Brett's Ramblings
Eat your broccoli first
Something good and something not-so-good on learning DFIR
The good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and gain skills in this career than most any other professional career.
* Resources are plentiful (such as thousands of websites, hundreds of books, colleges, trade schools, etc..)
* Skills (aka: competence) are generally more important than pieces of paper (i.e.: certifications)
* The DFIR field is segmented into many specific jobs (at least one surely fits you best!)
The not-so-good thing is the time and effort needed. Plus it is scary because of the time, effort, and money involved is a virtual unknown when you start out. Then again, anything worthwhile is worth the effort and time. The time and effort needed is actually the most common obstacle that everyone faces to get into the DFIR field. Keep in mind that no matter which path in DFIR that you embark, you have a lot of barrels to jump over and they just keep coming. Sometimes, it seems that there are so many that you feel that you will never make it. Everyone gets frustrated. Many give up. Some keep going (this is you).
Let’s get something out the way first
In this game of getting of getting into DFIR, or growing your skills in DFIR, everyone has to jump over the same barrels, meaning, there are subjects and skills that you must learn, just like everyone else. No one has a shortcut to reach the end. (PS: there is no end to what you need to learn to stay relevant and current). There is one tip that I found to work for me that might work for you. By the way, I am far from perfect, far from the smartest, and far from the best. It feels like that I have to work twice as hard as everyone else, but I realize that everyone has to work hard regardless of who you are or what your background experience may be.
First things first.
Keeping your DFIR skills up is no easier than it is to get the skills in the first place. We each know that because we know how difficult it is to get started. We are reminded of this sometimes-painful trek into DFIR each time we hear the question asked, “How do I get started?”.
As for me, as it applies to anything that I wanted to learn, the first lesson that I learned still applies today as it did the first time I really wanted to learn. That lesson is..
Eat your broccoli first.
Translated, this means to first do the things that you don’t want to do but you know have to get done. Get it over with as quick as possible. Push yourself through it. Your desire to only do what you want to do and not do what you don’t want to do is not only irrelevant, it is counterproductive. But how does that apply in the DFIR world?
The broccoli
If you love broccoli, then broccoli is a bad analogy. But I think you see my point. I not the biggest fan of broccoli, so when it is on my plate, I eat it first, because I don’t like it. I like the health benefits, but not the broccoli itself. But I know by eating it first, I won’t have to suffer eating it later when it is cold and staring me in the face for 20 minutes after I finished eating my steak. To be fair, by eating my broccoli first for years, I now like it.
In DFIR, we have lots of ‘broccoli’ to eat. Hexadecimal may be one for you (unless you like hex from the beginning). Basic computer repair (A+) for another. Network topology may be another one for you. And the list goes on. The things that are not glamourous, but necessary to do the DFIR work, must be learned, otherwise, they will stare at you later as you regret not mastering these topics first.
Luckily, in the broad category of DFIR, you can avoid much of what you might not like if you choose your job carefully. I doubt you can avoid the broccoli all together, but you can minimize quite a bit by avoiding the type of jobs that require learning what you don’t want to learn. But generally, across the board, there are quite a few topics in DFIR that everyone should know. Some of the topics fall into the “must know” category. Other topics are specific to the specific type of job in broad category of DFIR.
The way I handle the topics that bore me, or that I don’t initially think to be important, is to make those topics a priority. Learn them. Become competent enough, and then move onto the things that I want to do. Otherwise, if you skip over the basics or the boring things, the day will come when you will suffer at having not done the first things first.
Programming (your brain)
For me, at this stage of life and work, I actually like the boring topics, because I have seen where a basic fundamental aspect of DFIR will cinch a case shut. Many in the field skip the basics and that is where the big failures come. I have also seen some turn a “basic” forensic thing into a whole new world of how to do forensics.
Let me reiterate
* There is no free lunch.
* You cannot fake competence (for long).
* You can’t buy competence.
* You can’t buy experience.
* You can’t buy knowledge.
* You can’t buy determination.
* You can’t buy dedication.
* There are no shortcuts.
I screwed up
If I don’t catch myself making an error somewhere at some point, that means I am missing my mistakes. We all make them because we are human. The people who claim to never have made a mistake, or an oversight, or any fragment of an error only fool themselves.
The path to learning DFIR, whether new to the field or in it for decades, resembles the act of shopping for a car. Or dishes. Or groceries. Or a computer. No matter which thing you choose to buy at the time, eventually you discover that you should have bought something different or at a different place for a better price. That is the way it works buying things and the way it works learning things. Some of the things work out. Some were not the best idea.
Some of my greatest hits of screwups
* Studied like crazy for a cert and failed just as crazily. Then failed again. I even failed a third time. Just call me rock.
* Not studied at all for a cert due to over confidence (arrogance probably) and failed just as miserably. Twice.
* Paid for certs that did absolutely nothing for me because 'everyone' says you need these.
* Refused to get a specific cert out of spite even though it probably would have helped me get hired.
* Renewed same certs…for no good reasons other than acronyms to put on a CV.
* Paid for membership in “high tech” orgs that provided nothing more than a certificate of membership.
* Paid for a cert that required no test, no exam, nothing. Too embarrassed to ever write that one on my CV.
* Paid for an expensive course that was WAAAAYYYY above my level at the time. Gained practically nothing in the course.
* Paid for an expensive course that was WAAAAAYYY below my level at the time. Also, gained practically nothing in the course.
* Bought expensive software and hardware that I didn’t need, but everyone said that I did.
* Didn't buy expensive software and hardware that I knew I that I needed, but wrongly assumed that I could use other software and hardware.
* Not listened to advice from experienced mentors.
* Listened to advice from experienced mentors (sometimes it works, sometimes it doesn’t…)
* Took on cases that I ‘assumed’ I could handle, resulting in hiring people who could actually handle the cases that I assumed I could do.
* Take the above listed items, multiply by a factor of 4, maybe 5 or 6, and that's my life in learning DFIR..
But with that, a few neat things happened along the path..
* Hired to teach forensics at a university that rejected me as a student several years prior.
* Hired to teach forensics to a federal agency (same agency that also didn’t hire me when I applied…).
* Turned down a request to apply to that same federal agency that didn’t hire me (life had changed in a different & better direction).
* Taught forensics to a packed room of PhDs who teach forensics, yet never did forensics, but wanted to learn forensics!
* Met some of the smartest people in the world in this field, and most all have been great people!
* Worked some of the most amazing types of cases with incredible government agencies and law firms from class action litigation to the “T” type cases (if you worked in an alphabet agency, you probably know what I mean by T…….. case).
Perceptions change
Here is how I initially looked at everyone who was working in DFIR (even before ‘DFIR’ was coined);
Wow. They are so lucky. They had all the opportunities. They must all be geniuses. They must have had it so easy their entire life. I am so unlucky compared to them. Life is so unfair. I have to work so much harder to get where they are at. They are younger than me (or older), taller (or shorter) than me. You name it, I thought it. I feel pretty stupid thinking today about what I was thinking about all the DFIR folks at that time...
Here is how I look at them now;
They had to have worked hard. They had to have had amazing obstacles to overcome. They most likely had personal issues to handle at the same time of learning this work. They struggled like me. They most certainly are determined. They most certainly know that you have to put in the work. They are definitely still learning. They surely know that they don't know everything and never will. They all had different paths, and every path had it's own obstacles and challenges. They also know to eat the broccoli first.
About the author
Comments
Posts List
Tag Cloud
Search Blog
Most popular posts
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
Even better, support DFIR Training at Patreon and get access to multiple online courses in digital forensics with included ebooks!
More posts
-
Eat your broccoli first
Something good and something not-so-good on learning DFIR The good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn…
Saturday January 18
212 hits / 0 comments
-
The Second Decade of the 2000s is almost over!
We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown!…
Thursday December 26
8984 hits / 0 comments
-
Public Records
I have an outstanding public records request . It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that…
Thursday December 12
4363 hits / 0 comments
-
The Five Stages of the DFIR Career Grief Cycle
I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig,…
Tuesday September 10
33484 hits / 0 comments
-
Our World is Going to Turn Upside Down with DeepFakes
The short story Any person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with…
Sunday September 01
2333 hits / 0 comments
-
If you are comfortable in DFIR, you might be doing it wrong
I took a 3-day basic forensic course and embarrassingly enough, the instructor (in front of the class), said that I probably know everything in the…
Thursday August 29
2804 hits / 0 comments
-
Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp
You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits. In fact, you can probably enjoy the…
Saturday August 17
3479 hits / 0 comments
-
Personality of a computer
From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the…
Wednesday July 31
2823 hits / 0 comments
-
Add a Dab of Balance in your DFIR World
Jessica Hyde ’ s post of Giving Back in DFIR from 2018 is a great write up on contributing to the DFIR community, and I…
Monday June 24
13695 hits / 0 comments
-
The Easy Way to Learn DFIR
Summary There is no easy way to learn DFIR . You can stop reading from here if you want. Longer version Ok. Since you are…
Saturday June 08
12173 hits / 0 comments
-
Game of Thrones, DFIR Style
Short post and quick opinion. I came across some tweets today about how bad people are in the #infosec/#DFIR community and I dug a little…
Thursday April 25
28340 hits / 0 comments
-
Puking in DFIR
Admittedly, the title of this post is intentionally gross, because I am going to heave a few things at you, mainly about puking. As in,…
Wednesday April 17
5235 hits / 0 comments
-
The #1 Reason that DFIR practitioners don’t post opinions
Lesley Carhart tweeted today that a journalist used one of her tweets in an article that would have been rephrased in a less playful…
Tuesday April 09
5488 hits / 0 comments
-
If USB flash drives were shaped like spiders, we wouldn’t have these problems
I hate USB drives. My first experiences with the darn things was when I was a young patrol officer and the entire police department was…
Monday April 08
1547 hits / 0 comments
-
Working in DFIR is glamorous, but mostly only to those not working in DFIR...
Here is something about the DFIR career field: it is one of the most exciting, eventful, and jam-packed jobs that anyone can have. Running and…
Friday April 05
3032 hits / 0 comments
-
Overcommitted in DFIR
I have seen people be overcommitted, realize that they are overcommitted, yet continue forward in the most serious of situations. By overcommitted, I do not…
Friday March 22
16947 hits / 0 comments
-
'You're guilty unless you can prove it'
Swift on Security tweeted a great article. The article is not great as a well-written piece or containing earth shattering news piece, but more that…
Saturday March 09
20174 hits / 0 comments
-
“I've answered questions, responded to emails, and been on phone calls...when asked.” – Harlan Carvey
I feel obligated to respond to one of Harlan Carvey’s points in his recent blog post, Book Writing Misconceptions ( https://windowsir.blogspot.com/2019/03/book-writing-misconceptions.html ). I agree with…
Tuesday March 05
3022 hits / 0 comments
-
All you need is a tiny spark to solve your case.
During a recent workshop, one person in the class kept asking me for the magic bullet to work his case. By that, I mean that he…
Saturday March 02
2602 hits / 0 comments
-
Some CONS are good. Some cons are bad.
The bad cons are the criminals that victimize you. The good CONS are the conferences that you were glad to attend. CTIN is one of…
Thursday February 14
7917 hits / 0 comments
© 2020 Brett Shavers