Insights
This page is where I share my thoughts based on a career spanning four decades, largely centered on the world of digital evidence. Everything here is for educational purposes. The views and analysis are solely my own and do not reflect the position, policy, or endorsement of any employer, agency, or organization with which I am affiliated. Nothing here constitutes legal advice.
SAIDI in the Inbox: When the Account Sent It, but the Person Did Not Write It
A controlled test connects autonomous AI agents to real Gmail accounts and lets them read, reply, and build rapport on their own. The messages pass every authentication check and read as first-person, human correspondence. What the headers can, and cannot, prove about who was actually behind the keyboard.
AI Did It: Why Digital Investigative Analysts Must Not Outsource Judgment to Artificial Intelligence
SODDI is about to get a successor: SAIDI, “Some Artificial Intelligence Did It.” A controlled test of an autonomous AI agent on Windows 11 shows why the familiar attribution artifacts can vanish, what the file system and event logs still reveal, and why validation and examiner judgment matter more than ever.
The Power of the USN Journal in Digital Investigative Analysis
The NTFS change journal is one of the most powerful, and frequently underused, artifacts on a Windows system. How it records file creation, renaming, deletion, and counter-forensic activity, how to read its reason flags, a practical analysis workflow, and the limitations that must govern any forensic conclusion.