From Why to What: The Decline of Investigative Thinking in DF/IR

We used to ask why. Why would the suspect use this device? Why was this action taken at that time? Why does this one detail feel wrong? Now? We only ask what. What tool recovers deleted files? What script finds the browser history? What keyword pulls...