Live Investigation: Inside an Investigator's Thinking Process

Wednesday, October 28, 2026

Follow the Evidence. Not the Narrative.

The purpose isn't to watch me solve a case. It's to understand how I work one.

Most investigative training starts with a completed case. The instructor already knows what happened, which evidence matters, and how the case ends. Even simulated exercises are often built around a predetermined outcome.

This session is different.

I'm taking you inside an actual, ongoing investigation involving real people, public records, conflicting information, unanswered questions, and potentially real consequences.

The same investigative process we will go use applies directly to your DFIR casework. Whether you're examining a computer, analyzing mobile device data, or correlating digital evidence, the questions you ask, hypotheses you test, and conclusions you document determine whether you're simply finding artifacts or conducting a defensible investigation.

I don't know how this investigation will end. I don't know what additional evidence will become available, whether my working hypotheses will hold up, or whether the information I've requested will support or contradict what I currently believe.

That's the point of this.

What This Session Is About

For approximately 30–45 minutes, I'll open up my investigative thinking process using an actual investigation I'm currently working.

This isn't an entire investigation condensed into a short presentation. It's a snapshot of the case as it exists on the day of the session. More to come as this progresses.

I'll walk you through what prompted the investigation, the information obtained so far, the questions I've developed, the investigative decisions I've made, and what I intend to do next.

More importantly, I'll explain why.

Why did I request a particular record? What did I expect to find? What would it mean if the record contradicted another source? What alternative explanations should I consider? And how do I decide whether the evidence is sufficient to support a conclusion?

You'll hear me work through those questions using actual records, not hypothetical examples.

What You'll Learn

I'll demonstrate how I apply an investigative mindset to a real case, including:

Developing investigative questions: Turning initial information, allegations, or inconsistencies into questions that can actually be answered.
Establishing investigative objectives: Defining what needs to be established and what evidence may be required.
Planning an investigation: Deciding which records to obtain, which leads to pursue, and how to prioritize investigative steps.
Creating and testing hypotheses: Developing possible explanations, identifying evidence that could support or contradict them, and knowing when to revise or discard a hypothesis.
Evaluating evidence: Separating what a record actually establishes from what I believe it might mean.
Recognizing contradictions and gaps: Identifying information that doesn't fit, conflicting accounts, missing evidence, and unanswered questions.
Documenting investigative work: Recording observations, interpretations, investigative decisions, and the reasoning behind them.
Determining the next step: Deciding what to pursue, what to reconsider, and when the available evidence simply isn't enough.

Throughout the session, I'll explain not just what I'm doing, but why I'm doing it, what I expect to learn, and what might cause me to change my mind.

An Investigation Without a Known Ending

There are no predetermined findings or conclusions.

Additional records are still being sought, including forensic records that may provide new information. If those records become available, I'll explain how they fit into the investigation and what they might establish.

Some questions may be answered. Others may lead to more questions. We may discover that an assumption was wrong, a hypothesis cannot be supported, or an investigative lead is no longer worth pursuing.

There may be significant developments before the session. There may be none.

That's how real investigations work.

The value of this session isn't in watching me reach a conclusion. It's in understanding the decisions that get an investigator closer to one.

What This Session Is Not

This is not a live forensic examination, software demonstration, capture-the-flag exercise, or fictional investigation.

It's also not a presentation designed to prove that an individual or agency is right or wrong.

This investigation involves real people, so accuracy, fairness, and restraint matter. Allegations are not automatically facts. An investigative finding is not necessarily proof of a crime. And missing information is not permission to fill in the blanks with assumptions.

The purpose is to demonstrate investigative methods, including recognizing when the available evidence does not support a conclusion.

You are welcome to question my reasoning, challenge an interpretation, or suggest an alternative explanation.

I don't expect you to agree with every decision I make. I want you to understand how I reached it and whether the evidence supports it.

As a side note, I'm due the raw forensic extraction, and at that time, we'll go through it live using whatever tools are best at the time.

Session Details

Date: Wednesday, October 28, 2026

Time:

2:30 PM Pacific
3:30 PM Mountain
4:30 PM Central
5:30 PM Eastern

Duration: Approximately 30–45 minutes

Location: Live online via Zoom

Cost: Free

What You'll Receive

Access to the live Zoom session.
A firsthand look at an actual investigation in progress.
An explanation of the investigative questions, objectives, planning, evidence evaluation, and decision-making involved.
An opportunity to ask questions and challenge investigative interpretations.
Access to selected supporting public records and investigative resources.
A certificate of completion.

Participation Rules

This is a professional educational session focused on investigative methods.

Attendees will not be visible to one another. Questions and comments may be submitted using your name or anonymously.

Recording, retransmission, or redistribution of the session by attendees is prohibited.

The session will begin on time. Because the investigation concerns real people and actual records, discussion will remain focused on evidence, investigative reasoning, and appropriate professional conduct.

No one should interpret the presentation as an attempt to attack, defend, or establish the guilt or innocence of any person.

How to Register

Registration is free.

After registering, you'll receive an email with instructions for obtaining your Zoom access link and accessing the available supporting records and resources.

Zoom registration is required to attend.

Most case studies teach you what happened. This session shows you how to investigate when you don't yet know what happened.