From Why to What: The Decline of Investigative Thinking in DF/IR

We used to ask why.

Why would the suspect use this device?
Why was this action taken at that time?
Why does this one detail feel wrong?

Now? We only ask what.

What tool recovers deleted files?
What script finds the browser history?
What keyword pulls hits the fastest?

That shift from why to what is killing this field.

The Technician Takeover

This is gonna hurt. We’ve trained a generation of DF/IR folks to be button-pushers. Walk into a room, run a tool, export a report, walk out. That’s not investigating. That’s tech support.

I’ve seen ‘examiners’ throw mountains of data into a report and call it done. No conclusions. No context. Just a dump of whatever the tool handed them expecting someone else to figure out what it all means.

Let me ask you: If you can’t explain why an artifact matters, what are you doing in this field?  Better yet, if you can’t articulate the truth of the matter, what good was your work?

Tools Don’t Solve Cases. You Do.

I love tools. But the tool didn’t make the case. You did. Or you didn’t.

• You didn’t recognize the 3AM logon as behavior-based access.
• You didn’t connect the anonymized IP to the Starbucks across from the victim’s school.
• You didn’t ask why the app was installed, used, and deleted in five minutes.

That’s not a data problem. That’s a mindset failure.

DF/IR Is Starting to Smell Like Compliance

Too many people are doing DF/IR like it’s an audit checklist. Run the tool. Generate the report. Move on. That’s fine if your goal is plausible deniability and clocking out at 5.

But if you’re in this job to solve something, to find truth in chaos, then you better start thinking like an investigator again.

This job isn’t about data. It’s about behavior.
It’s about humans. Motive. Mistakes. Pressure. Panic.
If you’re not thinking about those things, you’re not doing digital forensics. You’re just a technician with an expensive marketing cert.

Knowing When to Investigate Is Just as Important

And here’s something no one tells you in a 3-day cert class: Knowing when to investigate is part of the mindset, too.

Every alert isn’t a breach. Every USB plug-in isn’t espionage. Every weird timestamp isn’t an incident.
Sometimes you watch.
Sometimes you wait.
Sometimes you don’t do anything.

Other times, that tiny anomaly? That odd logoff? That deleted file with a weird name? That’s the thread that unravels the whole incident if you’re paying attention.

Judgment is everything. It’s the one thing no tool will ever give you. And it’s the one thing few people, if any, train you to build. The good news is that I am seeing a shift getting back to asking why. I’ve seen an “investigative mindset” spelled out in job descriptions lately, and that is a good sign. Actually, a great sign that the employer wants to hire problem solvers, not button pushers.

Let me pitch you a class to develop your investigative mindset.

The DF/IR Investigative Mindset Course

I built this course and wrote a book about this subject because there’s no need that smart people turn into tool monkeys, which results in injustice to victims (businesses AND people).

This course isn’t a tutorial. It’s not a walkthrough. It’s not going to show you what button to press.

It’s going to change how you approach every single case.

If you want to solve cases instead of just reporting on them, start here:
?

About this course. I give it live 1-3 times a year, and this on-demand version gets you invites to also attend any live version (space available). Pass the course exam and you get a limited print, signed hardcover DFIR Investigative Mindset book free, including free shipping to a USA address.  International shipping is not included (if you are outside the USA, you can pay for the shipping, or opt out of the print book for a PDF version).

This class is $599, but once or twice a year, I’ll do a flash sale.  This is the second and probably the last time for 2025 that I bring the price down to $175 for 7 days only, and limiting registrations to the first 100.

I strongly believe in this subject matter as being in the top 3 things you need to master DF/IR. 

On taking any training class or getting advice on a skill, here is my opinion:

–There are those who think they know best and that no one can teach them anything (because they can learn it all on their own).

–Then there are the Roger Federer‘s out there who keep looking for that .01% edge that makes them great in whatever field they are in.

Which group are you in?