The Complete Guide to DFIR by Someone Who Never Did It
If you use AI to summarize everything you read, let me save you the trouble with this one. Me: Summarize this article in 3 bullet points in an 8th grade reading level. For those who actually read what was written, here we go. The Before-LLM time The…
Read More
You suck at DFIR if you’re vibe-coding forensic apps.
I’m talking about the DFIR equivalent of the examiner who clicks a button, gets an answer, and has no idea what happened underneath. I agree that AI is a development tool. Using AI to write code does not make something vibe-coded. A programmer who knows…
Read More
Placing the Suspect Behind the Prompt
We’re headed toward getting really good at proving what the AI did while remaining unsurprisingly bad at proving who put it in a position to do it. We’re building tools to stop the machine, but we also need evidence to identify the person behind it. Ovie…
Read More
Be Wary of Where You Get Your DFIR Knowledge
i wasted $100 so you don’t have to When I write a book, I buy more books. Every time, I end up buying a dozen or more books so I can see what is already in print, cite what is citable, and check whether an idea I think is original already has been…
Read More
Your CTF Has an Expected Answer. Your Investigation Doesn’t.
Capture the Flag (CTF) exercises are one of the ways to learn digital forensics because they make you do the work. You have to find the artifact, understand what it means, sometimes validate it manually, and usually figure out at least one thing you did…
Read MoreAI Has Only Gone on Ride-Alongs With Humanity
AI Has Only Gone on Ride-Alongs With Humanity Some people teach what they know. Some teach what they have done. And some teach what they read in a book and talk as if they did it. That last group is one of my pet peeves, especially since GenAI fits in…
Read More
Your DFIR Tools Are Not the Problem. You Are.
DFIR keeps trying to solve human problems with more software. We add parsers, automation, and larger forensic suites. None of that solved the human problems, so now we added artificial intelligence. Each tool promises to find more evidence in less time,…
Read More
AI Will Have to Pry Judgment from my Cold, Dead Hands
AI is not waiting outside your front door for permission. It is already inside your kitchen and eating your lunch. Now, what are you going to do about it? Side Note: If you are the type of person who thinks a ‘polished’ AI report is a substitute for a…
Read More
AI Can Build a DFIR Course in Minutes. So What Are You Really Paying For?
Every training provider should ask themselves this question before someone else asks it for them. “If AI can reconstruct a course outline in seconds, how does the value proposition rest solely on the curriculum?” Upload almost any DFIR syllabus into any…
Read More
Will Tomorrow Be Your DFIR ‘Mann Gulch’?
Most DFIR training teaches tools. Timelines. X-Ways filters. Database analysis. Registry carving. But it rarely teaches judgment, even though judgment is what saves (or sinks) an investigation when the evidence refuses to cooperate. I understand, tho.…
Read More