The banner that greets anyone reading Exterro’s announcement that ARMOUR for FTK, its new agentic AI layer for digital forensics, proclaims is now available within its FTK Central platform: See how the FBI beat the clock on the Trump WHCA Assassination Case with Exterro FTK. It’s not exactly clear what clock needed beating. Exterro explains that the DOJ filed charges within 48 hours of security thwarting a would-be shooter at the White House Correspondents’ Dinner, which is impressive, but it took the DOJ less than 24 hours to weaponize the attack to bully a plaintiff to drop its suit over Trump’s ballroom boondoggle. Even the most sophisticated AI tools can’t outpace cynical corruption.
For obvious reasons, the company can’t go into full detail at this time, but the Correspondents’ Dinner case employed the Exterro FTK Suite “with AI-Assisted Analysis.” The FBI’s tools are not necessarily identical to what’s coming to the public, but it offers some indication of where forensics is going. Exterro’s tools allowed the government to scour seized devices, social media, travel and financial records, and surveillance footage to build out the case in a couple days, while maintaining a pure chain of custody.
“Operational learnings from the Allen investigation and other global agencies is actively informing the next generation of agentic AI capabilities within the Exterro FTK platform,” the company declared. “[C]apabilities that will further automate complex investigative workflows, dynamically adapt to active case requirements, and reduce the cognitive load on investigators facing large-scale, time-pressured operations.”
Hey, if it’s good enough for J. Edgar Boozer… actually, let’s put the FBI involvement to one side.
Bringing us to the announcement that the masses will now have access to ARMOUR for FTK, a tool that Exterro explains goes beyond summarization and “executes governed forensic work by connecting AI reasoning directly to Exterro’s forensic technology.” The promise is that this tool solves for investigation teams still coordinating evidence across multiple security and forensic tools, which can invite delays and gaps in the evidentiary chain. “By reducing manual coordination and eliminating those bottlenecks, ARMOUR for FTK helps investigators move faster while preserving the defensible evidence record organizations need when legal, regulatory, and business risk are on the line.”
Stripped of the copy, the tool allows an investigator to type a question and the AI runs the forensics across live machines, cloud accounts, and communications, and hands back a structured record. The efficiency is real. Prior to today’s announcement, Exterro ran their ARMOUR model on subpoena intake and cut a 90-minute task to five. Now that tech is coming to forensic investigations.
Investigators describe the investigative goal; the AI determines the appropriate sequence of forensic actions […] while retaining complete responsibility for scope, findings, and all final decisions.
Right… but, is that still complete responsibility? Once the machine decides what to collect, what to correlate, and how to reconstruct the timeline, is the investigator even capable of being “responsible” for that chain of reasoning? Realistically, the answer is “yes.” A forensic investigator using a vetted tool, with an auditable record, to perform key tasks still allows the investigator to put their expertise behind the outcome.
But this is the same “human-in-the-loop” conundrum facing every AI application across every industry, but the law puts a lot of weight on the “responsibility” question in forensics. Legal tied itself into knots in the early days of eDiscovery, trying to find the right entry point for technology to alleviate the duty to bill 500 hours to reviewing irrelevant receipts in a Topeka warehouse. Turning key decision points in digital forensics over to technology will take some adjustment.
“Enterprise AI is moving from helping people find information to helping people complete governed work,” Harsh Behl, Exterro’s VP of DFIR Product Management said. “Every finding must remain transparent, defensible, and investigator-verified. ARMOUR for FTK accelerates investigations without compromising the evidentiary standards that legal, compliance, and regulatory obligations demand.”
Daubert asks whether a method can be tested, whether it’s been peer-reviewed, whether it has a known error rate, and whether it’s generally accepted in the relevant field. Those factors assume a method — a fixed, repeatable procedure that a qualified human can walk a court through and an opposing expert can attack. An agentic workflow that picks its own sequence of forensic actions per query is… muddying that process a bit. As Behl explained, the Exterro tool’s actions are reviewable and can be turned into defensible output by the expert, but introducing AI to the process is going to complicate things in the short-term as courts come to grips with this new process.
That said, an April Gartner report claims that “by 2030, more than 70% of the traditional models of manual, human-dependent forensic investigations will have been replaced by an agentic autonomous solution, which is almost entirely manual now.” That’s probably right. John Henry learned the hard way that the pace of automation rarely runs backward. So the courts needs to start taking this seriously. The contours of what is “peer-reviewed” and “testable” will have to adjust to include studies and experiments that consistently verify humans relying on agentic decision-making. Daubert as we know it will take a beating, but the structure can survive over the long-term.
And that road to 2030 starts right now.
Joe Patrice is a senior editor at Above the Law and co-host of Thinking Like A Lawyer. Feel free to email any tips, questions, or comments. Follow him on Twitter or Bluesky if you’re interested in law, politics, and a healthy dose of college sports news.