We’ve (D)evolved from Casework to Toolwork
DFIR training is fragmented, and fragmented training produces fragmented practitioners. And on top of that, we’ve turned artifacts and tools into a fetish, confusing output with understanding and “the tool says…” with a conclusion.
Read MoreDFIR (as we use it) started as a hashtag.
DFIR (the label) started as a hashtag. It didn’t create digital forensics or incident response, but did create a dominant label for both that became a banner and a massive marketing umbrella. This results in the most dangerous word inside that umbrella…
Read More
Your DF/IR Tool Can’t Tell You Who Did It. FACT Tells You When You’re Allowed To.
DF/IR doesn’t usually fail on the technical work. It fails at the exact moment someone gets impatient and confuses activity with identity, and then confuses identity with attribution. “This account did it” becomes “this person did it,” with zero bridge,…
Read MoreFight City Hall: If You Missed the Webinar, You’re Making Mistakes You Don’t Know About
The recording is available today (Friday, November 14, 2025) only. After that, it’s gone permanently. Register to access it here: https://www.suspectbehindthekeyboard.com/offers/S2W6hwau This wasn’t a case study. It wasn’t entertainment. It wasn’t…
Read MorePerfect seizure or total loss? DFIR has the ideal world. Patrol has the real one.
A recent podcast conversation with Jessica Hyde, Debbie Garner, and Kim Bradley brought back a problem I’ve seen for years: the digital evidence guidance written by experts is unusable by the first responders who touch devices first. {source}<iframe…
Read More
Ripping the Band-Aid Off DF/IR
Someone in DF/IR is going to testify in a trial in 2026. Actually, it will be many. And some are going to regret every second on the stand. Are you going to be one of them? There are things in this field that people don’t talk about. Not in conference…
Read MoreFighting City Hall: DF/IR Lessons from a Pro Se Plaintiff. One judgment, two years saved, half a million reasons it was worth it.
Here’s the short version: The litigation record showed large numbers of systems that were not searched, devices that could not be accounted for, and a workstation that was reported as ‘dead’ shortly after my request. The production showed thousands of…
Read MoreI Was There When Digital Forensics Lost Its Soul.
We built an assembly line of bots to learn forensics and forgot why the field existed in the first place. The Origin Story We Forgot Before anyone called it “digital forensics,” it was just investigation. Law enforcement investigators, not academics or…
Read More
I screwed up so you don’t have to
I recently posted on LinkedIn (How to wreck your report, affidavit, and testimony with one word.) about how one word can wreck your report, affidavit, or testimony. The word was deleted. That post got a lot of article views. Probably because we are all…
Read More
When the Investigation Gets Lost in the Machine
Somewhere along the way, we stopped investigating people and started interrogating machines. I harp constantly on this topic because it is important. I’ve seen investigations where the goal was clear. Follow the evidence to the truth and the technical…
Read More