Walk before you run: The digital forensics fundamentals we’re still skipping

Authored by Rhys Tooby

Originally published in the October 2026 issue of Magnet Unlocked. Want to be the first to see new content? Sign up for our monthly newsletter, Magnet Unlocked.

---

Sometimes our instinct is to chase a new and exciting tool, even though there’s proven technology we know how to use and agencies aren’t using properly.

It’s been more than eight years since I last worked a case as a police examiner, but I’ve kept close ties to the job. When I catch up with old colleagues, the conversation always lands on AI and how it will change everything. I understand the fear and excitement.

But I keep coming back to a less fashionable thought: Don’t run before you can walk.

Digital forensics already has proven technology and well-understood techniques. The challenge is making them work consistently at scale.

None of it is sci-fi.

All of it could be invested in tomorrow.

The engine under the bonnet

Automation is rarely the sexy tool in the room. It’s the engine under the bonnet (or the hood, depending on which side of the Atlantic you’re reading from). Nobody gets excited about it, but nothing moves without it.

Here’s a scene every examiner will recognize. You start imaging a drive and head home at 5:00PM. The image finishes at 6:00PM, or 2:00AM, and then it just sits there. You come in the next day, kick off processing, and wait again. The data is right there. You just can’t look at it yet.

When I was honest about my own lab, the truth was uncomfortable. We’d spent serious money on workstations, and I’d estimate they sat idle about 80% of the time. That wasn’t because the work was done. The jobs had finished and the humans had gone home to family, friends and a life outside the lab. That’s how it should be. But the machines don’t need to clock off. They can run 24/7, moving from acquisition to processing to the next item in the queue while we sleep. That’s the most basic case for automation, and it’s still underused.

Why aren’t we doing it?

People expect me to say the barrier is fear that automation will replace examiners, or a lack of understanding.

Honestly, I think it’s time.

Units are fighting backlogs every day. To implement automation properly, you have to put the tools down, step back and rethink how work moves through the lab. When you’re always chasing, there’s never a good moment to stop.

That’s exactly why it’s worth making the moment. Every hour spent setting it up comes back as hours you’ll never spend babysitting a progress bar again. And you don’t have to work it out alone. Plenty of agencies around the world have already walked this road, and that experience is there to share.

The case we nearly missed

Near the end of my policing career, a CSAM investigation was coming to its conclusion. There was a particular username that has been flagged in the chats. An officer went on his lunch break and mentioned it to a colleague, who stopped him because he recognized it. He went back through his own case files and found the same username in an investigation he’d done six months earlier.

That link opened up a network of offenders, and more than 160 victims.

The breakthrough came from a colleague recognising a username and connecting it to an earlier investigation. It was a powerful reminder of how much valuable intelligence sits across individual cases, and what becomes possible when those connections are made.

The identifier had been on our server the whole time. Two investigations, two examiners, two sets of intelligence — each holding a piece of a much bigger picture. What connected them was a conversation between two colleagues over lunch.

It stayed with me. Not because anyone had failed to do their job, but because it showed just how important it is to make connections between investigations, intelligence and the people working on them. Sometimes, a single link can change the scale of an investigation — and the number of victims we can identify.

This isn’t unique to CSAM. Drugs, fraud, anywhere like-minded offenders talk to each other, the same thing happens. Our intel points us at the investigation in front of us, we work it, and the next team does the same with theirs.

Nobody puts two and two together, because nothing in the system is built to.

Fix your current workflow, then implement AI

People often assume this story is a pitch for AI.

What would have caught that link is simple: extracting identifiers and searching across cases. Usernames, phone numbers, email addresses, bank account and card details. Pull them consistently from every case, keep them in one place, and flag when something you’re looking at today has appeared before.

It doesn’t have to make the connection for you. It just has to put its hand up and say: this username appeared in another case; someone should take a look. That flag alone gives you a way to triage all the “big data” we keep talking about. Because it’s built on known identifiers, you can trust what it’s telling you.

Think about the terabytes sitting on unit servers right now. When we say big data, what are we actually looking at? What have we missed that we don’t even know about? That was my gripe for years, and the answer was never more horsepower or a smarter model. It was getting the basics organized.

Updates in Magnet Axiom reflect just that, identifiers from Axiom now feed into the Griffeye Intelligence Database (GID) in Magnet Griffeye. That kind of joint thinking simply didn’t exist when I was in the lab.

Get that foundation right and then layer AI on top. Ask it to build out trends and surface patterns. It will be far more useful sitting on clean, connected data than on a pile of disconnected exports.

Don’t automate the instinct away

There’s a flipside to that lunch-table story. The connection happened because an investigator recognized something. That’s old-school police work, the kind of memory-and-hunch link you’d expect from a Sherlock Holmes story.

Automation and AI can do an enormous amount for us. They don’t replace the instinct of someone who has seen other corners of criminality and knows when something doesn’t sit right.

The best setup is one where the tools raise the flag, and the investigator brings the judgment. That means keeping relationships and conversations alive across the department, not just inside the lab.

Opening the door

One more thing has changed since I left the workforce. People joining policing now grew up with smartphones and apps. Digital forensics used to sit behind a closed door, the geeks in the back room who’d sort out that bit of the case.

That model doesn’t scale anymore.

We used to say 95% of investigations involve digital data. I suspect it’s even higher now. If you’ve got a phone in your pocket, it’s tracking your location.

So, the next tipping point is opening; sharing data across the organization and letting more investigators help. Which brings us back to the start. You can’t open the door if what’s behind it is a backlog and a server full of data nobody can search.

Walk first. Put the idle hours to work. Build the database. Cross-reference the identifiers. Then we can talk about running.