Somewhere along the way, we stopped investigating people and started interrogating machines.

I harp constantly on this topic because it is important. I’ve seen investigations where the goal was clear. Follow the evidence to the truth and the technical work was just one more path, alongside interviews, surveillance, and gumshoe labor.

And I’ve seen the opposite. Examiners chasing artifacts for the sake of artifacts, mistaking data collection for investigation. The human story disappears, replaced by an obsession with tool output. AI is making that worse.

Fluent in Code, Illiterate in Human Behavior

We’ve become highly skilled at parsing bytes, building timelines, and scripting workflows, yet dangerously detached from the human side of our work.

It’s not that we stopped caring. It’s that we started believing the tools could care for us. We assumed the case agent, attorney, or client would interpret our findings. Because we “only do the forensics,” right?

That’s how we’ve been teaching the last generation and shaping the next.

Training Shapes the Mindset

I’ve taken thousands of training hours, taught thousands of people, and earned a small stack of certificates.

After all that, one thing stands out: The way we train determines the way we think. And the way we think determines the quality of our casework. Some of us think we are doing ‘casework’ but for all practical purposes, we are just dumping data into spreadsheets and PDF reports.

If training begins with the tool, the investigation ends with the tool.

If training begins with the case, the tool becomes what it was meant to be, a way to tell the story.

We did this to ourselves. We learned forensics before we learned investigation. Most programs teach efficiency, not understanding, tool mastery, not reasoning mastery.

We’ve automated the workflow so well that we’ve stopped questioning it.

The Lesson of the Painted Rocks

When I was a young Marine, I once had to paint rocks in the desert, in front of an old Army building. It made no sense to me. Yet another work party…

When I asked why we were painting rocks, my Gunnery Sergeant, Gary Truscott, said (with his normal amount of F bombs interweaved like poetry):

It took years to understand it wasn’t about rocks. It was about pride, discipline, and legacy. That lesson eventually stuck.

Tie the Act to the Actor

That same principle drives everything I’ve done since. Placing the Suspect Behind the Keyboard wasn’t a slogan, it was a mission. Not for my benefit, but for every victim, whether a person or an organization. 

If we enter this profession and leave it in the same or worse condition, we’ve failed it. If we can fix it, we must.

The tools should sit in the backseat where they belong until they are called forward. The tools enable us to do the job; they are not the job.  And the job is attribution because attribution matters. 

Why It Matters Now

Automation keeps improving. Understanding keeps slipping.

If we don’t reintroduce reasoning into the DF/IR workflow, we’ll end up with practitioners who can only run software and can’t explain what it means. Eventually, the software will tell us what to do and we’ll obey.

It’s not the machine that does the forensics. It’s the examiner.

As Dr. Karen Howard told Congress:

“Forensic algorithms have expanded our capabilities and quietly eroded our comprehension.”  Adapted from GAO-24-107206, U.S. Government Accountability Office (2024)

We’re seeing the consequences already.

In State v. Puloka (Wash. Super. Ct. 2024), a defense expert admitted he didn’t know what data the AI model was trained on or how it reached its conclusions, yet he offered its output as evidence. The court rejected it, finding the video “did not show with integrity what actually happened.”

What failed wasn’t the technology. It was the method. No investigative mindset, no comprehension, no ability to defend the result.

The Courts Are Catching Up

The law is finally codifying what we’ve been forgetting. Yet we still see testimony like this:

“He believed the program is reliable merely because it is the most popular program used to examine cell phones and because he was told it was reliable.”  State v. Pratt II, 2015 VT 89, ¶15, 199 Vt. 330, 123 A.3d 831

This isn’t about bad actors; it’s about blind spots.

A 2022 study (Nina Sunde, Forensic Sci. Int’l: Digital Investigation, Vol. 40 (2022)) found that:

• 45% of practitioners started analysis without an innocence hypothesis.
• 34% applied no techniques to maintain objectivity.
• 38% did nothing to test evidence reliability.

That’s not a statistical problem. It’s a mindset problem.

Bringing It Full Circle

If the next generation learns to rely on automation before they learn to think, the integrity of every case is at risk.

Our tools should extend cognition, not replace it. The suspect is still human. The victim is still human. The investigator must be too.

We need to start investigating people again, using technology to do it. That’s what Placing the Suspect Behind the Keyboard was always about.

Ready to Bring Investigation Back to Forensics?

If this hit home, you’ll want to see what I’m teaching next. PSBK CASEWORK is the one-day, scenario-based course that puts the investigation back into digital forensics; live, immersive, and built on real cases.

? Take a look at this unique training and register here

Limited seats. Limited books (limited print edition included free). Once they’re gone, they’re gone.