Where to Draw the Line on AI: Lessons From Digital Forensics
TechRadar, Wednesday, September 30th, 2026
SANS's Heather Barnhart says AI can speed forensic triage, but human investigators must own the conclusions.
Writing for TechRadar Pro, SANS Institute DFIR curriculum lead Heather Barnhart examines where AI belongs in digital forensics and incident response.
With 90% of criminal cases now involving digital evidence and backlogs of more than 20,000 devices in England and Wales, AI helps triage data, correlate activity across devices and accounts, reconstruct timelines and structure reports.
But Barnhart stresses that tools only support investigations and investigators remain responsible for their conclusions, so organizations need to define clearly where AI assists and where human expertise must stay in control.