Making AI Defensible: What Every Examiner Should Take From the DFRWS Practitioner Report

I'll be upfront: I'm pro-AI. I've been doing digital investigations since 2002, and I've watched data volumes grow from a single hard drive to multiple phones, cloud accounts, vehicles, and smart devices in one case. We can't keep up by hand anymore. AI is a big part of how we close that gap.

But being pro-AI doesn't mean being pro-shortcut. A finding you can't explain on the stand isn't a finding, it's a liability. That's why I think every examiner, investigator, and prosecutor should read the new DFRWS report, "Practitioner Perspectives on Making AI Defensible in Digital Forensics Casework." It came out of a working session at the DFRWS Digital Forensics Conference Americas 2026, led by Eoghan Casey with Jim Jones, Jessica Hyde, Cameron Kelley, and Chad Steel. Credit to them and to the practitioners who contributed. It's one of the most practical things I've read on this subject.

Here's my take on what it gets right, both about what AI can do for us and where it can hurt us.

Where AI Earns Its Place

The report doesn't treat AI as the enemy, and I appreciate that. The practitioners in the room identified real, everyday wins:

• Transcription, translation, and OCR at ingest, which speed up triage and review dramatically
• Classifying and prioritizing large volumes of documents, emails, and images
• Reducing how much harmful material examiners have to view personally in CSAM cases, which matters for examiner wellness
• Parsing unfamiliar log formats and helping with tool development and troubleshooting
• Generating leads and hypotheses an examiner might not have considered

That last one is key. AI is excellent at pointing you somewhere. It is not the one who decides what's there.

Where AI Can Burn You

The report also gives an honest list of failures that practitioners have actually seen. Some of them should make anyone pause:

• A LevelDB misidentified as SQLite
• Fabricated sources, including a made-up SWGDE publication
• A regex that missed half the results
• A model that reversed a correct answer simply because the user pushed back
• A model that reviewed 50 of 500 keyword hits and reported it had "read all the chats"
• A "created at" timestamp treated as the time of the event, when it may reflect a copy, sync, or restore

None of these are exotic. They're the kind of mistakes that slip into a report when someone trusts the output and moves on. The report also flags something every agency leader should worry about: deskilling. If examiners stop checking AI's work, they eventually lose the ability to check it at all.

One more point that stuck with me: using a second AI to verify the first is not verification. In the report's words, "A confident second model laundering a first model's mistake is worse than no check at all."

The Checks and Balances

This is where the report really delivers. Instead of vague advice about "using AI responsibly," it lays out concrete guardrails:

• Log everything. Every tool run, parameter, input, output, and the specific model and version used. A model's summary of what it did is not a record.
• Let AI drive validated tools. Don't let it write a new parser on the fly. Have it work from the output of tools you've already validated.
• Separate findings from interpretation. Keep what the data shows apart from what you think it means.
• Tie every finding to its source. File, path, table, row.
• Show how to verify it. Give the query to run and the record to check with an independent tool.
• Qualify conclusions. What happened on a device is not automatically what a person did.
• Be honest about coverage. State what was examined, what failed, and what was skipped.
• Sandbox it for real. Evidence stays read-only, there's no outbound network, and prompt instructions alone don't count as protection.

The report also makes a point many people miss: when you change models or versions, you've changed your tool. Your validation has to be run again. That's no different from updating any other forensic software, and we should treat it the same way.

Why This Matters in Court

Jessica Hyde's section on AI in court is worth reading on its own. Traditional digital forensic tools tend to make systematic errors, the kind you can identify and mitigate. AI introduces random errors, which brings error rates back into the Daubert conversation. Meanwhile, proposed Federal Rule of Evidence 707 on machine-generated evidence has been sent back to committee for more work, so the legal standard is still taking shape. If you're using AI in casework now, assume you'll be asked to defend how you used it.

The report also raises an issue I think we'll be hearing a lot more about: the "Some AI Did It" defense. As AI agents increasingly act on users' behalf, attribution is going to get harder.

The Bottom Line

The phrase I keep coming back to is this one: "Appropriate use of AI is a combination of the task and the operator." The same tool can be a force multiplier in trained hands and a disaster in untrained ones.

So use AI. Use it to cut backlogs, to get through data volumes no team can handle manually, and to surface leads faster. But keep a qualified examiner accountable for every conclusion, document everything, validate your tools, and never let a model's confidence stand in for your own verification. As my friend Brandon Epstein put it in his Police1 piece on AI in digital forensics, "the technology does not testify." You do.

Read the Full Report

I encourage you to read the full DFRWS report: https://dfrws.org/wp-content/uploads/2026/10/Practitioner-Perspectives-on-Making-AI-Defensible-in-Digital-Forensics-Casework.pdf

DFRWS summary post: https://dfrws.org/dfrws-2026-report-of-practitioner-perspectives-on-applying-ai-in-digital-forensics/

Sources

• Casey, E., Jones, J., Hyde, J., Kelley, C., and Steel, C. "Practitioner Perspectives on Making AI Defensible in Digital Forensics Casework." DFRWS, September 2026.
• Epstein, B. "AI in Digital Forensics: Conflict or Partnership?" Police1, April 2026. https://www.police1.com/investigations/ai-in-digital-forensics-conflict-or-partnership