Brett Shavers's Blog

The recording is available today (Friday, November 14, 2025) only. After that, it’s gone permanently. Register to access it here: https://www.suspectbehindthekeyboard.... This wasn’t a case study. It wasn’t entertainment. It wasn’t po...

A recent podcast conversation with Jessica Hyde, Debbie Garner, and Kim Bradley brought back a problem I’ve seen for years: the digital evidence guidance written by experts is unusable by the first responders who touch devices first. {source}

Someone in DF/IR is going to testify in a trial in 2026. Actually, it will be many. And some are going to regret every second on the stand. Are you going to be one of them? There are things in this field that people don’t talk about. Not in conferenc...

Here’s the short version: The litigation record showed large numbers of systems that were not searched, devices that could not be accounted for, and a workstation that was reported as ‘dead’ shortly after my request.The production showed thousands of...

Somewhere along the way, we stopped investigating people and started interrogating machines. I harp constantly on this topic because it is important. I’ve seen investigations where the goal was clear. Follow the evidence to the truth and the technica...

I’m all for AI when and if it benefits DF/IR. If it makes us faster, sharper, or more accurate, bring it on, I’m here for it. But the risk is if we charge ahead without caution, we don’t just risk losing the parts of AI that don’t work for DF/IR. We ...

I just came across a job ad for an ICAC digital forensic examiner. For minutes, I thought about applying. Talk about a strong pull the requirements had/have on me… To be honest, I still think about constantly…I used to chase monsters like that job ca...

Data is the trail. Humans are the quarry. This is my opinion response to a solid LinkedIn post that asks a very important question: “How do we fix DF/IR so different paths don’t lead to different answers?” (paraphrased) Humans first. Technology secon...

Aka: The Machine did its job. The lazy* human did not. https://petapixel.com/2025/08/28/new-...  Stop Worshipping the Magic Box Here’s the creeping canc...

Every digital forensic examiner, eDiscovery professional, and evidence handler eventually faces the same reality: the courtroom is where your work either stands or collapses. Yet, many in our field have never even sat through a trial, hearing, or sup...