The Human Element of DF/IR (YOU!)

The clock is racing. A global breach is unraveling on one side of the room; millions siphoned in real-time, systems crashing, and reputations crumbling by the second. On the other, the unthinkable: a child has been taken. A predator lured her online, and you know that the trail will fade. Two cases. One team. No matter how advanced, the tools are drowning in noise, false positives, and chaos, unable to decide what matters most. Tools can’t think. Tools can’t prioritize. But investigators can.

This is where the investigative mindset separates the leaders from the rest. It’s the ability to dig deeper, adapt under pressure, and see through the noise when everything is on the line.

A Decade+ of Harping on the Investigative Mindset

In 2013, I wrote about the investigative mindset in Placing the Suspect Behind the Keyboard. But I’ve been harping on it long before then. Working hundreds of cases, from human trafficking and international organized crime to terrorism, I’ve seen this mindset make the difference between success and failure.

While DF/IR tools have evolved into powerful assets, I’ve also seen their misuse dull investigative skills. Tools don’t do forensics – you do. A tool should amplify your skill, not replace it.

Writing from Experience

Everything I write about the DF/IR investigative mindset comes from me. Not just from theory. Not only from secondhand accounts. It comes from my own mistakes, failures, and successes. I’ve misinterpreted evidence, made mistakes, made errors, and learned the hard way. But I’ve also run behind great investigators (literally ran behind them in the field to catch up!) learning how they think, how they act, and how they make decisions. I’ve interrogated the best interrogators in how they are the best in investigations to learn.

Why the Investigative Mindset Deserves Its Own Spotlight

As I have been working on the latest update to Placing the Suspect Behind the Keyboard: DF/IR Investigative Strategies, I reached the chapter on the investigative mindset and knew it couldn’t stay just a chapter. This topic deserved its own book. It’s a skill so foundational and critical that it couldn’t just be one piece of the puzzle. That realization led to the creation of a book: DFIR Investigative Mindset.

Let me be clear: theory alone doesn’t solve cases. I’ve been in classrooms where instructors with no real-world experience lecture about investigations when they themselves never investigated. I’ve also heard some say that this can’t be taught, which I interpret as them not being able to articulate it, let alone teach it.

It is one thing to talk about doing something you’ve never done and quite another to be under the gun doing it with real-world consequences. Training must move beyond theory. It must be practical and useful.

When I write or teach, I aim to provide strategies that can be applied immediately, whether chasing a breach or finding a missing child. It’s about real-world action, not abstract concepts.

Giving Back to the Community and Making a Point

To ensure this message reaches as many investigators as possible, I’ve personally given away over 1,000 copies of DF/IR Investigative Mindset to examiners who took up a challenge, colleges, students, and reviewers. And I’m thrilled that Magnet Forensics purchased 50 copies to give out for their upcoming MVS conference (sign up! it’s free!).

—————-

Look what @MagnetForensics is giving out to some lucky attendees of my presentation on Feb 11! I just signed each one :)

Sign up! It’s free and online.https://t.co/kvs168iv3s #DFIR pic.twitter.com/8KYX73iQsu

— Brett Shavers ? (@Brett_Shavers) January 23, 2025

—————-

For those who bought the book or took my training in this topic, you directly impacted others because in cumulative book purchases, I could give away so many. If I could, I’d make sure this book was in the hands of every investigator at every DF/IR event, because it’s not just a book: It’s the foundation of our craft.

Fix what is broken

In a previous blog post, I asked my peers, as well as those more experienced and competent than me, what will be our legacy in this field. I didn’t ask that question for credit but to fix what we know to be broken. I foresee a broken DF/IR field if we don’t fight the temptation of letting tools do forensics. I don’t want that to be my legacy, to let something become broken when I could have helped fix it. Exploit the tools to do your job better.

Don’t be tricked by thinking the tools can do your job.

Final Thoughts

Here’s the bottom line: tools will come and go. Technology will evolve. But your ability to think critically, prioritize, and follow evidence where it leads will always set you apart.

If you don’t have a copy of DF/IR Investigative Mindset, get one. Whether you buy it, borrow it, or win it as swag, it’s worth it. A DFIR tool will never save a person or save a business or make a case. It is only the human element that makes the case using tools.