AI in DFIR 101: Why AI isn’t Good for DFIR Collections
Brief
AI is useful in investigations, but the collection phase is not one of those times. During collection, you may have one shot at getting the data you need. You need determinism, which AI doesn’t provide. But, we’ll talk about how AI can be useful when you are desperate and out of options.
The Collection Phase
The collection phase happens early in an investigation when you copy data that could be relevant to your investigation.
Examples:
- Retrieving telemetry or logs from an API
- Copying registry hives, event logs, and executables from a host
- Making a full disk or memory image of a host or VM
Collection happens after the planning phase, which is when you identify what you want to collect.
Your goal is to access the data and get a copy before it goes away. In some situations, you can go back and get more. In others, you may really have one chance.