We don’t rise to the level of our DF/IR certs and degrees. We fall to the level of our experience and training.

Everything I’ve written here is not a concept. It’s coming.

Want In? Get on the List.

Train like it matters. Because in DF/IR, it does. Soon, I’ll be inviting a small group to this first scenario-based cohort. If you want early access or just want to stay in the loop on upcoming trainings, tools, and PSBK resources join my Placing the Suspect Behind the Keyboard newsletter. It’s a newsletter targeting only placing suspects at devices in DF and IR cases (ie: attribution!).

? Click here to get on the PSBK newsletter list.
(No spam. No fluff. Just real-world DF/IR investigative stuff.)

You’ll get:

• Priority invites to PSBK courses (including this private cohort)
• Free DF/IR strategy downloads and toolkits
• Case walkthroughs and field-tested lessons
• Insider updates on the framework and training releases

This isn’t part of the DF/IR Talent Pipeline Series I’ve been writing. That series is there to help everyone, for free.

This upcoming course is something different.

In it, I’ll be showcasing a framework and system that is a legally defensible DF/IR investigative methodology I’ve used and been refining from years of federal and state cases, expert witness work, and hands-on investigation. The core of the framework is Placing the Suspect Behind the Keyboard, fit for both the DF and the IR, in both the criminal and civil worlds. The framework doesn’t replace any other framework; it supports all of them but wraps everything around the entire case/event and not only focusing on data or a data point.

This is pressure-tested, scenario-based digital forensics and incident response training. The kind that challenges you, changes you, and makes you think.

More details are coming. But for now, I know that the experience gap isn’t going to fix itself. But we’re about to close it, one realistic scenario at a time, and not as a tabletop exercise or CTF.

If You’re Wondering Where This Scenario-Based DF/IR Course Came From, Read On.

It didn’t start in a lab. It started on a range.

Back in the early ’90s, I was a brand-new police officer, and I experienced firsthand the “old way” of doing training.

Firearms training meant shooting paper targets a few times a year. Defensive tactics (DT) meant hitting bags or pulling hair for two hours. I was selected for SWAT, and that training was marginally better; we had Simunitions occasionally and practiced tactics. But most training was static, unrealistic, and disconnected from what actually happened in the field.

Frankly, I dreaded going. It felt like wasted time. I would’ve rather polished boots. Or stuck a fork in my eye.

So, I did something about it.

Building a Program That Didn’t Exist

I became a certified instructor in firearms, defensive tactics, and continued my SWAT gig, pretty much all at once. My goal: integrate the three disciplines into one realistic, scenario-based program that actually prepared officers for real-world encounters.

I had some experience in the military with training like this, but it wasn’t designed for law enforcement. Still, those ideas stuck with me.

So, I wrote a 23-page, fully researched proposal for a use-of-force training program that merged everything: FA, DT, SWAT. One training environment. Real gear. Real scenarios. Real decisions.

At the time, no one in my state (Washington) was doing it. I called police academies around the country and found nothing. SWAT teams used Sims, sure. But not for integrated, full-spectrum force-on-force training. Maybe someone else had it, but not that I could find in 1995. Mind you, this is pre-Internet as it is today. We had to do physical research and actually talk to people to find information.

It took over a year to get approved, bureaucracy, of course. but once it was, I ran it under DT to keep live weapons out of it.

We Trained for Reality. Not for Comfort

I handpicked instructors. Designed every scenario from real calls. We trained detectives, patrol, traffic, even DARE officers. Each scenario could be set to shoot/no-shoot, force/no-force. Only the role players knew the intended outcome.

We filmed every session for debriefs.

Every officer trained in full uniform, minus live weapons. Each had to articulate the force they used (or didn’t use) before knowing if it was correct. No do-overs without accountability. We included backup failures, equipment mistakes, ethics tests, and stress triggers.

One scenario: role player complies 100% with verbal commands. If the officer gives commands, it ends peacefully. If not? It escalates into a shooting because they failed to use verbal commands when it was appropriate to do so.

Another: role player ignores commands, resists control. Officer must use deadly force or get ‘killed’ by Sim round or edged weapon.

It was brutal. It was stressful. But it worked.

The Results Changed a Department

Half the department hated the idea at first. Senior officers mocked it and I expected that. But younger ones were all in. I think because they didn’t know better…

After their first scenario, there wasn’t a single officer who didn’t walk away feeling like they had just lived through a real incident. Tunnel vision. Adrenaline. Fear. Excitement. All of it.

• Early on, many fired into walls or ceilings.

• They forgot their flashlights and had to enter dark rooms, forgot to call for backup and were overwhelmed with role players, froze under pressure and had near panic.

We coached them. Ran the scenarios again. No one left without learning something and no one wanted to go back to the old way.

After a year?

• Firearms safety improved. No one ever missed. Ever.

• Command presence skyrocketed.

• Tactical decision-making became muscle memory.

• My loudest critic became the program’s biggest fan (25+ years on the job and wrote it up in praise).  His written memo: “…this is real life stuff, a part of the job that could happen day or night…”

And then the real world came knocking.

One of my friends who trained in the program was later involved in an actual officer involved shooting. He told me afterward:

“All I could think of during the call was your scenario and voice from training.”
He wasn’t the only one to say that.

The academy (WSCJTC in Burien, WA) eventually called me and asked to help build out the state’s version. What started as a single-department initiative is now widely adopted.

And I’m proud to say that after I left law enforcement, I returned to visit my old department and saw that they’d made it even better.

The Cost of Real Training

There was a cost, though.

A close friend of mine was injured in one of the early scenarios, badly enough to require medical retirement. It was a freak accident. Watching the video still makes me cringe as you can literally hear the snap. We learned from it. Adapted. And it never happened again.

We’re still best friends to this day. He remains a supporter of what we built.

Why It Matters to DF/IR

That same need for scenario-based, pressure-tested training exists in digital forensics and incident response.

The courses most of us have taken? They’re static. Controlled. Clean.
Like early DT and firearms: linear, mechanical, and stress-free.

That’s not how real cases work.

I’ve taken over 1,500 hours of DF/IR training since then: FLETC, vendor courses, conferences. None of them—none—ever replicated what an actual case feels like. They taught pieces. But never the whole picture.

That’s what this new course is.

Start to finish. From incident to courtroom or boardroom. You’ll investigate, report, testify, and defend your decisions. The scenario unfolds whether you’re ready or not.

It doesn’t matter where you are in your career. Like my use-of-force program, rookies improved. Veterans were reinvigorated. And some found their purpose again.

That’s what I want to build in DF/IR.

Fail (ie: learn) in training in order to succeed in real life.

Here’s what I have so far:

A framework and system built on everything I have done with scenario-based training and course development that I have experienced. It’s a framework that fits DF and IR, in both civil and criminal casework. And it’s being put into a DF/IR scenario-based, time-sensitive, decision-making training program that you must make decisions that will determine the course of the investigation. 

It starts with an event and ends with submission of findings to a boardroom or courtroom (depending on the scenario type). And it’s not just “DF/IR”. It is the whole gamut of what you have available to investigate, like interviewing witnesses or IT staff or key card access logs or security cameral footage, and writing affidavits for warrants.  On top of forensic analysis of devices!

My objective is a course that makes you think and think creatively. To make you see the big picture and the small details, while putting it all together coherently in reports or affidavits. To make you choose your tool of choice and defend your choice. 

I’ll throw in the normal obstacles, like, your chosen tool is more expensive than your org wants to buy. Or you have only an hour to do a task that takes two because you have a meeting or client call to attend with. Or your co-worker is off sick and you have to figure out how to do something only they knew how to do.

It doesn’t matter your current skill, education, or training for this course. Like the integrated use-of-force scenario-based program I created, new officers started with great training and experienced officers were reinvigorated with training that improved their decades of learned skills into something that made them safer and more confident. One senior officer in particular was so engaged after the training, I caught him mentoring a new officer, something that he never cared about doing before. The why (I just had to ask)…he said that the training made him remember why he was there in the first place.

That’s a several years long story wrapped up in a blog post. To remind you why we are here in the first place.

The DF/IR scenario-based training is the next story that has been years in the making. It’s a course that I needed when starting out. It’s a course that I needed to give me an edge in my skills later in my career, that would have pushed more than I thought I could do.