@night 1803 access accessdata active directory admissibility ads aduc aim aix ajax alex levinson alissa torres amcache analysis anjp anssi answer key antiforensics apfs appcompat appcompatflags applocker april fools argparse arman gungor arsenal artifact extractor attachments attacker tools austin automating automation awards aws azure azuread back to basics backstage bam base16 best finds beta bias bitcoin bitlocker blackbag blackberry enterprise server blackhat blacklight blade blanche lagny book book review brute force bsides bulk extractor c2 carved carving case ccdc cd burning ceic cfp challenge champlain chat logs Christmas Christmas eve chrome cit client info cloud forensics command line computer forensics computername conference schedule consulting contest cool tools. tips copy and paste coreanalytics cortana court approved credentials cryptocurrency ctf cti summit cut and paste cyberbox Daily Blog dbir deep freeze defcon defender ata deviceclasses dfa dfir dfir automation dfir exposed dfir in 120 seconds dfir indepth dfir review dfir summit dfir wizard dfrws dfvfs dingo stole my baby directories directory dirty file system disablelastaccess discount download dropbox dvd burning e01 elastic search elcomsoft elevated email recovery email searching emdmgmt Encyclopedia Forensica enfuse eric huber es eshandler esxi evalexperience event log event logs evidence execution exfat ext3 ext4 extended mapi external drives f-response factory access mode false positive fat fde firefox for408 for498 for500 for526 for668 forenisc toolkit forensic 4cast forensic lunch forensic soundness forensic tips fraud free fsutil ftk ftk 2 full disk encryption future gcfe gcp github go bag golden ticket google gsuite guardduty gui hackthebox hal pomeranz hashlib hfs honeypot honeypots how does it work how i use it how to howto IE10 imaging incident response indepth information theft infosec pro guide intern internetusername Interview ios ip theft iphone ir itunes encrypted backups jailbreak jeddah jessica hyde joe sylve journals json jump lists kali kape kevin stokes kibana knowledgec korman labs lance mueller last access last logon lateral movement leanpub libtsk libvshadow linux linux forensics linux-3g live systems lnk files log analysis log2timeline login logs london love notes lznt1 mac mac_apt macmini magnet magnet user summit magnet virtual summit mari degrazia mathias fuchs md viewer memorial day memory forensics metaspike mft mftecmd mhn microsoft milestones mimikatz missing features mlocate mobile devices mojave mount mtp multiboot usb mus mus 2019 mus2019 nccdc netanalysis netbios netflow new book new years eve new years resolutions nominations nosql notifications ntfs ntfsdisablelastaccessupdate nuc nw3c objectid offensive forensics office office 2016 office 365 oleg skilkin osx outlook outlook web access owa packetsled paladin pancake viewer path specification pdf perl persistence pfic plists posix powerforensics powerpoint powershell prefetch psexec py2exe pyewf pyinstaller python pytsk rallysecurity raw images rdp re-c re-creation testing reader project recipes recon recursive hashing recycle bin redteam regipy registry registry explorer registry recon regripper remote research reverse engineering rhel rootless runas sample images san diego SANS sans dfir summit sarah edwards saturday Saturday reading sbe sccm scrap files search server 2008 server 2008 r2 server 2012 server 2019 setmace setupapi sha1 shadowkit shadows shell items shellbags shimcache silv3rhorn skull canyon skype slow down smb solution solution saturday sop speed sponsors sqlite srum ssd stage 1 stories storport sunday funday swgde syscache system t2 takeout telemetry temporary files test kitchen thanksgiving threat intel timeline times timestamps timestomp timezone tool tool testing training transaction logs triage triforce truecrypt tsk tun naung tutorial typed paths typedpaths uac unc understanding unicorn unified logs unread updates usb usb detective usbstor user assist userassist usnjrnl validation vhd video video blog videopost vlive vmug vmware volatility vote vss web2.0 webcast webinar webmail weekend reading what are you missing what did they take what don't we know What I wish I knew whitfield windows windows 10 windows 2008 windows 7 windows forensics windows server winfe winfe lite winscp wmi write head xboot xfs xways yarp yogesh zimmerman zone.identifier

Daily Blog #5: Milestones 3 and 4 detailed


Hello Reader,
                     The conversation from these posts is continuing in the comments and I'd like to ask you to consider joining us. While I enjoy sharing my perspectives we would all benefit from hearing yours as well. Whether you are just getting started or you've been doing this longer than I have, I would hope you would consider providing your experiences with these milestones and what is different in your professional achievements.

    That said today's post will focus on milestones 3 and 4 as we continue up the ladder of skill and sophistication as a digital forensic examiner.

Milestone 3 - You look beyond your tool.
    This is a moment of apprehension for many examiners. You've been well trained on your tool of choice and you might have heard some excellent marketing people explain to you the importance of using only tools like theirs which courts welcome with open arms. However, you also now know that other people are starting to find artifacts your tool does not yet support and you are you realizing you are missing evidence because of it. The development cycle for a major forensic suite is long, so it’s not that your tool of choice doesn't want to integrate every artifact that examiners unearth on a daily basis, it just has to be prioritized into their development schedule before they can implement it.

    You also begin finding limits to the efficiency your tool of choice is providing, whether it's how its presenting data for you to review/export, to how it's handling a support artifact you want to get more data out of, or get things done faster and your tool isn't keeping up. Now is the time when you start looking at the ever widening range of other tools out there. Some examiners gravitate to another large suite tool, for instance many users of TCT, FTK and EnCase will use one of the other three to fill in a gap in functionality. Some users will gravitate to the purity of X-ways in a hope to get deeper into guts of forensics, while others will look to augment their tools abilities with tools that fill a gap like IEF. What's not important is what additional tool (commercial or open source) you adopt into your process but the fact that you've opened yourself to doing so and gotten over the fear of non-vendor created tools. This is an important step and one of many decisions you'll make of what tool to use and whose output to trust as you continue to improve.

    Not all tools are made equal and eventually you may end up like me, with a license of almost every tool because each one handles X better than the others. I'm not going to tell you it’s cheap, and don't think I get anything for free (although I am willing to!), but as your case load grows you'll find that the work justifies the expense.

    If you notice I've mentioned a lot of commercial tools in this post, please do not consider that an endorsement of commercial tools only or a slight towards free and open source tools. I'm trying to make sure this post is relevant to the largest segment of readers. Substitute any tool name you want in this post and the point still remains valid. In my work we use everything we can get our hands on that creates reliable, verifiable output.

Milestone 4 - You get certified with a vendor neutral certification.
    Some examiners who have been in the field a long time may deride my focus on certifications for the new examiner, and that's OK. I didn't get a forensic certification until last year and I'm just now in the process of getting a vendor neutral certification (if I ever find the time to finish!). However, we are the exception to the rule as we started doing computer forensics prior to there being any certifications available to non-law enforcement examiners. That being said, for those of you who aren't cynical forensic veterans, certification is something that more employers, attorneys and judges are looking for. We discussed in Milestone 2 vendor certification and what it skills it actually demonstrates. In Milestone 4 we are looking at certifications not tied to a specific product but towards a provable set of skills, processes, and knowledge in your ability to analyze and report your findings.

    There are many vendor neutral certifications out there these days; CCE, GCFE/GCFA, CFCE, etc... and which one is right for you will depend on many things such as;
 
  • Are you law enforcement? (CFCE)
  • Do you have a good training budget? (GCFE/GCFA)
  • Are you looking to join an accredited lab? (CCE)

    These are not hard rules, you could get all three and more if you choose to, but it's a decent elimination criteria for you. I will tell you that overall in my opinion that the CCE is winning.  Why? They made a partnership with ASCLD to be recognized as a proficiency test for accredited lab operation. (https://www.isfce.com/ASCLD.htm)
 
    While I and many other people are not looking forward to lab accreditation being forced on us (the day to day paperwork is painful), the partnership bestows a large amount of credibility on the certification and I do plan to obtain it now.

    So I've talked about getting a vendor neutral certification and which to get, but why should you get one? This is what I believe is the important point that many miss. Your vendor certification is great for showing your competency and ability to explain the results your tools show you, but as we just discussed in the prior milestone you've grown beyond your tool. You do not have a certification in these other tools and for many tools there is no certification to be had, so beyond your own ability to demonstrate the tools reliability it’s nice to have a third party body that is attesting to your skills and ability through a written and practical test. These certifications focus more on your ability to understand artifacts, analyze evidence, and write concise reports that find and explain what they have left for you to find.

    If you feel some kind of animosity towards certification programs in general I would advise you to swallow your pride and seriously consider it. While some people, Andy Rosen for example, have enough experience, education and documentable achievements/software/tools/reports behind them to be able to escape this type of scrutiny the rest of us do not. I've been doing forensics for 14 years (this December), written books, created tools, spoken at conferences, taught classes, etc... and I will tell you that I still feel that I need certification now as more judges and attorneys are looking for some way to judge an experts base competence. I'm seeing more depositions' transcripts where attorneys are asking for certification as a way to judge the reliability of reports and understanding of processes/artifacts, and this is especially important when the opposing expert has certification and you do not.

    Tomorrow is Saturday and according to Lenny Zelster he would post interesting reading and quotes on weekends. That sounds pretty good to me so I'll follow the same and look to post the next part of this series on Monday.


Labels:

Post a Comment

[blogger][disqus][facebook][spotim]

Author Name

Contact Form

Name

Email *

Message *

Powered by Blogger.