AI Can Assist Digital Forensics, but Humans Must Decide, SANS DFIR Leader Says

The article says AI is becoming part of almost every workflow. Developers use it to write and test code, customer support teams use it to handle routine queries, and security teams use it to analyze alerts and support investigations. DFIR is no exception. But as digital forensics has evolved over decades, one lesson has remained consistent: tools can support investigations, but investigators remain responsible for the quality of the conclusions they reach.

The article points to the scale of the problem. It says 90 percent of criminal investigations and prosecutions now involve a digital element, and that as of February this year, more than 20,000 devices remained in the digital forensics backlog in England and Wales alone. Evidence is spread across endpoints, cloud environments, communications platforms and user accounts.

According to the article, AI can help investigators triage that information more efficiently. It can identify potential leads, spot connections between datasets and highlight other sources of evidence that may need further examination. It can also correlate relevant activity across multiple devices, accounts and data sources, helping to reconstruct event timelines that would otherwise take days to piece together manually. The article adds that AI can help practitioners organize information and structure reports, reducing time spent on administrative work and allowing more time for analysis.

Used appropriately, the article says, AI can cut time spent on manual, repetitive work and allow skilled practitioners to focus on analysis and decision-making. The danger, it says, is that AI often appears so authoritative that people become overly reliant on its outputs.

The article argues that every tool has limitations. Experienced investigators understand that forensic tools can be wrong, and AI is no different. It says the greatest risk is using AI without the foundational knowledge needed to recognize when it is wrong. It compares AI to a junior analyst on their best day: able to identify patterns, highlight areas of interest and help move work forward, but not someone an organization would allow to make the final decision in a sensitive investigation without oversight and accountability. The article says AI should be approached in much the same way.

Problems arise, it says, when organizations treat AI-generated outputs as answers rather than something that needs to be validated by someone with the expertise to challenge them. AI can help an investigator reach a conclusion, but it should not be the conclusion in and of itself, according to the article.

The article says there are many areas where AI can accelerate and enhance work, but some areas where it should never be used. In digital forensics, AI can help identify information that warrants further examination and support analysis. But it should not be blindly trusted to reach investigative conclusions or determine innocence or guilt. Those decisions carry legal, professional and life-changing consequences, making human judgment and accountability non-negotiable, the article says.

The same principle extends beyond digital forensics. The article says organizations in every sector are now deciding how much responsibility should be handed to AI. The answer will vary depending on the use case, but the underlying question remains the same: what safeguards are in place to prevent people from becoming overly reliant on AI outputs, and how will they know when those outputs are wrong?

The article says new practical frameworks for the use of AI in DFIR are addressing those questions. They encourage organizations to consider how much risk a task carries, how outputs will be reviewed and where human oversight should remain mandatory. It says using AI in DFIR requires strict governance because the stakes are high: mistakes are taken seriously when someone’s life is on the line or a wrongful conviction could take place.