DFIR and DOGE: Digital Forensics in a new funding environment
Originally published in the May 2025 issue of Magnet Unlocked. Want to be the first to see new content? Sign up for our monthly newsletter, Magnet Unlocked.
For decades, I’ve seen DFIR lab funding follow a cycle; budget cuts, crisis, then a funding surge. Today I want to share insights from the field and outline how to manage the rising tide of digital evidence amid tighter government budgets.
The Familiar Budget Rollercoaster
I was recently speaking with a former colleague from a major federal agency who confided that retirement offers and cut notices were circulating—but no one knew which positions would vanish. Rumors flew faster than official word, panic was setting in, and my friend wanted to know if we were hiring. Sound familiar?
I saw firsthand the real sting of this cycle back in 2015. In speaking with a large financial institution, I saw that they were writing off hundreds of millions each year in fraud. Why? Simply because the volume was so high and the cost to investigate was also high. Those losses? Ultimately, passed on to consumers through higher rates and fees. Fast forward to last month’s headline-grabbing crypto exchange hack; hackers demanded a $20 million ransom, but clean-up and remediation are now pegged near $400 million—with a 6% stock-price dive adding insult to injury.
Now we’re back in the bottom side of the churn, and I’m fielding calls from lots of former colleagues asking me what they should be doing in this uncertain environment. Here’s what I’ve been telling them!
Automation as Your Ally
When budgets shrink, headcount is the first line item managers look at. But obviously the data volumes only grow, so what can you do when you suddenly have half the people investigating twice the cases?
Work smarter, not harder. Automation solutions—whether on-prem or in the cloud—can tackle repetitive intake, parsing, and initial analysis. Free up your scarce human capital for the deep dive machines can’t handle. In my consulting work I’ve seen tools like automated evidence ingestion and review slash man-hours by 40–60%, paying for themselves in reduced overtime and contract-for-hire costs. But not everything in forensics can be done by a machine, or by an examiner pushing buttons. It requires an investigative mindset, creativity, curiosity, and experience. Leverage automated tools to free up your team to do the kind of forensics work only a human can.
Preserve Institutional Knowledge
Here’s an under-the-radar crisis; veteran DFIR talent walking out the door. I’ve fielded more than 20 calls from worried federal agents and special agents considering early retirement or a jump to the private sector just to escape the uncertainty. When experts with 10–15 years of experience retire, they take priceless knowledge of casework, data structures, and courtroom testimony with them (not to mention the credibility in the eyes of a jury their tenure brings).
How to safeguard your team’s know-how:
- Document everything: Build playbooks of evidence-handling protocols.
- Mentor proactively: Pair seasoned analysts with junior hires on real cases. There’s no substitute for real apprenticeship in this field.
- Invest in training: Beyond vendor certifications, tap into free training being offered, government-sponsored training is also available to keep your people sharp on mobile, network, vehicle, cloud, and emerging IoT forensics.
Seek Alternative Funding Streams
If your budget is on life support, seek new capital:
- Grants & partnerships: Many law-enforcement and non-profit programs offer grants or free training credits. Applying for these can be time consuming; we have a grant writer at Magnet to help you, so don’t hesitate to reach out.
- Strategic contracting: Weigh the ROI of outsourcing workload spikes vs. building in-house capacity, explore creative ways to maximize your budget.
Don’t Panic!
Rumors are exactly that. Wait until you see the official bulletins, and remember this cycle of slash and build is not new. Its been going on for a long time, and the industry has always survived, because the work we do is essential. If that isn’t clear to budget decision makers right now, it will be soon. All it takes is a big breach, or enough time with evidence in the backlog, to wake folks up to the importance of investing in DFIR.
Though the DFIR funding landscape may look rocky, it’s also ripe with opportunity. With smart tools, creative funding, and a commitment to preserving expertise, you’ll be not just resilient but even more effective than before.
Authored by one of our experts, Steve Gemperle.