Insights
This page is where I share my thoughts based on a career spanning four decades, largely centered on the world of digital evidence. Everything here is for educational purposes. The views and analysis are solely my own and do not reflect the position, policy, or endorsement of any employer, agency, or organization with which I am affiliated. Nothing here constitutes legal advice.
AI Did It: Why Digital Investigative Analysts Must Not Outsource Judgment to Artificial Intelligence
SODDI is about to get a successor: SAIDI, “Some Artificial Intelligence Did It.” A controlled test of an autonomous AI agent on Windows 11 shows why the familiar attribution artifacts can vanish, what the file system and event logs still reveal, and why validation and examiner judgment matter more than ever.
The Power of the USN Journal in Digital Investigative Analysis
The NTFS change journal is one of the most powerful, and frequently underused, artifacts on a Windows system. How it records file creation, renaming, deletion, and counter-forensic activity, how to read its reason flags, a practical analysis workflow, and the limitations that must govern any forensic conclusion.