Knowledge Retention & Sharing in DF/IR

I had an opportunity a bit ago to engage with three other folks within the industry, all at the same time, and all of us from varied backgrounds. We had some similarities in our backgrounds, and some overlaps or near-misses in our experiences and employment, but we were all very different folks in the same industry. In a lot of ways, this is what made this a very powerful meeting and discussion.

We had the meeting because these guys had graciously taken the time out of their day to provide me with a demo of an upcoming product, and following the demo, our conversation leaned toward how this product provided various "skills" that would elevate analysts, providing new, junior, less experienced analysts with the ability to really produce very quickly, while also ideally providing a greatly accelerated growth path.

As a result of the conversation, or more accurately, where we left off, I'd like to share some thoughts...

When I started in DF/IR, there was little in the way of publicly available training. Yes, there were vendor certification courses; I availed myself of the EnCase 3. 0 Intro course in 1999, provided thru Guidance Software. However, these courses were "how to use the tool" courses, not "what happens under the hood" nor "why you should do certain things" courses.

There was no real "why" for the "how"; they'd show us the "how" for something, but there was not real "why" associated with it. " Why would I want to perform that action?" was a question that wasn't really addressed. Even the instructor, who had used the application extensively, had a lot of stories behind the work he'd done, but across the 5 days of the course, there was nothing about, "...

this is why you would want to take this action, and here's what you do with the output..."

There was nothing shared in the way of investigative processes.

I had an opportunity a bit ago to engage with three other folks within the industry, all at the same time, and all of us from varied backgrounds. We had some similarities in our backgrounds, and some overlaps or near-misses in our experiences and employment, but we were all very different folks in the same industry. In a lot of ways, this is what made this a very powerful meeting and discussion.

We had the meeting because these guys had graciously taken the time out of their day to provide me with a demo of an upcoming product, and following the demo, our conversation leaned toward how this product provided various "skills" that would elevate analysts, providing new, junior, less experienced analysts with the ability to really produce very quickly, while also ideally providing a greatly accelerated growth path.

As a result of the conversation, or more accurately, where we left off, I'd like to share some thoughts...

When I started in DF/IR, there was little in the way of publicly available training. Yes, there were vendor certification courses; I availed myself of the EnCase 3. 0 Intro course in 1999, provided thru Guidance Software. However, these courses were "how to use the tool" courses, not "what happens under the hood" nor "why you should do certain things" courses.

There was no real "why" for the "how"; they'd show us the "how" for something, but there was not real "why" associated with it. " Why would I want to perform that action?" was a question that wasn't really addressed. Even the instructor, who had used the application extensively, had a lot of stories behind the work he'd done, but across the 5 days of the course, there was nothing about, "...

this is why you would want to take this action, and here's what you do with the output..."

There was nothing shared in the way of investigative processes.