If AI Is Better at Digital Forensics Than We Are, What Should We Learn?
00_Intro
Hello, I’m amier_ge.
I am currently studying Digital Forensics & Incident Response as my main field!
As AI continues to develop rapidly, I have felt that many things are also changing in the field of digital forensics. Therefore, today I would like to talk about the relationship between AI and digital forensics from the perspective of a student rather than a professional working in the field, as well as how we should respond to these changes and continue developing our own capabilities.
01_Before Codex/Claude Code
The first period I would like to discuss is before Codex and Claude Code became widely used. I suppose this would be around 2025.
At the time, we did not have AI Agents like the ones we use today, so the amount of data that could be analyzed within a single session—that is, a single chat window—was limited, and there were also strict limits on the size of files that could be provided as input. AI could not directly access or analyze files in my local environment either.
AI models themselves were also less capable than they are today, and together with these limitations, it was difficult to analyze complex incidents, large forensic images, or large volumes of logs.
As a result, it was not yet a world where everything could be solved with a single 'Just do it for me.'
However, from my personal experience, even back then, I remember asking Opus to analyze logs and being surprised by how well it performed….
Ah... will there still be a place for me in the future…?
I remember genuinely worrying about that.
It was also extremely good at analyzing artifacts when I parsed them in advance and provided the results🥲
02_After the Arrival of Agents
After Agents such as Codex and Claude Code appeared, I strongly felt that 'the world really has changed.'
Agents directly inspected files in local working directories, executed the necessary commands, and immediately wrote scripts required for analysis. When a problem occurred during the analysis, they identified the cause of the error, looked for a solution, and continued working. Previously, a person had to keep intervening throughout the analysis process, but now it felt more like AI had directly entered the analysis environment and was working alongside us.
To test their actual performance, I asked an Agent to solve KDFS challenges from the previous year.
Even without any particularly detailed instructions, it produced results that were quite close to the actual answers. Its performance in log analysis was especially overwhelming. Its ability to extract relevant information from a large number of logs, organize events chronologically, and identify connections between different events was impressive.
Watching this, I began to think that it could become entirely possible for AI to perform a significant portion of the analysis, while humans adjust the direction of the investigation and verify the results using their own domain knowledge.
However, despite this, not every analysis was accurate!
In some cases, the Agent confidently presented conclusions based on an incorrect interpretation of an artifact, or described nonexistent information as though it were factual.
As a result, the perfect world of ‘just do it for me’ has not yet arrived, but at least these words no longer sound like nothing more than a simple joke..!
03_Then, What Should We Do?
After reading Section 02, some of you may be wondering,
Wait, does that mean I have no future???
I would like to share my thoughts on this through three main points!
03-1_AI Is Ultimately Just a Tool
In my opinion, studying with the goal of defeating AI is not a particularly good direction.
AI will continue to improve, and it will become increasingly difficult for people to compete with it in terms of simple processing speed or workload! Therefore, I believe that what matters is how well we can use AI, and how effectively we can adapt it to our own needs.
⊙ Which tasks should be assigned to AI?
⊙ What information should we provide to obtain better results?
⊙ Which parts of the output should we trust, and which parts should we verify again?
We need to develop the ability to make these judgments.
Rather than leaving everything to AI, we should use it appropriately while maintaining control over the analysis ourselves.
We must remember that AI is not an all-powerful machine, but a tool used by people!!
03-2_The Importance of Reporting
Personally, I believe that the ability to write reports will become even more important in digital forensics.
AI is good at summarizing and organizing analysis results, but I still feel that it has limitations when it comes to accurately connecting the flow of an incident with the supporting evidence and turning it into a report that is easy for people to understand. No matter how good the analysis results are, if they cannot be properly explained, it would be difficult to call it excellent forensic analysis.
Therefore, I believe that we should continue developing not only our analytical abilities, but also our ability to logically communicate our analysis process and results!
03-3_Do Not Overlook the Fundamentals!
Lastly, while studying, it is easy to think, 'AI will handle this much for me' or 'This is just basic material, so I can quickly move past it.' I also make these mistakes from time to time and regret them later.
However, without a proper understanding of the fundamentals, we will not be able to recognize what is wrong when AI produces an incorrect answer.
In actual competitions, AI often identifies the overall direction of the analysis correctly, but sometimes misinterprets artifacts or presents nonexistent information as fact. Because the results may appear convincing, someone without the relevant knowledge could simply accept them as correct.
Ultimately, identifying these errors and reviewing the results requires human domain knowledge.
⊙ What the commands or scripts written by AI actually do
⊙ What the analyzed artifacts actually mean
⊙ Whether the conclusions presented are sufficiently supported by evidence
We must be able to judge these things.
Therefore, we still need to study. Perhaps we may even need to study harder than before.
AI performing analysis for us does not mean that studying is no longer necessary. Instead, we are entering an era where we must study in order to verify the analyses performed by AI.
04_Outro
I have written this article based on what I have felt from the perspective of a student. Were there any parts that you could relate to?
For professionals working in the field, I believe the first issues they encounter when using AI are realistic limitations such as ‘the difficulty of providing sensitive corporate information to external AI services’ or ‘the legal/professional reliability of analysis results.’
On the other hand, students cannot help but first think, 'Wait, AI is much better than me…?'!
This can make us feel uncertain and afraid about whether there will still be a place for us when we begin working in one or two years—or even further into the future.
However, rather than simply fearing AI or viewing it only as a competitor, I believe it is more important to think about how we can use it and prepare ourselves for the roles that we will need to take on. Let us continue working to build strong fundamentals, develop the expertise required to verify AI-generated results, and clearly communicate our analysis to others!
To every student studying information security, keep it up!
Thank you for reading🤭