If you suck at your DFIR job, AI is going to take it.
Some of you are on the X, and AI (via HR) has you in its crosshairs. If your job is mostly clicking buttons, reading tool output, and turning machine data into paragraphs, you painted that target on yourself.
Read More
20 Minutes Up Front Reduces Hours of Waste Later.
The FACT Attribution Framework is designed to have you writing less, wasting less time, producing clearer, more defensible conclusions, and testifying more clearly starting right now. If you have framework fatigue, don’t worry.
Read More
Why AI Will Replace Every DFIR “Tool Operator” by 2027.
Experience is a brutal and effective teacher.
Read More
I Thought Legal Would Catch It. They didn’t.
Early on, I made an incorrect assumption: If I ever wrote something dumb in a report, a supervisor or legal would catch it, fix it, or send it back. That delusion let me sleep, and I never questioned it.
Read More
Is Artifact Worship Killing Your Cases?
If your report is primarily a timeline of artifacts, you cataloged them without investigating. There’s a name for that: artifact worship.
Read More
We’ve (D)evolved from Casework to Toolwork
DFIR training is fragmented, and fragmented training produces fragmented practitioners. And on top of that, we’ve turned artifacts and tools into a fetish, confusing output with understanding and “the tool says…” with a conclusion.
Read MoreDFIR (as we use it) started as a hashtag.
DFIR (the label) started as a hashtag. It didn’t create digital forensics or incident response, but did create a dominant label for both that became a banner and a massive marketing umbrella. This results in the most dangerous word inside that umbrella…
Read More
Your DF/IR Tool Can’t Tell You Who Did It. FACT Tells You When You’re Allowed To.
DF/IR doesn’t usually fail on the technical work. It fails at the exact moment someone gets impatient and confuses activity with identity, and then confuses identity with attribution. “This account did it” becomes “this person did it,” with zero bridge,…
Read MoreFight City Hall: If You Missed the Webinar, You’re Making Mistakes You Don’t Know About
The recording is available today (Friday, November 14, 2025) only. After that, it’s gone permanently. Register to access it here: https://www.suspectbehindthekeyboard.com/offers/S2W6hwau This wasn’t a case study. It wasn’t entertainment. It wasn’t…
Read MorePerfect seizure or total loss? DFIR has the ideal world. Patrol has the real one.
A recent podcast conversation with Jessica Hyde, Debbie Garner, and Kim Bradley brought back a problem I’ve seen for years: the digital evidence guidance written by experts is unusable by the first responders who touch devices first. {source}<iframe…
Read More