DF/IR Lemonade

Digital forensics and incident response are too often taught like a parts catalog.

One module on log analysis. A class on memory forensics. A blog post on timeline creation. A YouTube video on parsing registry hives. A lab on recovering deleted files. And maybe, if you’re lucky, a short segment on how to write a report.

These are the lemons of DF/IR.  Each one has value. Each is necessary. But like real lemons, none are satisfying alone. When we produce DF/IR professionals without integrating the parts, we end up with those who can only run tools or perform specific tasks. And they will struggle to answer the most critical questions:

Why did this happen? How did it happen? Who did it? What does it mean? What do I do next?

We’re training people to extract data. We’re not always training them to investigate.

This isn’t an insult to the students. It’s a flaw in our system. When training is delivered in disconnected pieces, with no pressure to integrate, apply, or justify, the result is predictable: a pile of lemons and no idea how to make lemonade.

A trial

Just last week, after my jury duty, I sat in a different case as a spectator to get a different perspective of casework (I’ll eventually write up some really neat perspectives on court).

The trial was a basic traffic stop (non-DF/IR) with one witness, one item of evidence, and one charge. The officer’s report was the bare minimum, just a few paragraphs. On the stand, he couldn’t recall the sequence of events. He added key details during testimony that weren’t in the report, specifically testifying to evidence he saw in the vehicle. But this evidence, which was relevant and substantial, wasn’t seized as evidence and not written in the report. It sounded as if he made it up, even if he didn’t.

The defense objected, and they were right. The prosecutor was caught off guard. There was no foundation. No structure. No clarity. I was cringing while watching the officer testify. He was clearly getting nervous.

The officer had seven years of experience, so he was not new to police work. The officer didn’t fail on the street. He failed on paper. And that failure compromised the entire case.

The result?

Contradiction. Loss of credibility. Loss of confidence. Reasonable Doubt. The jury returned an acquittal even though the body cam clearly showed guilt. 

That “simple” case triggered a massive system response from the arrest through trial that was totally wasted. From start to finish, here’s what it likely involved, based on my experience of working the other side:

• Three patrol officers were at the scene
• A dispatcher
• A field supervisor to approve the report
• Jail staff for booking, housing, and meals
• Evidence technicians
• A judge
• A court reporter
• A prosecutor and paralegal
• Two defense attorneys and their support staff
• A courtroom for the day
• A courtroom marshal (aka: bailiff)
• Jury commission clerks
• Six jurors pulled from their day jobs
• The defendant’s family in court
• Clerks handling filings, transcripts, logs, and more

All of the time and labor of everyone was wasted, because the foundation was weak. Poor documentation. No articulation. No story. The officer (ie: the investigator) was pivotal in that case as many times that is the case. You, the DF/IR investigator, are pivotal in your work. Imagine the number of people and hours involved in just one of your incidents or cases. I am sure it is more than this case example!

That simple criminal case was a basket of lemons.  By chance, I picked a good trial to evaluate, but it was hard to watch.

Making Lemonade

You make lemonade when your timeline doesn’t add up and you go back to figure out why. You make it when you realize you misread an artifact and fix your conclusion before you’re cross-examined. You make it when a critical piece of evidence turns out to be irrelevant but you can still defend your findings. 

That’s the difference between checking a box and working a case.

Tool and skill training

By the way, I like tool training.  A lot. I also like classes on database forensics and everything else!

When it’s done well, it saves me time. It makes my workflow more efficient. And it gives me confidence when I testify. If I’ve been trained on a tool or skill, and I’ve tested it, validated it, and used it properly, I can explain why I used it, what it produced, and how that output supports my findings. That kind of training doesn’t just make the job easier; it makes it more defensible.

But tool training alone doesn’t build an investigator. Tools are lemons. Just like individual DF/IR skills are lemons. They are required, necessary, and important. But the case is the lemonade.

If you are not putting together your case, or your team isn’t, or a co-worker isn’t, then the fix is integration. Application.  Context. And real consequences.

We must stop treating DF/IR like a checklist of skills and start treating it as a system of understanding. That means shifting from:

“What was on the device?”
to including
“What does this mean in context of the user’s behavior, the network’s activity, and the incident as a whole?”

It also means writing reports that you expect to testify to, because one day, you will. It might take you 20 years to get to the stand, and maybe only once in your career, but when that day happens and you are unprepared, remember these words:

“Brett said this would happen.”

Whether it’s criminal, civil, internal, or regulatory, your report becomes the spine of your investigation. If it’s incomplete, the case is incomplete. If it’s vague, your credibility is vague. If it’s just a raw data dump with no reasoning, it’s not a report. It’s a red flag.

It’s easy to collect lemons (ie: the DF/IR necessary skills!), but the hard part is turning them into something useful. That’s where your value as a digital investigator comes from, not in what you extract, but in what you explain, justify, and defend.

That’s why I’m writing Placing the Suspect Behind the Keyboard: DF/IR Investigative Strategies, Volume 3, and why I’ve nearly finished building the scenario-based DF/IR training course that goes with it.

It’s not a tool review.
It’s not a PowerPoint marathon.
It’s not death-by-acronym.

It’s a system built of pressure-tested, courtroom-grounded, full-spectrum training experience designed to make you better at building cases, not just pulling data.

DF/IR Investigative Strategies (Volume 3) and the course are coming soon.
If you’re on the list, you’ll be the first to know. Yes, I’m creating a list for this unique and one-of-a-kind training, but limiting it to small groups: https://www.suspectbehindthekeyboard.com/psbk-interest-opt-in

Until then, keep collecting your lemons. But never forget that collecting lemons isn’t the goal. Making lemonade is.