harshest reviewer in the room. That’s why their conclusions and work survive.

These are those who led your team, mentor others by mere virtue of being there, and are able to handle the most complex cases.

Tools: Now the tools are supporting the case by providing transparency and allowing investigator/practitioner judgment to drive the case.

How people grow

Maturity is usually forged through near misses, fender benders, and collisions. These are the experiences of having unanswerable questions in court, a report that folds like a cheap card table under cross-examination, or a conclusion that looked “obvious” until someone asked one brutal question to destroys the entire premise of the work product.

Tactical practitioners are the most dangerous because they don’t know what they don’t know, yet they write with confidence anyway. Their (over)confidence gives clients and attorneys a false sense of confidence, and that never works out well.

If you want to become wise, you have to choose to learn by intent: constant critique, deliberate practice, and real validation. Each of the steps below require training, education, practice, testing, research, and experience.

Step 1: Education/Foundations

Legal and technical basics (ie: What is law?  What is a computer?). 

Step 2: Tools

Make data human-readable (ie: Using forensic tools to translate bits and bytes into human-readable information)

Step 3: Investigations

Interpret information (ie: Build the story from facts, using the scientific method and investigative processes)

Because learning by impact is expensive and sometimes career-fatal.