Forensics First. AI Second.
Brief
AI found it. You prove it. From Artifact to Defensible Casework Decisions.
I bought an AI-ready computer for testing and started running a local LLM against test data and CTFs. It’s a little more complicated than that to get set up, but once you get everything connected…. oh my.
I have not been this excited and this disappointed at the same time.
The speed is hard to describe unless you see it in front of you. It can run through data, summarize, group, compare, and surface things faster than a person could manually work through the same material. That part is really incredible. Anyone pretending this technology is not going to change DFIR work is fooling themselves.
The problem, and it's a big one
Once I moved from broad data review into natural-language questions tied to investigative processes, the LLM risks and failure were there.