The State of Enterprise DFIR survey is now open until October 31, 2025. DFIR is facing a huge inflection point. Between artificial intelligence, increasing digital endpoints, and other unique challenges, the field is changing at a rapid rate. Those in the industry need to know how to keep up. That’s why we want to hear from you.
In digital forensics, the fight against technology can sometimes get in the way of the fight for justice. Whether it’s an encrypted phone sitting in a lab queue awaiting support or a crucial lead buried in gigabytes of data, solving a case can sometimes come down to a single update or surfacing a single artifact. And in some cases, that one artifact doesn’t just whisper its significance—it screams.
Photos, videos, and other media files have become critical to investigations. They establish timelines, corroborate witness statements, and reveal details that would otherwise be overlooked. But media is also one of the easiest forms of evidence to manipulate. Editing tools are widely available and simple to use. Metadata can be easily altered with minimal technical knowledge. Deepfake and AI-generated content continues to evolve, making it harder to distinguish authentic from manipulated media. Attorneys may question whether a file is genuine, and investigators must respond with authoritative answers that can withstand scrutiny.
What was once an amusing novelty has become a systemic threat to global business. Deepfakes, synthetic media, and AI-generated material have infiltrated private enterprises, and their presence is now being felt across financial services, insurance, retail, human resources, ecommerce, and more.
When I first began trying cases, digital evidence wasn’t even part of the case. It simply didn’t exist in the courtroom. At most, you might see a phone bill or a stray email, but the real drama played out through eyewitnesses, physical evidence, and confessions.
“Push-button forensics” is often viewed skeptically and criticized as a shortcut or a threat to expert examiners. In reality, digital forensic tools designed for ease of use aren’t about replacing human expertise. Their true purpose is to streamline repetitive, time-consuming steps, enabling forensic examiners to focus on what truly matters: in-depth analysis, context, and human judgment.
Too often, devices sit for weeks while the balance between thorough, defensible work and timely insight gets lost. When I was part of the West Virginia State Police and ICAC Task Force, I had to rethink how to strike that balance.
I’ve spent my career in digital forensics wrestling with two deceptively simple questions: Where do I start and where do I stop, in an investigation? Both decisions feel like drawing lines on quicksand. You’re flooded with artifacts—timestamps, logs, messages—tempting you to search every byte. But legal deadlines and investigative demands force focus. The real skill isn’t just finding evidence but knowing when to stop.
Years ago, I stood in a Colorado courtroom, arguing for the admissibility of a method I had developed to estimate vehicle speed using dashcam footage. The case was heartbreaking. A father riding a homemade motorcycle had been struck and killed by an impaired driver traveling at 105 mph. The only available evidence? The dashcam video from the offender’s own vehicle.
For decades, I’ve seen DFIR lab funding follow a cycle; budget cuts, crisis, then a funding surge. Today I want to share insights from the field and outline how to manage the rising tide of digital evidence amid tighter government budgets.
