Brett's Ramblings
Some things about training, education, and learning in DFIR
In theory, if you know what you are doing and are competent, that is all you need. In practice, being competent is rarely enough. You probably need documentation....
The importance of documentation was hammered into me for years by my employers as a government employee (military and LE). Courts made sure that anything that I did not realize was important to document before testifying, better be documented next time.
TL/DR aka Cliff Notes: Don't just download some DFIR tool and use it. Create documentation to justify your self-training/education/experience in using that tool, especially if you will be facing a jury or hiring manager.
One example I had early in police work was that of drug field tests (not the kind you see on TV, where the cop puts some unknown substance on their tongue and says, "That's good stuff"). Getting trained on how to do field drug test wasn't something that we'd get in the academy, or as a normal part of the job. Most would just follow the instructions on the test kit and call it good. I think I may have been the first person in my department to be eaten up on the stand for a drug test in my report because I said, "I followed the instructions on the kit", yet had no formal or informal training in it. My field test result was confirmed by the state lab, but I was badgered for a bit on the stand by the defense attorney on the drug test because I had no formal training in how to do it. I did nothing wrong, I followed the instructions perfectly, the case was fine, but I didn't like getting attacked for something minor like not having a piece of paper showing 'training'. 
Here is what I did that day after court. I found the most senior narc in the department, who had testified to field testing drugs, who had taught narcotic work at the academy, who did major cases, and most important, someone who would spend a few minutes with me. The senior narc (who was a Commander at the time), spent 30 minutes teaching me what I already knew, but also gave me some things that I did not. Before I left his office, I had a department head memo detailing the 'training' I just received with a brief bio of the Commander who taught me. That memo went into my training record, which I would use any time I were to testify to a field test of drugs in a case.
Having gone into narcs years afterward, I created a formal in-service class and taught every patrol officer in field-testing to make sure they didn't get eaten up on the stand for not having any training in field-testing drugs. It's a little thing, a memo or a training record, until it's a big thing.
I apply the same concept in the DFIR world. Every breakout session at every conference I attend incurs labor on my part. I write up the specific session, with the name of the presenter, with notes I take, plus the time spent in that session. If there is hands-on, I document that as well. All the better if there is a booklet of the sessions that I get in the swag bag to keep me organized. I have a spot on my shelf with these for reference. For anything that I learn on my own, guess what...I document that too. I never ever get on the stand to testify about something I did in which I do not have documentation at the ready. If/when asked, I know:
- The names of the presenters that I have learned from at the specific courses and conferences I've attended, and/or
- The number of hours that I have researched practiced with a tool or process (learning hours, not case hours), and/or
- The tools that I have written (itty bitty things that I have written) and the tests done with them.
I have documented formal education/training and documented informal training. Anything that is not documented, I don't even refer to it. I don't comment on it. I don't list it. If you have ever been on the stand to testify about your training, education, and experience, then you know that if you don't have documentation to support it, you will be under a microscope about it. If you are new to DFIR, you are lucky because you can start saving your documentation now. If you have been doing this for some time and not been saving your documentation, then you have lots of work to do.
For anyone who doesn't feel the need to keep training records or documentation, either you don't have court appearances in your planned future, haven't met the devil of an opposing counsel yet, or are in a job you don't ever plan to leave.
I tend to create online courses for the benefit of getting something on paper for those wanting something on paper. I believe we can do this job without taking a class or getting a degree. I believe that if you are in DFIR, you are smart enough to learn on your own. Actually, if you can't learn on your own, you may have a difficult time in this field. But that's not how it works if court appearances or job interviews are in your future. You need paper, and lots of it. Degrees, certifications, conferences, courses, and personally documented research & practice. The learning is implied if you do these things. Competence is assumed if you have them. All becomes clear when you employ them (clear as in, your employer will see if you actually know what you are doing or not).
If you are in a position of authority, leadership, or mentorship, teach others something. In classes I teach, whether a LE course, college course, online course, or in person at coffee, I implore the learner to take seriously what I am saying in documenting what I am teaching them, because it may become useful later. In one way that I have used this in my testimony is that I have specifically stated, "I have been trained in the use of this tool by the developer of the tool." Or, "I have been taught this forensic process by name of person, who developed the process". Or even, "I have been trained by the person who wrote a book on it." This is all the better if you are the author, tool or process developer, but second best is being taught by the tool or process developer, or the organization that developed the tool or process you used.
In a perfect world, everyone accepts that we are competent because we say that we are and we can prove it. In reality, even proving it is sometimes not enough if you don't have a document that says it.
About the author
Comments 1
By accepting you will be accessing a service provided by a third-party external to https://www.brettshavers.com/
Posts List
Tag Cloud
Search Blog
Most popular posts
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
Even better, support DFIR Training at Patreon and get access to multiple online courses in digital forensics with included ebooks!
More posts
-
COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.
The meat and potatoesA bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical…
Saturday April 25
14530 hits / 0 comments
-
Mini-WinFE 10 and WinFE 10 Updated
The short story on the newest Mini-WinFE 10 (aka, the download link):Mini-WinFE has been updated and upgraded. I update WinFE developments (including the downloads for…
Sunday April 05
8976 hits / 2 comments
-
Eat your broccoli first
Something good and something not-so-good on learning DFIRThe good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and…
Saturday January 18
30155 hits / 0 comments
-
The Second Decade of the 2000s is almost over!
We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown!…
Thursday December 26
9817 hits / 0 comments
-
Public Records
I have an outstanding public records request. It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that I…
Thursday December 12
4689 hits / 0 comments
-
The Five Stages of the DFIR Career Grief Cycle
I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig,…
Tuesday September 10
34886 hits / 0 comments
-
Our World is Going to Turn Upside Down with DeepFakes
The short storyAny person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with any…
Sunday September 01
3038 hits / 0 comments
-
If you are comfortable in DFIR, you might be doing it wrong
I took a 3-day basic forensic course and embarrassingly enough, the instructor (in front of the class), said that I probably know everything in the…
Thursday August 29
3991 hits / 0 comments
-
Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp
You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits. In fact, you can probably enjoy the…
Saturday August 17
4934 hits / 0 comments
-
Personality of a computer
From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the…
Wednesday July 31
3936 hits / 0 comments
-
Add a Dab of Balance in your DFIR World
Jessica Hyde’s post of Giving Back in DFIR from 2018 is a great write up on contributing to the DFIR community, and I see her…
Monday June 24
14607 hits / 0 comments
-
The Easy Way to Learn DFIR
SummaryThere is no easy way to learn DFIR. You can stop reading from here if you want.Longer versionOk. Since you are still reading, you probably…
Saturday June 08
13905 hits / 0 comments
-
Game of Thrones, DFIR Style
Short post and quick opinion. I came across some tweets today about how bad people are in the #infosec/#DFIR community and I dug a little…
Thursday April 25
31816 hits / 0 comments
-
Puking in DFIR
Admittedly, the title of this post is intentionally gross, because I am going to heave a few things at you, mainly about puking. As in,…
Wednesday April 17
5765 hits / 0 comments
-
The #1 Reason that DFIR practitioners don’t post opinions
Lesley Carhart tweeted today that a journalist used one of her tweets in an article that would have been rephrased in a less playful manner…
Tuesday April 09
5858 hits / 0 comments
-
If USB flash drives were shaped like spiders, we wouldn’t have these problems
I hate USB drives. My first experiences with the darn things was when I was a young patrol officer and the entire police department was…
Monday April 08
2306 hits / 0 comments
-
Working in DFIR is glamorous, but mostly only to those not working in DFIR...
Here is something about the DFIR career field: it is one of the most exciting, eventful, and jam-packed jobs that anyone can have. Running and…
Friday April 05
3844 hits / 0 comments
-
Overcommitted in DFIR
I have seen people be overcommitted, realize that they are overcommitted, yet continue forward in the most serious of situations. By overcommitted, I do not…
Friday March 22
19018 hits / 0 comments
-
'You're guilty unless you can prove it'
Swift on Security tweeted a great article. The article is not great as a well-written piece or containing earth shattering news piece, but more that…
Saturday March 09
21290 hits / 0 comments
-
“I've answered questions, responded to emails, and been on phone calls...when asked.” – Harlan Carvey
I feel obligated to respond to one of Harlan Carvey’s points in his recent blog post, Book Writing Misconceptions (https://windowsir.blogspot.com/2019/03/book-writing-misconceptions.html). I agree with everything he…
Tuesday March 05
3456 hits / 0 comments
© 2020 Brett Shavers