I Was There When Digital Forensics Lost Its Soul.

We built an assembly line of bots to learn forensics and forgot why the field existed in the first place.

The Origin Story We Forgot

Before anyone called it “digital forensics,” it was just investigation. Law enforcement investigators, not academics or vendors, were the ones who figured out how to handle electronic evidence. Actually, there were no vendors or academics.

They didn’t have textbooks, certifications, or conferences.  But they had cases. And their cases had victims.

When the first waves of forensic experts entered the private sector, most came from that world. They already knew how to investigate, how to connect motive, method, and opportunity. What they lacked was technical training.

In came forensic training filling that gap: teaching technology to investigators. None was teaching investigation to technologists. It produced competence because it assumed one non-negotiable fact: The goal of forensic work is to prove something true, which is what every investigator already knew.

The Inversion

Then the pipeline reversed. Private-sector education discovered profit. Universities rolled out 25 flavors of “cyber forensics” degrees. Online academies began selling quick certifications and bootcamps with high-salary, job placement promises. 

Today, most people entering DFIR come from the opposite direction. They have technical education, but no investigative foundation other than what they see in movies.

They can parse data but not defend conclusions. They know workflows, not logic. They can process artifacts but not connect behavior.

The industry has been teaching how to click, not how to think.

And employers rewarded it.

“Bachelor’s required.”
“Master’s preferred.”
“XYZ certification a plus.”

Human-resources departments couldn’t measure competence, so they outsourced trust to paper. Now the field is full of analysts who can pass a test but can’t pass legal scrutiny.

The exceptions

Let me interject something before some heads explode. I know many, and I mean many examiners who can investigate as if they were born to do it having never worn a badge. These are the (1) natural investigators and those (2) who have worked LOTS of cases and figured it out on their own.

And yes, there are investigators teaching higher education. Again, (1) you know this doesn’t apply to you and (2) you know that this is all too true.

I am not talking about these groups in this post as they don’t represent the entire field of DFIR.  They are outliers.

The Incentive Problem

Teaching investigative reasoning is hard. It’s slow, subjective, and doesn’t scale. It is also difficult to measure.

Teaching button-click workflows is cheap, fast, and easy to monetize. So, the market optimized for speed, scale, and sale, not for skill. Training vendors sell certificates. Schools sell degrees. And professionals collect both to prove motion and not mastery.

We stopped producing investigators and started producing graduates.

What We Stopped Teaching

Before I sat behind a forensic workstation, I spent a few years overseas in the Marines, training with foreign nations and learning firsthand how differently people live, think, and fight, and how similar they are when it comes to fear, pride, and survival. Human nature was the big lesson.

After that, and even before sitting behind a forensic workstation, I spent years behind jail cells…working in them. As a corrections officer (aka: jailer), I made intentional conversations with thousands of inmates during booking, daily rounds, mealtimes, and releases.

I wanted to know why they were there. What led to that arrest? Was it their first time or their fiftieth? How did they get into (whatever crime they kept doing)? What choices, habits, and justifications led them to this point? How do they think?

Those conversations, with people who had spent their lives making bad decisions and living in the criminal justice system, taught me more about motive, opportunity, and rationalization than any textbook ever could.

Later, nearly a decade working undercover filled in the rest of the criminal human behavior lessons for me. I experienced firsthand how people lie, minimize, and justify when the stakes are real. I was in their clique, daily, seeing from their perspectives, planning crimes, and understanding their view of the world and how they react to it. That experience changes how you see evidence. You stop looking for files and start looking for behavior.

So, when digital evidence entered the picture for me, it was instinctive. Investigating crimes involving computers wasn’t a new skill, it was just a new medium. Bits instead of fingerprints. Logs instead of statements. But the human behavior behind them never changed.

And that’s what DF/IR education has largely forgotten. We teach the registry like scripture but not the psychology of the person who created the artifact. We’ve made technicians out of people who were supposed to be investigators. That is fine and dandy for data analysis, but DF/IR is much more than that.

The Cultural Decline

Law enforcement no longer drives the pipeline into DF/IR. Private programs and online schools do.

Those who never investigated real cases are producing thousands of graduates who’ve never investigated either. The graduates mastered parsing, extraction, and reporting but not reasoning, attribution, or defensibility. At times, they haven’t even mastered these things.

The lineage has flipped: Where investigators once learned technology, now technologists pretend investigation is optional or ignore it altogether.

We’re left with professionals who can operate every tool in the drawer but can’t explain why they used them or understand the motives behind the events.

The Result

We’ve built a profession that rewards paper over proof. We have more people qualified on paper than competent in practice.

DF/IR has become an assembly line of analysts who can extract data but can’t explain human behavior, the very thing the job was built to uncover.

We replaced logic with logos, competence with credentials, and judgment with jargon. We borrowed the language of war (battlefields, kill chains, war rooms, red teams) but not the discipline, command structure, or consequences that make them mean something.

We built a field of collecting certs, playing pseudo forensic games, and conducting academic research in novelty areas that rarely impact investigations.

And we wonder why the courtroom keeps eating us alive.

The Way Back

The fix isn’t new technology. It’s old discipline. What is old is new again. The way back isn’t through innovation. It’s through restoration.

Train judgment, not checklists.
Hire for competence, not credentials.
Teach investigation, not imitation.

Digital forensics began as an investigative pursuit, a method for proving truth through evidence, logic, and defensibility. It still can be. It has to be.

But it won’t happen through another certification or degree program.

Tools don’t testify or think. You do.

More of Brett’s opinion

I’ve watched this shift happen for over two decades, from the jail, to undercover work, to the lab, to the courtroom. I’ve seen smart analysts fail under questioning and average investigators win cases because they understood one thing: how to build and defend a case.

At a minimum, if you remember the goal of your case (aka: legal matter, civil matter, corporate matter, or incident), you will use your technical skills as a means to solve the problem and not just use your technical skills.

Do you keep taking training and never feel like you are improving? Do you forget in a week what you spent a week learning in a technical class? Do you ever stare at data and wonder what you are supposed to do? If so, this entire post is your reason why.

That’s why I built PSBK CASEWORK. A one-day, live course designed to reconnect DFIR with its investigative roots.  And why I continue to write the Placing the Suspect Behind the Keyboard series, not as technical manuals, but as roadmaps back to the kind of thinking that created this field.

If you lost your investigative edge with all the training, let me help you get it back. If you do pretty well in the investigative side of things, let me sharpen your skill. If you have no idea of why an investigative mindset is important, let me light the path for you.

We have lots of technical training. But there is practically no DF/IR investigative training, because it is simply difficult to articulate, teach, and test it, especially if one has never done it.  https://www.suspectbehindthekeyboard.com/psbk-casework 

If you want to see how your work looks from every seat in the courtroom, join me for the free webinar Every Seat but the Judge’s https://www.suspectbehindthekeyboard.com/opt-in-3ecc8d3a-fb08-4ade-8198-df2181a9a5dd) We’ll walk through how investigators, defense, and jurors view you and your case, and how that perspective changes how you write, analyze, and testify.

Last word on tool training: it is necessary, mandatory, and the fastest way to learn how to effectively use a tool and be taught its underlying behavior. I am a huge advocate of tool training.