Learn how to implement a strategy of high-speed, defensible data collection as part of your digital forensics and incident response workflows with Matt Petersen of Rockwell Automation in this session from Exterro INFORM 2026.
.jpg)
This session is critical for DFIR and Legal Tech professionals who must balance the technical need for evidence with the executive demand for speed. Matt Petersen frames forensic collection not just as a technical task, but as a leadership capability—demonstrating how to maintain defensibility while operating under the intense pressure of active litigation or a breach. He shifts the conversation from the "how" of full-disk imaging to the "why" of targeted, high-velocity data acquisition.
Traditional full-disk imaging is time-prohibitive in an era of multi-terabyte drives and encrypted cloud environments, leading to unacceptable delays in incident triage.
Incident Response (CSIRT) and Forensic (DFIR) teams often operate in silos, resulting in "forensic suicide" where containment actions, like wiping a machine, accidentally destroy the evidence needed for legal defensibility.
Proprietary data frequently migrates to personal cloud drives (OneDrive, Google Drive) or encrypted chat apps, leaving the organization blind to the true scope of data exfiltration.
