Brett's Ramblings

Font size: +
4 minutes reading time (733 words)

In the #DFIR world, it seems like everyone is an expert….

…because everyone can be an expert.

One thing about the DFIR field and all of its ever-encompassing related fields, is that it is physically impossible for any one person to be an expert in the entirety of the field. To even try to be ‘that DFIR expert’ is to set yourself up for failure.

I base my opinion on what I’ve seen over the years, especially after the first time being court qualified as an expert. Once, I was even qualified as a “computer forensic expert”. It makes me cringe every time I think about that, because as far as I am concerned, no one can be realistically be an all-encompassing DFIR expert.

The reason I distance myself from being looked at as an expert is that the perception of what a court qualified expert means to many people is most time incorrect.  Being an expert implies that you know everything, that you are smarter than anyone else in that area, and that your opinion is practically fact. 

Reality is a bit different.

Without getting into the nitty gritty of expert witness testimony or how to become court qualified, let me talk about the one aspect of specialization. If you are in the field of DFIR, working to get into the field of DFIR, or preparing yourself to eventually get into the field of DFIR, you have a 100% chance of becoming an expert in a shorter period of time than you can imagine.

You can do this because you can focus on something in this field, something as little as a few bytes or as massive as some function of an operating system and learn everything about it. You can learn so much, that eventually you start discovering things about it that no one knows. You can be the expert of that thing that you researched. Do not take this lightly. If you are looking for something to propel you into DFIR, find something that no one is doing, cares about, or knows about. Research that thing and find the DFIR relationship of that thing. Master it. Publish it with any means possible, including a blog post.

I can see the future…

Here is what will happen if, I mean when, you do this. You will be recognized in the community as an expert. Court? You will shine as an expert. Confidence? Oh yeah, you will get some. Take that one thing you did and do it again with something else.

That’s all you need to do.

A warning…

Once you become noticed for something in DFIR, you are going to be known as an expert in DFIR, which means some will will think that you know everything.  For example, I was having I was having a conversation with an awesome malware researcher, who has done amazing things in her career. She can tear apart malware as if it were packaged in a wet, paper bag. As for me, I can reverse malware too! However, I can’t do it as well, or as fast, or as complete as she can. Nowhere near it.  It is not the best thing I that I can do. I actually have a 90-second conversation limit when talking about reversing malware, because after 90 seconds, all I hear is a foreign language that I do not know. (I have been increasing my 90 seconds of knowledge on a slow, but steady rate...).

The point in this story is that in this awesome conversation, after that 90 second mark, I am sure that my face turned blank and she realized that she was the expert in malware, not me. There is nothing wrong in not knowing something, and part of the expertise field is recognizing your limits, that others will know more than you do in one area of DFIR, and you will know more than they do in other areas.  This is also makes a good team, when team members cover a broad range of expertise, spread out among the team. 

So don’t be shy to say, “I have no idea what you are talking about” when you have no idea of what someone is talking about, because in this field, we each do different things, enjoy different aspects, focus on different specifics, and excel in different facets. That is how you can be an expert too. Focus on that one thing, and one thing at a time.

Stay Informed

When you subscribe to the blog, we will send you an e-mail when there are new updates on the site so you wouldn't miss them.

Old hat investigative work will always work
Why does Google think this is a good idea?