I’ve spent my career in digital forensics wrestling with two deceptively simple questions: Where do I start and where do I stop, in an investigation? Both decisions feel like drawing lines on quicksand. You’re flooded with artifacts—timestamps, logs, messages—tempting you to search every byte. But legal deadlines and investigative demands force focus. The real skill isn’t just finding evidence but knowing when to stop.
Years ago, I stood in a Colorado courtroom, arguing for the admissibility of a method I had developed to estimate vehicle speed using dashcam footage. The case was heartbreaking. A father riding a homemade motorcycle had been struck and killed by an impaired driver traveling at 105 mph. The only available evidence? The dashcam video from the offender’s own vehicle.
For decades, I’ve seen DFIR lab funding follow a cycle; budget cuts, crisis, then a funding surge. Today I want to share insights from the field and outline how to manage the rising tide of digital evidence amid tighter government budgets.
