Hello Reader,
The conversation from these posts is continuing in the comments and I'd like to
ask you to consider joining us. While I enjoy sharing my perspectives we would
all benefit from hearing yours as well. Whether you are just getting started or
you've been doing this longer than I have, I would hope you would consider
providing your experiences with these milestones and what is different in your
professional achievements.
That said today's post will focus on
milestones 3 and 4 as we continue up the ladder of skill and sophistication as
a digital forensic examiner.
Milestone 3 - You look beyond your tool.
This is a moment
of apprehension for many examiners. You've been well trained on your tool of
choice and you might have heard some excellent marketing people explain to you
the importance of using only tools like theirs which courts welcome with open
arms. However, you also now know that other people are starting to find artifacts
your tool does not yet support and you are you realizing you are missing
evidence because of it. The development cycle for a major forensic suite is
long, so it’s not that your tool of choice doesn't want to integrate every
artifact that examiners unearth on a daily basis, it just has to be prioritized
into their development schedule before they can implement it.
You also begin finding limits to the
efficiency your tool of choice is providing, whether it's how its presenting
data for you to review/export, to how it's handling a support artifact you want
to get more data out of, or get things done faster and your tool isn't keeping
up. Now is the time when you start looking at the ever widening range of other
tools out there. Some examiners gravitate to another large suite tool, for
instance many users of TCT, FTK and EnCase will use one of the other
three to fill in a gap in functionality. Some users will gravitate to the
purity of X-ways in a hope to get deeper into guts of forensics, while others
will look to augment their tools abilities with tools that fill a gap like IEF.
What's not important is what additional tool (commercial or open source) you
adopt into your process but the fact that you've opened yourself to doing so and
gotten over the fear of non-vendor created tools. This is an important
step and one of many decisions you'll make of what tool to use and whose output
to trust as you continue to improve.
Not all tools are made equal and
eventually you may end up like me, with a license of almost every tool because
each one handles X better than the others. I'm not going to tell you it’s
cheap, and don't think I get anything for free (although I am willing to!), but
as your case load grows you'll find that the work justifies the expense.
If you notice I've mentioned a lot
of commercial tools in this post, please do not consider that an endorsement of
commercial tools only or a slight towards free and open source tools. I'm
trying to make sure this post is relevant to the largest segment of readers.
Substitute any tool name you want in this post and the point still remains
valid. In my work we use everything we can get our hands on that creates reliable, verifiable output.
Milestone 4 - You get certified with a vendor neutral certification.
Some examiners
who have been in the field a long time may deride my focus on certifications
for the new examiner, and that's OK. I didn't get a forensic certification
until last year and I'm just now in the process of getting a vendor neutral
certification (if I ever find the time to finish!). However, we are the
exception to the rule as we started doing computer forensics prior to there
being any certifications available to non-law enforcement examiners. That being
said, for those of you who aren't cynical forensic veterans, certification is
something that more employers, attorneys and judges are looking for. We
discussed in Milestone 2 vendor certification and what it skills it actually
demonstrates. In Milestone 4 we are looking at certifications not tied to a
specific product but towards a provable set of skills, processes, and knowledge
in your ability to analyze and report your findings.
There are many vendor neutral
certifications out there these days; CCE, GCFE/GCFA, CFCE, etc... and which one
is right for you will depend on many things such as;
- Are you law enforcement? (CFCE)
- Do you have a good training budget? (GCFE/GCFA)
- Are you looking to join an accredited lab? (CCE)
These are not hard rules, you could
get all three and more if you choose to, but it's a decent elimination criteria for
you. I will tell you that overall in my opinion that the CCE is winning.
Why? They made a partnership with ASCLD to be recognized as a proficiency test
for accredited lab operation. (https://www.isfce.com/ASCLD.htmL)
While I and many other people are
not looking forward to lab accreditation being forced on us (the day to day
paperwork is painful), the partnership bestows a large amount of credibility on
the certification and I do plan to obtain it now.
So I've talked about getting a
vendor neutral certification and which to get, but why should you get one? This
is what I believe is the important point that many miss. Your vendor
certification is great for showing your competency and ability to explain the
results your tools show you, but as we just discussed in the prior milestone
you've grown beyond your tool. You do not have a certification in these other
tools and for many tools there is no certification to be had, so beyond your
own ability to demonstrate the tools reliability it’s nice to have a third
party body that is attesting to your skills and ability through a written and
practical test. These certifications focus more on your ability to understand
artifacts, analyze evidence, and write concise reports that find and explain
what they have left for you to find.
If you feel some kind of animosity
towards certification programs in general I would advise you to swallow your
pride and seriously consider it. While some people, Andy Rosen for example,
have enough experience, education and documentable
achievements/software/tools/reports behind them to be able to escape this type
of scrutiny the rest of us do not. I've been doing forensics for 14 years
(this December), written books, created tools, spoken at conferences, taught
classes, etc... and I will tell you that I still feel that I need certification
now as more judges and attorneys are looking for some way to judge an experts
base competence. I'm seeing more depositions' transcripts where attorneys are
asking for certification as a way to judge the reliability of reports and
understanding of processes/artifacts, and this is especially important when the
opposing expert has certification and you do not.
Tomorrow is Saturday and according
to Lenny Zelster he would post interesting reading and quotes on weekends. That
sounds pretty good to me so I'll follow the same and look to post the next part
of this series on Monday.
