Brett's Ramblings

Font size: +
5 minutes reading time (983 words)

DFIR Mentors.  You just might be one and not know it.

If you share information, openly discuss that which you can, and sincerely try to help others in the DF/IR field, you are probably someone’s mentor and do not even know it.   I have always understood the term of “mentor” seriously as it implies a responsibility to teach others, and also suggests that you know a lot more than you think you know.

When you are in that position of being a mentor, know that your words are heavy.  You may not have asked to be someone’s mentor.  You may not want to be anyone’s mentor.  You may refuse to even being called a mentor.  But guess what…you are, whether you like it or not.   My advice is to run with it.  Your words can make an incredible difference in someone’s career (aka: substantial part of their life).

Harlan Carvey may not remember the day I first spoke to him by phone, but I remember it like it was yesterday.  I may not exactly remember how I came about to call him, except through a series of emails and questions that I wanted to ask him.  At the time, I was extremely proficient at working my way as an undercover officer in any criminal organization I targeted, in any number of states (and internationally).  But at the time, I was moving into the computer forensics world and was a green as a gooseberry in the middle June when it came to forensics.   That one phone call with Harlan set me on a new career path that I am truly grateful, especially since the undercover work was getting a bit hairy at times…I would say that my wife and kids really appreciated the career move.

Harlan was my mentor, at least with that phone call, and practically still is. 

Through the following years, I have had several mentors from the DF/IR field.  Most of which I never spoke or corresponded.   I read their writings, took their courses, or used their software.  I followed them as my mentors as if they were actually mentoring me (hint: they were, they just didn’t know it).

Getting to the point.

Your words are heavy.  Did I say that already? This must be important then.  I most likely follow your words to this day and your words have influenced me to be better, do better, and keep learning.  Especially if you have spoken to me personally, or emailed me, or DM’d me….  You just might be one of my mentors and not know it.

Since you just might be someone's mentor, here is some friendly advice.

Lend a helping hand. Encourage those who you have influence to do better than you did.  Show them the way to do things more efficiently and more effectively.  Our goal is to improve our lot, not to personally be the better than everyone else or constantly be the only 'winner' because we are the only ones who know how to do this job.  We are better because we help our peers and our juniors be better than we ever were or will be. You are the Yoda to today's Luke and Rey.

One of the things I do today is that which was done for me.  On that first call I had with Harlan Carvey, he gave me some advice.  Start a blog.  Find something no else is doing and research it.  Write a book.  And so I did, for myself at first.  But since then, I have helped ghostwrite DF/IR books for first timers, tech edit other books, and encouraged more than a few others to start Microsoft Word and get typing on their ideas for a great DF/IR book.  Some have not only taken me up on the challenge and published their book after me pushing them a little forward, but a few are also helping others in the same way.  Technically, I call this super cool.  One of my shelves of DF/IR books, I have a special section of books that I had a hand in being published.  I am most proud of those, even more so than the ones I have written because they are better than mine. That was my intention.

As an example of lending a hand, for book topics with those wanting to be published, I often get asked questions like, “What would you recommend to write about?” or “What do you think of this idea?”.  I always give my honest opinion based on (1) would I buy this book today or (2) would I have bought this book when I first started.  If neither fits me, my opinion is that maybe the idea works for others, but not for me. As for book ideas, I believe you can take any minute topic in the entire field of Digital Forensics / Incident Response and expand an entire encyclopedia on that one specific topic.  I’m not exaggerating. There is no need in the world to take an idea that has already been done and do over unless you can completely change everything that has already been done.  Why do that when you can be innovative, creative, and original?  Don’t reinvent the wheel.

There are too many ways in which you can be a mentor to positively affect someone in the field.  You can not only mentor the new folks, but believe it or not, you are probably mentoring your peers as well.  There is not a thing I cannot learn from every person, regardless of who it is.  If someone speaks, writes, or teaches, I can learn something regardless if it from a student or professor, user or developer, writer or reader.  This thinking should apply to you as well.

Your words are heavy.  You influence more than the people around you.  You influence everyone in the field.  You are a mentor, whether you accept the challenge or not, it is what it is.  I’m happy with that.



Stay Informed

When you subscribe to the blog, we will send you an e-mail when there are new updates on the site so you wouldn't miss them.

When you think you know enough
Bitcoin Forensics | Investigating Cryptocurrency C...