Brett's Ramblings
Making Ham Sandwiches in DFIR
Following up on some points made about DFIR writing on Twitter, here are my opinions on the subject of writing up your work in DFIR:
1: Write it up (or else your work didn’t happen)
2: Write it for your audience (or it won’t matter what you did anyway)
If you follow those two tips, your writing will be fine.
I agree that there are more ways to share, but writing is so important in what we (#DFIR) do.
— H. Carvey (@keydet89) February 18, 2018
In police work, report writing is frequently given the analogy of “Painting a picture”, in that you should write a story that doesn’t need explaining outside of what you wrote. The canvas should tell the entire story. Search warrant affidavits work the way in that the probable cause for the warrant must be contained (and comprehended) within the four corners of the affidavit. An independent party should be able to read what was written without requiring outside information to either support the words or interpret them. The report (aka, the picture) stands on its own to describe the story. I usually use the analogy of making a ham sandwich instead of painting a picture.
When I read a report that doesn’t make sense to me, I typically say to myself, this person can’t make a ham sandwich. I can see the tomatoes, the bread, and the ham, but it just doesn’t look like a ham sandwich. If I need the writer to verbally explain to me what was written, then the report is meaningless. It may be 100% technically accurate, but 100% worthless at the same time. I do not mean to say 'worthless' in an insulting manner, as a technical report can be very well done for a technical audience. I mean worthless in the manner that if the intended audience can't understand it, then why write in the first place.
If any of these are true, then the report wasn’t written correctly.
1: The writer needs to explain the report.
2: There is no story.
You can do the best DFIR work in the world and yet write a report that ruins it all. Or, you can write up what you did in a manner that the report can be read on national television, in full, without needing a word of exposition to translate it to the audience.
Few of us are great DFIR’rs and great writers. We tend to favor one side over the other. Some of us however, tend to ignore the writing part completely. We don’t like to write. We don’t like to edit. We don’t like to write for an audience who doesn’t know what a MFT is, after all, doesn’t everyone know what the MFT is?
The reality is, you have to write up what you did so that others can understand it. Embrace writing. Showcase your DFIR labor in your writing, so that the reader completely understands what you did, what you found, and what needs to be done next.
Make that ham sandwich.
About the author
Comments
By accepting you will be accessing a service provided by a third-party external to https://www.brettshavers.com/
Posts List
Tag Cloud
Search Blog
Most popular posts
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
Even better, support DFIR Training at Patreon and get access to multiple online courses in digital forensics with included ebooks!
More posts
-
COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.
The meat and potatoesA bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical…
Saturday April 25
14523 hits / 0 comments
-
Mini-WinFE 10 and WinFE 10 Updated
The short story on the newest Mini-WinFE 10 (aka, the download link):Mini-WinFE has been updated and upgraded. I update WinFE developments (including the downloads for…
Sunday April 05
8976 hits / 2 comments
-
Eat your broccoli first
Something good and something not-so-good on learning DFIRThe good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and…
Saturday January 18
30155 hits / 0 comments
-
The Second Decade of the 2000s is almost over!
We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown!…
Thursday December 26
9817 hits / 0 comments
-
Public Records
I have an outstanding public records request. It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that I…
Thursday December 12
4689 hits / 0 comments
-
The Five Stages of the DFIR Career Grief Cycle
I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig,…
Tuesday September 10
34886 hits / 0 comments
-
Our World is Going to Turn Upside Down with DeepFakes
The short storyAny person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with any…
Sunday September 01
3038 hits / 0 comments
-
If you are comfortable in DFIR, you might be doing it wrong
I took a 3-day basic forensic course and embarrassingly enough, the instructor (in front of the class), said that I probably know everything in the…
Thursday August 29
3991 hits / 0 comments
-
Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp
You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits. In fact, you can probably enjoy the…
Saturday August 17
4934 hits / 0 comments
-
Personality of a computer
From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the…
Wednesday July 31
3936 hits / 0 comments
-
Add a Dab of Balance in your DFIR World
Jessica Hyde’s post of Giving Back in DFIR from 2018 is a great write up on contributing to the DFIR community, and I see her…
Monday June 24
14607 hits / 0 comments
-
The Easy Way to Learn DFIR
SummaryThere is no easy way to learn DFIR. You can stop reading from here if you want.Longer versionOk. Since you are still reading, you probably…
Saturday June 08
13904 hits / 0 comments
-
Game of Thrones, DFIR Style
Short post and quick opinion. I came across some tweets today about how bad people are in the #infosec/#DFIR community and I dug a little…
Thursday April 25
31816 hits / 0 comments
-
Puking in DFIR
Admittedly, the title of this post is intentionally gross, because I am going to heave a few things at you, mainly about puking. As in,…
Wednesday April 17
5765 hits / 0 comments
-
The #1 Reason that DFIR practitioners don’t post opinions
Lesley Carhart tweeted today that a journalist used one of her tweets in an article that would have been rephrased in a less playful manner…
Tuesday April 09
5858 hits / 0 comments
-
If USB flash drives were shaped like spiders, we wouldn’t have these problems
I hate USB drives. My first experiences with the darn things was when I was a young patrol officer and the entire police department was…
Monday April 08
2306 hits / 0 comments
-
Working in DFIR is glamorous, but mostly only to those not working in DFIR...
Here is something about the DFIR career field: it is one of the most exciting, eventful, and jam-packed jobs that anyone can have. Running and…
Friday April 05
3844 hits / 0 comments
-
Overcommitted in DFIR
I have seen people be overcommitted, realize that they are overcommitted, yet continue forward in the most serious of situations. By overcommitted, I do not…
Friday March 22
19018 hits / 0 comments
-
'You're guilty unless you can prove it'
Swift on Security tweeted a great article. The article is not great as a well-written piece or containing earth shattering news piece, but more that…
Saturday March 09
21290 hits / 0 comments
-
“I've answered questions, responded to emails, and been on phone calls...when asked.” – Harlan Carvey
I feel obligated to respond to one of Harlan Carvey’s points in his recent blog post, Book Writing Misconceptions (https://windowsir.blogspot.com/2019/03/book-writing-misconceptions.html). I agree with everything he…
Tuesday March 05
3456 hits / 0 comments
© 2020 Brett Shavers