Brett Shavers's Blog

When the Investigation Gets Lost in the Machine

Somewhere along the way, we stopped investigating people and started interrogating machines. I harp constantly on this topic because it is important. I’ve seen investigations where the goal was clear. Follow the evidence to the truth and the technica...

AI in DF/IR: Who is first to pull the rip cord?

I’m all for AI when and if it benefits DF/IR. If it makes us faster, sharper, or more accurate, bring it on, I’m here for it. But the risk is if we charge ahead without caution, we don’t just risk losing the parts of AI that don’t work for DF/IR. We ...

Every Monster Leaves Teeth Marks. Some Go to the Bone.

I just came across a job ad for an ICAC digital forensic examiner. For minutes, I thought about applying. Talk about a strong pull the requirements had/have on me… To be honest, I still think about constantly…I used to chase monsters like that job ca...

DF/IR Isn’t About Computers. It’s About Hunting Humans.

Data is the trail. Humans are the quarry. This is my opinion response to a solid LinkedIn post that asks a very important question: “How do we fix DF/IR so different paths don’t lead to different answers?” (paraphrased) Humans first. Technology secon...

Lazy* police work results in arresting an innocent person.

Aka: The Machine did its job. The lazy* human did not. https://petapixel.com/2025/08/28/new-...  Stop Worshipping the Magic Box Here’s the creeping canc...

Courtroom Trials Are the Final Exam for Your Work. Why Haven’t You Attended One?

Every digital forensic examiner, eDiscovery professional, and evidence handler eventually faces the same reality: the courtroom is where your work either stands or collapses. Yet, many in our field have never even sat through a trial, hearing, or sup...

Tech skills are cheap. Legal knowledge is priceless. Mindset is everything.

Tech Skills Question: Is there an easy way to find out if the Windows registry can be found in memory, and if so, can you collect it and if so, exam it with a forensic application? Answer: Yes, yes, and yes. A quick Internet search will give you URLs...

From Bailiff to Juror #12: How Every Courtroom Role Scores Your DFIR

Every face in the courtroom judges you and not just the one wearing the robe. I’ve reflected on my courtroom experience and giving you the highlights of perspectives of a DF/IR practitioner from every angle of the court that I sat. On Thursday, Augus...

DF/IR Paralysis: What to Do When You Don’t Know What to Do

If you are like me, you have found yourself biting off more than you can chew, wading in water that was deeper than you thought, and reached a point of ‘what do I do now?”. And it happens more than once (am I oversharing…?). Things like staring at a ...

How Sitting in 14 Legal Roles Created My DFIR Investigative Mindset

The DFIR investigative mindset no one teaches you but everyone judges you by. Most people in DFIR hear “investigative mindset” and think it means one of three things: Be curious.Think like a criminal.Ask better questions. That’s beginner-level thinki...