Hello Reader,
The conversation from these posts is continuing in the comments and I'd like to ask you to consider joining us. While I enjoy sharing my perspectives we would all benefit from hearing yours as well. Whether you are just getting started or you've been doing this longer than I have, I would hope you would consider providing your experiences with these milestones and what is different in your professional achievements.
That said today's post will focus on milestones 3 and 4 as we continue up the ladder of skill and sophistication as a digital forensic examiner.
Milestone 3 - You look beyond your tool.
This is a moment of apprehension for many examiners. You've been well trained on your tool of choice and you might have heard some excellent marketing people explain to you the importance of using only tools like theirs which courts welcome with open arms. However, you also now know that other people are starting to find artifacts your tool does not yet support and you are you realizing you are missing evidence because of it. The development cycle for a major forensic suite is long, so it’s not that your tool of choice doesn't want to integrate every artifact that examiners unearth on a daily basis, it just has to be prioritized into their development schedule before they can implement it.
You also begin finding limits to the efficiency your tool of choice is providing, whether it's how its presenting data for you to review/export, to how it's handling a support artifact you want to get more data out of, or get things done faster and your tool isn't keeping up. Now is the time when you start looking at the ever widening range of other tools out there. Some examiners gravitate to another large suite tool, for instance many users of TCT, FTK and EnCase will use one of the other three to fill in a gap in functionality. Some users will gravitate to the purity of X-ways in a hope to get deeper into guts of forensics, while others will look to augment their tools abilities with tools that fill a gap like IEF. What's not important is what additional tool (commercial or open source) you adopt into your process but the fact that you've opened yourself to doing so and gotten over the fear of non-vendor created tools. This is an important step and one of many decisions you'll make of what tool to use and whose output to trust as you continue to improve.
Not all tools are made equal and eventually you may end up like me, with a license of almost every tool because each one handles X better than the others. I'm not going to tell you it’s cheap, and don't think I get anything for free (although I am willing to!), but as your case load grows you'll find that the work justifies the expense.
If you notice I've mentioned a lot of commercial tools in this post, please do not consider that an endorsement of commercial tools only or a slight towards free and open source tools. I'm trying to make sure this post is relevant to the largest segment of readers. Substitute any tool name you want in this post and the point still remains valid. In my work we use everything we can get our hands on that creates reliable, verifiable output.
Milestone 4 - You get certified with a vendor neutral certification.
Some examiners who have been in the field a long time may deride my focus on certifications for the new examiner, and that's OK. I didn't get a forensic certification until last year and I'm just now in the process of getting a vendor neutral certification (if I ever find the time to finish!). However, we are the exception to the rule as we started doing computer forensics prior to there being any certifications available to non-law enforcement examiners. That being said, for those of you who aren't cynical forensic veterans, certification is something that more employers, attorneys and judges are looking for. We discussed in Milestone 2 vendor certification and what it skills it actually demonstrates. In Milestone 4 we are looking at certifications not tied to a specific product but towards a provable set of skills, processes, and knowledge in your ability to analyze and report your findings.
There are many vendor neutral certifications out there these days; CCE, GCFE/GCFA, CFCE, etc... and which one is right for you will depend on many things such as;
- Are you law enforcement? (CFCE)
- Do you have a good training budget? (GCFE/GCFA)
- Are you looking to join an accredited lab? (CCE)
These are not hard rules, you could get all three and more if you choose to, but it's a decent elimination criteria for you. I will tell you that overall in my opinion that the CCE is winning. Why? They made a partnership with ASCLD to be recognized as a proficiency test for accredited lab operation. (https://www.isfce.com/ASCLD.htm)
While I and many other people are not looking forward to lab accreditation being forced on us (the day to day paperwork is painful), the partnership bestows a large amount of credibility on the certification and I do plan to obtain it now.
So I've talked about getting a vendor neutral certification and which to get, but why should you get one? This is what I believe is the important point that many miss. Your vendor certification is great for showing your competency and ability to explain the results your tools show you, but as we just discussed in the prior milestone you've grown beyond your tool. You do not have a certification in these other tools and for many tools there is no certification to be had, so beyond your own ability to demonstrate the tools reliability it’s nice to have a third party body that is attesting to your skills and ability through a written and practical test. These certifications focus more on your ability to understand artifacts, analyze evidence, and write concise reports that find and explain what they have left for you to find.
If you feel some kind of animosity towards certification programs in general I would advise you to swallow your pride and seriously consider it. While some people, Andy Rosen for example, have enough experience, education and documentable achievements/software/tools/reports behind them to be able to escape this type of scrutiny the rest of us do not. I've been doing forensics for 14 years (this December), written books, created tools, spoken at conferences, taught classes, etc... and I will tell you that I still feel that I need certification now as more judges and attorneys are looking for some way to judge an experts base competence. I'm seeing more depositions' transcripts where attorneys are asking for certification as a way to judge the reliability of reports and understanding of processes/artifacts, and this is especially important when the opposing expert has certification and you do not.
Tomorrow is Saturday and according to Lenny Zelster he would post interesting reading and quotes on weekends. That sounds pretty good to me so I'll follow the same and look to post the next part of this series on Monday.
