The Complete Guide to DFIR by Someone Who Never Did It

If you use AI to summarize everything you read, let me save you the trouble with this one.

Me: Summarize this article in 3 bullet points in an 8th grade reading level.

ChatGPT:

• AI makes DFIR writing fast and easy, but polished writing does not prove the author has real knowledge, testing, or experience.

• The bigger problem is trust. AI-generated content can hide weak sources, bad references, and errors, making it harder to know what information is reliable.

• AI should support human thinking, not replace it. Strong DFIR writing should show real testing, observations, mistakes, evidence, and clear responsibility for every claim.

For those who actually read what was written, here we go.

The Before-LLM time

The effort it once took to research, write, edit, and publish is part of what made DFIR content valuable in the first place.

I’ve never had this much DFIR content available so quickly in the form of artifact guides, tool comparisons, “Top 10 Lists,” LinkedIn tutorials, blog posts, and explanations of forensic artifacts that somebody learned 15 minutes earlier.

I’ve already written a little about LLM created DFIR books here: https://www.dfir.training/blog/what-400-dfir-books-tell-us-about-the-field

In the Before-LLM time, you had to know something, make a decision if it was worthwhile writing about, organize the ideas, research it, write it, edit it, and push the publish button. Now, you simply ask AI (aka: LLM) to do all of that for you. You don’t even have to spell check anymore, meaning many won’t even read what the LLM wrote for them.

I’m not against AI in writing if it is used as ‘AI-assisted,’ like a flow or grammar check. We’ve been doing that with MS Word’s spell and grammar check since the 90s. I am saddened by AI taking the good ways we wrote and turning it into AI writing tells. As one example, the “not X but Y” was a favorite of mine, but now I have to hunt through my writings to make sure I don’t do that anymore. LLMs took that from writers.

The machines learned to write like us. Now we’re learning to write unlike ourselves so nobody thinks we’re machines.

This Is Not Entirely Bad

Whatever you want to “learn” in DFIR you can find online today. LLMs can organize your notes, summarize and translate a comprehensive paper at an 8th grade level, and generate questions that can lead to new research.

AI can reduce the mechanical cost of communicating knowledge but that does not mean the person publishing it possesses the underlying knowledge.

The Problem is DFIR Content Without DFIR Experience

Traditionally, writing anything about DFIR had a serious friction point in that it was enough work to make sure you got it right that many never would write. For those who have written a blog post, and maybe this is just me, but a single blog post can take days to write, or more than a week before publishing it. That’s if you are writing it yourself. With an LLM, it takes less than a minute.

Working in DFIR (or any field actually), one would solve a problem, reflect on how they did it because there was no playbook or standardized dashboard, and then write a post or paper from their handwritten notes.

“I dealt with this problem. I tested these possible solutions. I discovered how the problem was created. I solved it. Here’s what I Iearned.”

Today, with an LLM…

“I asked AI to write an article about a problem and solution that I never experienced.”

This has given us a tidal wave of content of “A Complete Guide to Windows Prefetch” by someone who might have never even seen a Prefetch file. Unfortunately, the text might be accurate, but the source is an LLM, not from a person’s experience. Even if the LLM is drawing on human-generated source material, eventually this becomes garbage as a source.

We are losing provenance in our source material. Even with some highly experienced practitioners, I have personally seen some of my writings wildly inaccurately referenced that they were nearly opposite of what I wrote. The apparent issue is trusting what AI writes without even reading to verify if AI got it right. I don’t get it.

Pen → Keyboard → Prompt

Every sentence written with a pen requires deliberate motor action (physical effort!). You first have to generate a thought, then decide which word to write after each word you decided to write. This requires both physical and mental labor.

This is helpful to write the fewest words to convey your point, which requires you to critically think while you critically write. There is more of you in those words. And research suggests the physical act of handwriting engages the brain differently in ways associated with encoding and memory.

Typing removes much of the fine motor skills to produce letters, but there is still a constant physical action of typing and reading the words appearing on the screen. You still need some level of cognition to type coherently.

Expensive words are written. Typed words are cheap. AI words are free. If something is ‘free,’ you are more apt to treat it as something you found on the sidewalk.

The cost of writing a 500-page book with an LLM is for all practical purposes, approaches zero. I recently spoke to someone who wrote a ‘book’ using an LLM for most of the book. The conversation didn’t go far. This person never wrote a book before (with or without an LLM) and doesn’t have the concept, nor will consider, the difference between personal experience conveyed versus AI-generated.

Reading Is Thinking Too

The same problem exists on the other side. Critical reading requires attention, interpretation, comparison with what you already know, deciding what is important and true, and building a mental model of what you read.

That effort is partly what produces comprehension. Then we created “Summarize this.”

Comprehension went out the window because the AI determined what you needed to know, how you needed to know it, and what was true. Near-zero cognitive effort required. I’m being hyperbolic on purpose.

The perfect cycle

• Author: “Turn my five bullets into an article.”
• AI: writes 2,000 words.
• Reader: “Summarize this for me in five bullets.”
• AI: reduces it to five bullets.

AI can assist learning when it supports cognitive work. It can undermine learning when it replaces cognitive work.

We Are Outsourcing Both Ends of Communication

Historically: Human thinks → Human writes → Human reads → Human interprets.

Increasingly: Human has an idea → AI expands it → AI publishes it → Another AI condenses it → Human reads five bullets.

Why create the 2,000 words at all?

We may be building an enormous layer of machine-generated prose whose primary consumer is another machine.

Are people using AI to satisfy algorithms? SEO? LinkedIn? “Thought leadership?”

The Scarcity Goal Post Has Moved

Information used to be scarce. Now the scarce resource is attention, verification, curation, and trust. Ten thousand times the number of Prefetch articles are not necessarily ten thousand times more useful when you don’t know which one is correct, or who tested it.

Curation Becomes More Valuable Than Creation

The old internet rewarded creation. The AI internet may reward trustworthy selection.  The cheaper information becomes, the more valuable human filtered becomes.

The Trust Problem Is Worse in DFIR

Before generative AI, a long technical article represented at least some investment by its author. We have always had published garbage, but generally, you can tell. With “polished” prose, the evidence of no knowledge, experience, or testing is hard to find. Anyone, literally anyone who can type a halfway coherent prompt could publish a “polished” 5,000-word “Complete Guide to Prefetch Forensics.”

We obsess over provenance when dealing with evidence. Maybe we should start caring about provenance when dealing with expertise.

Suspicion Is Becoming the Default

This may be one of the worst unintended consequences. I used to read an excellent technical article and assumed somebody probably knew what they were talking about.  Now I question it every time. This hurts legit experts and practitioners.

I’m at the point now that if there isn’t a named person behind content, I don’t bother reading it. Same with forensic tools. If a legit company or named person isn’t on the tool, I won’t even watch the demo, let alone install it.

Using AI/LLMs to assist in writing is fine, in my opinion anyway. It just depends on if it is being used to accelerate one’s expertise and at the same time, not simulate it.

A Better Standard for AI-Assisted DFIR Writing

DFIR content needs more war stories. More ‘I tested this.’ More ‘I observed this.’ More screenshots. More datasets. More versions. More failures. More ‘I thought this would work and it didn’t.’

The author remains responsible. Your name is on it. You own every claim. As a side-note, this helps finding out when you were wrong, and you can self-correct. That is important.

For the DFIR Newcomers Writing and Sharing

Tell your war stories. If in school, describe the classroom problem. If new in the field, share what you actually have done. In time, you gain provenance. Not the first week and maybe not the first years. It will come, but not by asking AI to write everything for you.

My Closing Argument

AI has solved the mechanical problem of producing words. It can also imitate the language of experience, judgment, curiosity, verification, and critical thinking. That is not the same as having done any of them.

We spent decades making information easier to create and easier to consume. We may eventually discover that the effort required to create it and consume it was part of what made it valuable in the first place.

A test for you

If you made it this far without asking AI to summarize it, tell me where I’m wrong or right. Don’t just click Like. Challenge something I wrote here in the LinkedIn comments (https://www.linkedin.com/pulse/complete-guide-dfir-someone-who-never-did-brett-shavers-hhhmc).

More important is that it would at least prove we both did some thinking.