DFIR+AI: Making Tool Decisions in a GenAI World
Brief
Build vs Buy. Deterministic vs Non-Deterministic. Validated vs Disposable.
With GenAI, such as Claude and ChatGPT, investigators now have more options about what tools they use during an investigation. Do they use the tools they’ve used for years, have GenAI write a disposable script, or reach for a new “AI-native” tool?
Organizations should take a systematic approach to making these decisions because GenAI is powerful for some things and a waste of time for others. This post gives you a consistent way to evaluate that choice, task by task, rather than picking a side once and sticking with it.
Changes Caused by GenAI
Investigators have always had tool options, including manual vs automated and commercial vs open source.