Eat your broccoli first

Something good and something not-so-good on learning DFIR.

The good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and gain skills in this career than most any other professional career.

* Resources are plentiful (such as thousands of websites, hundreds of books, colleges, trade schools, etc..)

* Skills (aka: competence) are generally more important than pieces of paper (i.e.: certifications)

* The DFIR field is segmented into many specific jobs (at least one surely fits you best!)

The not-so-good thing is the time and effort needed. Plus it is scary because of the time, effort, and money involved is a virtual unknown when you start out. Then again, anything worthwhile is worth the effort and time. The time and effort needed is actually the most common obstacle that everyone faces to get into the DFIR field. Keep in mind that no matter which path in DFIR that you embark, you have a lot of barrels to jump over and they just keep coming. Sometimes, it seems that there are so many that you feel that you will never make it. Everyone gets frustrated. Many give up. Some keep going (this is you).

Let’s get something out the way first

In this game of getting of getting into DFIR, or growing your skills in DFIR, everyone has to jump over the same barrels, meaning, there are subjects and skills that you must learn, just like everyone else. No one has a shortcut to reach the end. (PS: there is no end to what you need to learn to stay relevant and current). There is one tip that I found to work for me that might work for you. By the way, I am far from perfect, far from the smartest, and far from the best. It feels like that I have to work twice as hard as everyone else, but I realize that everyone has to work hard regardless of who you are or what your background experience may be.

First things first.

Keeping your DFIR skills up is no easier than it is to get the skills in the first place. We each know that because we know how difficult it is to get started. We are reminded of this sometimes-painful trek into DFIR each time we hear the question asked, “How do I get started?”.

As for me, as it applies to anything that I wanted to learn, the first lesson that I learned still applies today as it did the first time I really wanted to learn. That lesson is..

Eat your broccoli first.

Translated, this means to first do the things that you don’t want to do but you know have to get done. Get it over with as quick as possible. Push yourself through it. Your desire to only do what you want to do and not do what you don’t want to do is not only irrelevant, it is counterproductive. But how does that apply in the DFIR world?

The broccoli

If you love broccoli, then broccoli is a bad analogy. But I think you see my point. I not the biggest fan of broccoli, so when it is on my plate, I eat it first, because I don’t like it. I like the health benefits, but not the broccoli itself. But I know by eating it first, I won’t have to suffer eating it later when it is cold and staring me in the face for 20 minutes after I finished eating my steak. To be fair, by eating my broccoli first for years, I now like it.

In DFIR, we have lots of ‘broccoli’ to eat. Hexadecimal may be one for you (unless you like hex from the beginning). Basic computer repair (A+) for another. Network topology may be another one for you. And the list goes on. The things that are not exciting, but necessary to do the DFIR work, must be learned, otherwise, they will stare at you later as you regret not mastering these topics first.

Luckily, in the broad category of DFIR, you can avoid much of what you might not like if you choose your job carefully. I doubt you can avoid the broccoli all together, but you can minimize quite a bit by avoiding the type of jobs that require learning what you don’t want to learn. But generally, across the board, there are quite a few topics in DFIR that everyone should know. Some of the topics fall into the “must know” category. Other topics are specific to the specific type of job in broad category of DFIR.

The way I handle the topics that bore me, or that I don’t initially think to be important, is to make those topics a priority. Learn them. Become competent enough, and then move onto the things that I want to do. Otherwise, if you skip over the basics or the boring things, the day will come when you will suffer at having not done the first things first.

Programming (your brain)

For me, at this stage of life and work, I actually like the boring topics, because I have seen where a basic fundamental aspect of DFIR will cinch a case shut. Many in the field skip the basics and that is where the big failures come. I have also seen some turn a “basic” forensic thing into a whole new world of how to do forensics.

Let me reiterate

* There is no free lunch.

* You cannot fake competence (for long).

* You can’t buy competence.

* You can’t buy experience.

* You can’t buy knowledge.

* You can’t buy determination.

* You can’t buy dedication.

* There are no shortcuts.

I screwed up

If I don’t catch myself making an error somewhere at some point, that means I am missing my mistakes. We all make them because we are human. The people who claim to never have made a mistake, or an oversight, or any fragment of an error only fool themselves.

The path to learning DFIR, whether new to the field or in it for decades, resembles the act of shopping for a car. Or dishes. Or groceries. Or a computer. No matter which thing you choose to buy at the time, eventually you discover that you should have bought something different or at a different place for a better price. That is the way it works buying things and the way it works learning things. Some of the things work out. Some were not the best idea.

Some of my greatest hits of learning DFIR screwups

* Studied like crazy for a cert and failed just as crazily. Then failed again. I even failed a third time. Just call me rock.

* Not studied at all for a cert due to over confidence (arrogance probably) and failed just as miserably. Twice.

* Paid for certs that did absolutely nothing for me because 'everyone' says you need these.

* Refused to get a specific cert out of spite even though it probably would have helped me get hired.

* Renewed same certs…for no good reasons other than acronyms to put on a CV.

* Paid for membership in “high tech” orgs that provided nothing more than a certificate of membership.

* Paid for a cert that required no test, no exam, nothing. Too embarrassed to ever write that one on my CV.

* Paid for an expensive course that was WAAAAYYYY above my level at the time. Gained practically nothing in the course.

* Paid for an expensive course that was WAAAAAYYY below my level at the time. Also, gained practically nothing in the course.

* Bought expensive software and hardware that I didn’t need, but everyone said that I did.

* Didn't buy expensive software and hardware that I knew I that I needed, but wrongly assumed that I could use other software and hardware.

* Not listened to advice from experienced mentors.

* Listened to advice from experienced mentors (sometimes it works, sometimes it doesn’t…)

* Took on cases that I ‘assumed’ I could handle, resulting in hiring people who could actually handle the cases that I assumed I could do.

* Take the above listed items, multiply by a factor of 4, maybe 5 or 6, and that's my life in learning DFIR..

But with that, a few neat things happened along the path..

* Hired to teach forensics at a university that rejected me as a student several years prior.

* Hired to teach forensics to a federal agency (same agency that also didn’t hire me when I applied…).

* Turned down a request to apply to that same federal agency that didn’t hire me (life had changed in a different & better direction).

* Taught forensics to a packed room of PhDs who teach forensics, yet never did forensics, but wanted to learn forensics!

* Met some of the smartest people in the world in this field, and most all have been great people!

* Worked some of the most amazing types of cases with incredible government agencies and law firms from class action litigation to the “T” type cases (if you worked in an alphabet agency, you probably know what I mean by T…….. case).

Perceptions change

Here is how I initially looked at everyone who was working in DFIR (even before ‘DFIR’ was coined);

Wow. They are so lucky. They had all the opportunities. They must all be geniuses. They must have had it so easy their entire life. I am so unlucky compared to them. Life is so unfair. I have to work so much harder to get where they are at. They are younger than me (or older), taller (or shorter) than me. You name it, I thought it. I feel pretty stupid thinking today about what I was thinking about all the DFIR folks at that time...

Here is how I look at them now;

They had to have worked hard. They had to have had amazing obstacles to overcome. They most likely had personal issues to handle at the same time of learning this work. They struggled like me. They most certainly are determined. They most certainly know that you have to put in the work. They are definitely still learning. They surely know that they don't know everything and never will. They all had different paths, and every path had it's own obstacles and challenges. They also know to eat the broccoli first.