Skip to main content

Free Newsletter

Digital Forensics Today

Digital evidence, court-ready forensics, tools, and case strategy, written from active casework by Eric Waldrep. Every issue is built around one question: does your work stand up when someone asks how you know?

Free. No spam. Unsubscribe any time. Every issue also publishes on LinkedIn.

~800

Subscribers on LinkedIn

19

Years Active Casework

Fed + State

Courts Qualified

Court-Ready Insights

Daubert and FRE 702, documentation discipline, and the case law that decides whether digital evidence survives.

Tools & Techniques

Artifact interpretation, validation, OSINT method, and where the leading forensic platforms end and your judgment begins.

Written From Casework

No vendor talking points. The failures and fixes come from real examinations, generalized so they teach without exposing any matter.

Digital Forensics TodayLinkedIn Newsletter · Published by Eric Waldrep

Follow on LinkedIn

The Archive

Every Issue, Free to Read

Each issue is a complete field guide on one problem: no teasers, no paywalls. The pitch, when there is one, sits in a clearly marked section at the end.

September 29, 2026 · 11 min read

What a Screenshot Cannot Say

The most common exhibit in the field records what one screen showed one person at one moment. Rule 901, four social media authentication cases from 2011 to 2015, and a capture method that answers the questions the picture cannot.

Read the issue →

September 22, 2026 · 11 min read

Generally Accepted by Whom?

Every examiner eventually says "generally accepted." Frye asked by whom in 1923 and Daubert kept the question in 1993. How to answer it under oath, how to ask a method question without leaking a case, and why the field now has a room of its own.

Read the issue →

September 8, 2026 · 16 min read

The Network Remembers: A Forensic Guide to Call Detail Records

A carrier spreadsheet can reconstruct communications, associations, and movement. It can also mislead when network metadata is treated as GPS or a subscriber is confused with a user. The examination workflow that keeps call detail records defensible in court.

Read the issue →

August 25, 2026 · 9 min read

Verified Is Not Complete.

A hash proves the bytes you collected did not change. It says nothing about whether anything else should have been collected. Why NIST lists incompleteness ahead of inaccuracy, and what Rule 702(d) now asks of an acquisition.

Read the issue →

August 18, 2026 · 17 min read

The Evidence Follows You Home: Mental Health in Digital Forensics

A first responder may encounter a horrific scene once. The examiner may encounter it hundreds of times. What the research says about burnout and vicarious trauma in DFIR, and what examiners and supervisors can actually do.

Read the issue →

August 2026 · 13 min read

The Finding Was Right. The Record Failed.

Examiners rarely lose on the analysis. They lose on when the note was written, which build of the tool produced it, and who authorized the act. The documentation discipline that keeps closed cases closed.

Read the issue →

August 11, 2026 · 12 min read

Nobody Cross-Examines the Tool.

Vendor certification proves you can operate the software, and you should get one. It is also not what opposing counsel asks about. The layer above the instrument is what gets tested under oath.

Read the issue →

August 4, 2026 · 9 min read

The Model Is Not Your Witness.

AI can compress a day of open-source work into an hour. It can also invent a source, a quote, and a court case without changing its tone. The verification discipline that takes the gain without the failure.

Read the issue →

July 28, 2026 · 16 min read

Search Is Cheap. Judgment Is Not.

The OSINT most people practice falls apart under one question. Eight practices for defensible open-source investigation, plus the capture and chain-of-custody section most guides skip.

Read the issue →

Prefer a feed reader? Subscribe to the RSS feed.

The Author

Written by the Examiner, Not a Content Team

Eric L. Waldrep

Court-qualified digital forensic examiner · Magnet Certified Forensics Examiner · U.S. State Dept. ATA Cyber Mentor

Eric Waldrep has spent 27 years in law enforcement and 19+ years in active digital forensics, with casework for federal and state courts. He was selected by the U.S. State Department's Antiterrorism Assistance program to train allied nation law enforcement in digital forensics. Every issue of Digital Forensics Today comes from that casework: the failures he is asked to review, the questions he is asked under oath, and the practices that survive both. Case patterns are always generalized; no real matter is ever described.