That Time I Bought Coke on a Skateboard
What undercover drug buys taught me about trust, judgment, and the DFIR investigative mindset. Buying dope is easy.
Read MoreAI is Eating Itself
Google made answers easy. AI is making us source-blind. “Ask the chatbot and get an answer.” That sounds good until you ask where the answer came from, who created it, who verified it, who updated it.
Read MoreYour Digital Forensics Degree Is Already Outdated. Now What?
An expensive checkbox Unless you are subsidized or earned support somehow, a degree can be a financially expensive and time consuming checkbox. It can get your application past a screening filter.
Read MoreAI Won’t Replace DFIR Investigators. But It Will Replace Those Who Don’t Investigate.
Here is ONE example of being led astray by AI.
Read MoreStop Building Shrines to Your Own Bias
‘Thinking like an investigator’ is not the same as having an ‘investigative mindset.’ Walk through any conference hall or search online and you’ll see it everywhere. Booth after booth, search result after search result, all promising some version of the…
Read MoreIf you suck at your DFIR job, AI is going to take it.
Some of you are on the X, and AI (via HR) has you in its crosshairs. If your job is mostly clicking buttons, reading tool output, and turning machine data into paragraphs, you painted that target on yourself.
Read More20 Minutes Up Front Reduces Hours of Waste Later.
The FACT Attribution Framework is designed to have you writing less, wasting less time, producing clearer, more defensible conclusions, and testifying more clearly starting right now. If you have framework fatigue, don’t worry.
Read MoreWhy AI Will Replace Every DFIR “Tool Operator” by 2027.
Experience is a brutal and effective teacher.
Read MoreI Thought Legal Would Catch It. They didn’t.
Early on, I made an incorrect assumption: If I ever wrote something dumb in a report, a supervisor or legal would catch it, fix it, or send it back. That delusion let me sleep, and I never questioned it.
Read MoreIs Artifact Worship Killing Your Cases?
If your report is primarily a timeline of artifacts, you cataloged them without investigating. There’s a name for that: artifact worship.
Read More