Don’t Marry the Suspect
Brief
Bad investigators look for proof they were right. Good ones look for where they are wrong.
The fastest way to damage an investigation is to fall in love with the first answer that feels right or you want to be right or you are just too impatient to wait for the right answer.
The wrong answer might be a person or a theory. It might be an outside attacker, an inside employee, malware, a bad tool result, a disgruntled user, or whatever story makes you feel better or closes the case faster.
That is what I mean by don’t marry the suspect.
Once you marry it, everything changes. Every fact gets pulled toward it, the weak points get rationalized away, and every contradiction becomes “probably nothing” or “unrelated.” Confirmation bias as its best.
Quick gut check: Ask yourself, “What if I am wrong?” and consider the consequences if you are. Who will be hurt by your decision ?