Guest: Steve Davis

Vice President, Forensics & Investigations Practice, Purposely Legal
(“Doing well and good to see you both… always enjoy crossing paths with you.”)

Episode Overview

Digital forensics is evolving faster than ever and returning guest Steve Davis brings a front‑line perspective on how investigators are adapting to a world defined by massive data growth, ephemeral messaging, encryption, and the rise of generative AI. In this episode, Steve breaks down the shifting landscape of evidence collection—from mobile devices and third‑party apps to structured databases and collaboration platforms—and explains why traditional assumptions about “where the data lives” no longer hold.

The conversation also explores the practical realities of modern investigations: how to build a defensible collection plan, how to manage client expectations, and how AI is beginning to transform exfiltration and migration analysis. Steve closes with a candid look at why he keeps returning to NELI and what keeps him energized in such a rapidly changing field.

Key Takeaways

• Data diversity now matters as much as data volume. Investigators must account for mobile apps, collaboration platforms, structured databases, and constantly shifting tool behaviors. (“Things can change literally a week or a month from what we did previously.”)
• Ephemeral messaging isn’t the end of evidence. While deletion is harder to overcome on modern devices, backups, syncs, and other participants’ devices often provide alternative paths to reconstruction. (“If the data is not there, the data is not there… but not necessarily.”)
• Gen AI is poised to reshape forensic analysis. Steve sees major potential in cross‑referencing artifacts, accelerating timeline reconstruction, and identifying patterns in exfiltration investigations. (“I think I’m dead wrong… there’s actually some super interesting things that are happening.”)

Action Items for Legal Teams

• Start every investigation with a structured plan. Identify custodians, platforms, timeframes, and data types before collecting anything.
• Avoid “collect everything” instincts. Large, nonlinear data sources require targeted, defensible scoping to avoid unnecessary cost and noise.
• Prepare clients for the realities of modern forensics. Explain why thorough questioning, planning, and methodical workflows are essential—and why there is no “easy button.”

Chapters & Timecodes

00:00 – Introduction
Daniel and Brandon welcome listeners and reintroduce Steve Davis.

00:02:09 – What’s Changed Since Last Year
Steve explains why digital evidence collection evolves weekly, not yearly.
(“You’ve got to be a student of the game… constantly listen and learn.”)

00:05:21 – The Explosion of Data Types
How investigators help clients navigate diverse platforms, apps, and storage locations.

00:08:31 – Linear vs. Nonlinear Data Challenges
Why collaboration platforms, JSON outputs, and structured databases complicate downstream review.

00:14:23 – Deletion, Encryption, and the Decline of Recoverability
Why SSDs and mobile architectures make deleted data harder to retrieve.

00:17:17 – The Future of Forensics in an Ephemeral World
How backups, syncs, and other participants’ devices can still preserve critical evidence.

00:20:50 – Gen AI’s Emerging Role in Forensics
Steve revises his earlier skepticism and highlights promising applications in migration and exfiltration analysis.

00:24:39 – Discoverability of AI Prompts
A discussion of enterprise vs. consumer AI tools and how prompts, outputs, and source code can be collected.

00:26:57 – Managing Expectations: The Myth of the Easy Button
Why clients often underestimate the complexity of forensic workflows—and how Steve addresses that gap.

Compelling Quote

“You can’t arrive… you’ve got to keep your hand on the pulse and constantly listen and learn.”