What’s Next for Digital Forensics? A Conversation with Eric Zimmerman
-
October 05, 2026
-
Eric Zimmerman, a forensic architect in the Cybersecurity practice, has more than two decades of experience developing forensic tools, leading laboratory operations and training practitioners across the public and private sectors. He has authored more than 50 open-source forensic tools now used by nearly 8,800 law enforcement officers across 80 countries.
In the Q&A below, Eric offers insight into the future of digital forensics, from emerging threats to the enduring importance of human expertise.
Q: You’ve developed open-source forensic tools that investigators around the world rely on every day. What have those tools, and the community using them, taught you about where digital forensics is headed next?
A: Many organizations seemingly want a single forensic tool that does many things, but tools like this can compromise the resolution of an individual artifact for the sake of convenience. My tools are purpose-built one artifact at a time to maximally and efficiently pull as much detail as possible from each artifact. I’ve learned that it is essential for tools to be useful for both new investigators and seasoned experts; ease of use and powerful capabilities make the bar for entry low while maximizing the usefulness of the data.
Q: Digital forensics has changed dramatically over the past decade. What’s the biggest misconception organizations still have about incident response and digital forensics today?
A: Many organizations expect artificial intelligence to replace people or solve problems that they do not have experts in-house to solve. However, in reality, AI is a tool to enhance human expertise, and should not be used for anything you do not already understand how to do manually. If you cannot verify or understand the output from an AI tool, be wary of using it.
Q: Attackers are increasingly leveraging automation, AI and legitimate tools already present in an environments to make malicious activity harder to distinguish from normal behavior. How is that changing what investigators need to be able to identify and reconstruct after an incident?
A: Investigators need to understand what normal is, so they can find the abnormal. Nothing on a computer, including malicious activity, can happen without a program running, so focusing on these kinds of artifacts allows investigators to isolate what is happening and identify anomalous activity. Another aspect of this is having detailed logging and telemetry data, so investigators can look back after discovering an incident to identify the root cause, track lateral movement and determine what data has been accessed.
Q: You’ve investigated everything from nation-state intrusions to criminal cyber activity. When you look at today’s threat landscape, what concerns you most, and what do you think organizations are paying too little attention to?
A: The biggest risk to organizations today is not understanding what their “normal” is. Attackers are using more automation, which means defenders have to be more vigilant in looking for the outliers in their environments. There is also a perception that cybersecurity problems can be easily solved with the most expensive tools, when in reality cheaper hardware used properly is more effective than a poorly implemented expensive tool.
Q: When a major cyber incident occurs, clients increasingly need technical depth, speed and the ability to operate across jurisdictions and very large volumes of data. How do you see technology, automation and globally integrated teams changing the way complex investigations are conducted?
A: As technology evolves, having mature back-end processes (networks, storage, compute) to manage investigations is essential, and allows investigators to focus on the job at hand instead of project management. Automation creates a robust audit trail that eliminates guesswork because it is generated and maintained automatically.
Q: You teach incident response and digital forensics to cybersecurity professionals around the world. What changes have you seen in today’s students compared to those from five or ten years ago, and what skills do the next generation of defenders need to develop?
A: Today’s students have more opportunities for formal training and access to more information than those of previous generations through expanded college programs and social media. However, developing an investigative mindset is still critical. The ability to read between the lines and infer details to move a case forward is just as valuable as knowing how a forensic artifact works. This includes the realization that the absence of evidence is often evidence in and of itself.
Q: You’ve spent much of your career pushing the technical boundaries of digital forensics. What attracted you to FTI Consulting, and what opportunity did you see here that made this the right next step?
A: The biggest draw for me was the quality of the people and their values. I was also excited by the challenge of building out and standardizing our forensic labs and improving existing processes such as data acquisition from customers, data security and zero trust.
Q: As you begin working with FTI Consulting’s forensic teams globally, what opportunities do you see to build the next generation of forensic capabilities and change how investigations are conducted?
A: I see an opportunity to enhance existing capabilities that will enable us to scale upward without a lot of manual intervention in regard to technology and infrastructure. The less time our team spends managing a process, the more time they have to help our clients with complex challenges. Another opportunity is leveraging AI where it makes sense while ensuring all results are human-verified. Proper use of AI in investigations can limit the risk of missing details in large volumes of data.
Q: Looking ahead three to five years, what do you think will fundamentally change about digital forensics and incident response, and what won’t?
A: Many people have concerns about AI replacing digital forensic experts, but I see subject matter experts playing an even bigger role as AI advances. Experts will be essential for validating models, verifying results and explaining the technology behind AI models to clients, juries and others. As we see more data in more places, investigators will need to find the important signals among the noise.
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.
Related Insights
Related Information
Published
October 05, 2026
Key Contacts
Senior Director