Failing hurts helps.

Not that long ago, I would listen in awe at the DFIR experts presenting at conferences and wondered how some people can just glide right through this work like a slip-n-slide without taking a second breath.  I mean, this work is usually pretty difficult to do but easy to make a mistake.  Missing an important artifact or misinterpreting data that gets caught by an opposing expert happens, and when it does, embarrassment sets in quite quickly.  How do these experts get away without making any mistakes?

The short answer

They made the same mistakes you make and are still making mistakes.  They fail every day.

The longer answer

We all fail and no one gets out of here alive (without failing).  The difference is what you do after you fail.  Having grown up in the South, whenever I would skin my knee or crash my bicycle, I was generally told to ‘rub some dirt on it' and get up.  I’ve pretty much lived with that advice and even raised my kids on it.  For my kids, I changed the ‘rub some dirt on it’ with ‘if you don’t see bone sticking out, get back up’.  

That’s as simple as it gets.  Fall down. Get back up.  There’s plenty of complex advice you can find on breaking this down into reflecting on how the fail happened, what steps you could have taken to prevent it, and how you can prevent the fail from happening again.  I take those steps as a given and simply know that I’ll rub dirt on it and keep going, making sure to not do that particular error again.

By the way, a failure by anyone feels the same as you do when you fail.  The difference is choosing to move past it as a learning experience.

A warning sign

If you don’t make mistakes, errors, or fails, then you are not moving forward.  You are not gaining experience or learning.  Obviously, the fewer fails you have, the better.  But having none is probably an indication that you are not trying to go beyond that what you already know.  You may not be testing your limits and pushing yourself to be better. You gotta know your limitations..

One of the worst pieces of advice that I have ever been given was from a 30-year police veteran when I was a new guy in patrol.  His advice was “never do anything and you’ll never get in trouble”.   Technically he was correct.  Don’t do any aggressive patrol and the risk of making a mistake drastically decreases.  Practically, that means you’d never get any better at the job you are getting paid to do.  Happily, I did the opposite and made enough mistakes to become so good at my job that a small-town cop traveled the world working international organized crime cases with just about every alphabet soup federal agency in North America.  I brought that attitude to digital forensics and believe me….I’ve made plenty of mistakes and fails, from forgetting to bring my presentation materials for a conference to totally missing a blatantly obvious piece of electronic evidence on a drive on a case.  Fails still smart, but rub dirt on it and learn from it.

What I am not saying

I am certainly not saying to intentionally make mistakes in order to learn or get better.  You will fail at something no matter how hard you try to succeed, so don’t worry about that.  The fails are coming, maybe in the next hour or next week.  As long as you work to learn and improve your skills, employ what you learned and master them, the mistakes will be there as you work through the process.  Try to keep the mistakes small and the learning big.  Worst are the big mistakes and small learning.  Fail small.  Learn big. 

Remember: Rub some dirt on it.  Learn from it.   Don’t do it again. 

I had coffee with a detective (ie...consulted on a case....) to discuss his case where tying a person to one specific device was necessary for criminal charges in an overly complex investigation.  There were a few things I learned and a few things he learned because of our talk.  I think it would beneficial to talk about some of the things we discussed in a webinar to pass along tidbits that can help others.

Not to take up a lot of your time, but how about a half hour of talking about placing a suspect behind a device?   I want the webinar to be live in order to take as many questions as I can squeeze in, while also packing in as much as I can in half an hour.  If you'd like to attend, register here: http://brettshavers.cc/index.php/events/event/23-webinar-free-placing-the-suspect-behind-keyboard-tips-and-case-studies.  SIDE NOTE:  There will be a bonus in the webinar that most likely be of interest to you.

The webinar is scheduled for Oct 17 at 11:00am (PST).   The webinar will be limited by virtue of the platform I'm using so if you want to get in, register early.  Given enough registrations, I may do a second webinar on the same topic afterward.  And if you do register, have some questions ready or even send them in advance (email: This email address is being protected from spambots. You need JavaScript enabled to view it.) so I can be sure to cover as many of the questions as I can.  Or just listen in.  This topic applies to both criminal and civil cases, so whether your job is to have a person arrested (or vindicated) or an employee fired (or retained), the tips apply equally.

As I have always said and believed, keep looking for that one thing that can make your case or save you minutes or even weeks of work.  Once you find that one thing, you will crush your cases as if they were Styrofoam cups.  Tip: that "one thing" is different for everyone, but we all need it to be successful.  Those are the things I want to talk about and share.

And here is one tip you can use:  Get your mind in the game.  This is easier said than done.  You can tell yourself every day to do it, but it won't work unless you know how to do it.  Just saying it doesn't work.  But once you do get your mind in the game, you will be the master of that game.  By 'game', of course I mean your job or the task at hand.  When you can create laser beam focus on a task, you will own it.   I drill this concept with the ways to do it in every talk I do.  It's that important because if your mind is in the game, you can do anything.

**** Update -Oct 17 *****

I'll have one more webinar session, limited to 50 attendees.  Details to be posted soon.

I have taught digital forensics at the University of Washington (on and off) for the better part of a decade.  I have also been a guest speaker at several universities for longer than that.  One thing that I learned from the continuing education courses is that most of the students are already working adults with many already working in the IT industry, and I take advantage of their experience by incorporating it into the classroom.

For example, I have had attorneys (prosecutors, public defenders, and civil attorneys), police officers, federal agents, software developers (some were founding members of commonly used software), and a few ‘white hat’ hackers in my courses.  Students who did not fit in any of those categories sat right next to them.
 

That was the benefit to the students: being able to absorb information from fellow students with years, if not decades, of experience.  On the first day of every course, I stress this to the students.  Take advantage of the 10-minute breaks, not by checking your email, but by talking.  Those 10-minutes breaks produce more relevant information than can be gained from a Google search, because you can talk to the people who have done it, do it every day, and want to share.  Rather than 'read' about a case, speak directly with someone who does those cases.

As for me, you better believe I took advantage of the students with experience, all for the betterment of the courses and myself.  In my prior law enforcement career as a city cop, I was a detective that worked undercover and was assigned to state, local, and federal task forces as well as investigated cyber-related crimes that spanned the planet.  I also investigated multi-national organized crime groups (drug trafficking organizations, gun trafficking, outlaw motocycle gangs, street gangs, human trafficking, counterfeit goods, etc…), terrorist cells in the United States, along with a few other crimes that took me across several states.

I give my brief background not to brag, but to show that even with my experience, I gained something from every class from nearly every person and I asked for it directly.  When I found that I had a software developer from a major software company in class, who worked on a program that I use daily…I used him for discussions in class on incorporating that program into forensic analysis reporting and visualization.  Every student in the course may not have recognized the value of speaking with someone instrumental in that one program, but we all learned new ways to use something in forensics that we would not have learned otherwise.  

Courses with law enforcement and attorneys as students also created a great amount of material and discussion based on how they do different aspects of the same job, in their different positions, titles, and agencies.  Hearing from a federal public defender talk about how forensics fits in with her work alongside a prosecutor talking about the same information but applied differently really gives the entire room a wide spectrum of knowledge.  Throwing in the investigator perspective rounds it all out. 

Granted, I’m only talking about continuing education programs.  I’ve taken and spoken at a few college degree programs where the students are students and not yet even in the workforce.  That type of class is an entirely different animal where the instructor had better know what she is talking about.  And yes, I’ve taken courses where a professor had never connected a write-blocker to a hard drive, ever…not in real life or in the classroom…never testified…never created a forensic image…yet teaches the students to do this by reading a book.  That is not the case with most schools, but certainly a few.  

In the course I teach at the University of Washington (I will call it “my” course…), I give students maximum hands-on, maximum time on the keyboard, maximum time working with the tools and maximum real-life information so that they are not only near-competent to competent, but marketable.  I call my course, “Brett’s Digital Forensics Bootcamp” (without the yelling). I don’t like wasting time and I want to teach a course that I wish I could have taken when first starting out.  That means getting your hands on data as much as possible.

One last point about continuing education programs (for higher education courses)

A conversation I had last week about DFIR certifications ended with me talking about continuing education and college degrees as perhaps a better route over certifications for certain people.  For anyone already in the IT field, I find that a continuing education certification from a major university to be ‘better’ than a vendor certification, or if not better, certainly worthwhile.  I say ‘better’ in the sense that most people in IT already have some certs on their resume.  They may not be digital forensics certs, but technology-related certs nonetheless.  Certs also expire, or are discontinued because a business goes out of business or decides to create a new cert.  Having a continuing education cert from the University of Name Your College doesn’t expire, has more clout (or is that now called klout?) through regional accreditation, and is most times considered graduate-level instruction. 

Another benefit of a continuing education course is that since the courses are not vendor specific, the whole gamut of tools can be explored along with the SPECIFICS OF THE JOB.  Vendor courses focus so much on the sale and function of their tool, little time is left to the other aspects of the job that are just as important, if not more important.  I’ve taken well over a dozen vendor courses and I cannot remember any of the courses teaching forensics, other than what their tool does for forensics.

Not knowing how to collect, analize, and present defensible evidence effectively makes the examiner ineffective, incompetent, and can ruin a case.  Especially when someone has not been taught "what is evidence", finding the elusive evidence is near impossible if you don't know what it is.  Even police officers must know the elements of a crime in order to know what a crime looks like.

Yes, you must know how software works, but you also must know the job.  It’s like driving.  You may know how to drive a car, but if you don’t know the rules of the road, you will end up getting ticketed or worse.