Early on, I made an incorrect assumption: If I ever wrote something dumb in a report, a supervisor or legal would catch it, fix it, or send it back. That delusion let me sleep, and I never questioned it.

If you write forensic reports in a legal matter, including an employment issue, this can happen to you, even if your forensic work is solid.

A case that I never expected to go to trial went to trial. In my report, one lazy sentence of “the suspect did X” made one of the worst trial experiences for me (I’ve had several, by the way…). I have since found that I have not been the only one who has done this, including experienced practitioners, including recent cases. IE: it has happened. it is happening.  it will probably continue to happen to those who don’t realize it until learning the hard way.

In that trial, the opposing counsel zeroed in on my words, not the evidence. I spent the entire morning on the stand defending phrasing instead of evidence or my work. Looking at the prosecutor from the stand was humiliating because it was no longer about the evidence. The trial was about me and nothing the prosecutor could do would save me.

The worst pain was when opposing counsel read my words back to me, slowly, with emphasis, while the entire courtroom watched. A full-body cringe moment.

Side note: Free training session on attribution this Thursday, Feb 5.
11:00 AM PACIFIC / 12:00 PM MOUNTAIN / 2:00 PM EASTERN.
As of Monday morning, 200+ registered. Cap is 300.
Secure your seat: REGISTER HERE

This still happens, and I think the reason is because of not being clear in what “attribution” really means, who can say it, who assigns it, and how to do it.

FACT: Don’t assume that legal will catch your DFIR errors.

Attorneys are rarely DFIR experts and DFIR experts are rarely attorneys.  I know some of both. But generally, attorneys don’t live on the edge between “shows” and “did.” They see “expert” or “certified” and assume you stayed in your lane because you should know your lane. By the time issues surface, case strategy is locked, declarations and affidavits are signed, and “what I meant to write” is worthless.

I’ve seen wording do more damage than most other mistakes because it’s what gets read aloud. Claiming attribution is the real danger, saying “who did it” without knowing or being able to explain the types of attribution and identification.

Most practitioners don’t realize they’re even making attribution claims. They think they’re “just describing artifacts” but attribution sneaks in. Sometimes questioning tries to force you to make those statements to discredit your testimony. Sloppy or imprecise wording implies sloppy or imprecise forensic work.

That’s a danger zone if you venture out of your lane.

Are you the DFIR examiner, looking only at data? Then your lane is Technical Identification.

Are you the case agent or a DFIR examiner who considers evidence outside the data? Then your lane is Investigative Attribution.

And that is as far as we go. Legal attribution is outside of our lanes. Guilt, responsibility, and accountability are for the adjudicators.  

We write conclusions to “help the case.” The attorney assumes it’s solid because we are certified and trained. The case strategy builds on it. Then the opposing counsel picks your report apart like a menu, and you (not your supervisor or attorney) are on trial.

Rule I live by: If my name is on it, I own it. 

Your report isn’t a draft for legal to fix or make sure that you are correct. It’s discoverable and can be used for impeachment. Sometimes, it’s the centerpiece of a case. Yes, some attorneys are really good at finding your errors and mistakes to prevent them from wrecking a case, but do not count on being saved by someone else.

I can tell the future: Your next report could end up in court. A report you wrote months ago can end up in court. Relying on “legal will catch it” will catch up with you at the worst time, in the worst case, to give you the worst day, even if it was your best work. Thinking your work isn’t important enough or it’s not a legal case (yet) will be a big regret as you figure out what to wear responding to a subpoena.

If your forensic work affects attribution, join me this Thursday, Feb 5, for a free training session (live, online) on building defensible attribution.

Investigative Decision-Making in DFIR: Defensible Conclusions & Attribution

DATE: Thu, Feb 5, 2026.  

TIME: 11:00 AM PACIFIC  / 2:00 PM EASTERN  (under 60 minutes)

ACCESS: Live, online with a 24-hour replay (then it is gone)

You’ll get:

• An attribution system I wish I had before that day on the stand
• A breakdown of a real case where language, not forensics, killed attribution
• My own “I can’t believe I wrote that” lines and how I’d fix them today
• A downloadable wording ladder and checklist you can keep next to your report template
• Certificate of attendance

Register here (free): REGISTER HERE

Don’t wait to learn this lesson the way I did, under oath, with your credibility on the line.

See you Thursday.

Brett