Computer Forensics Career

Hello all,

I am new to the security field, as you can tell by my name. I am currently working as a web server administrator, and I have about 4 1/2 years of I.T experience. I also have a B.S in Computer Info Sys. I am very interested in moving into the computer forensics field, and I have thought about pursuing a M.S in Information Security, but I'm not sure it would be worth the money. The program is very expensive and, I don't have any forensics experience. I have also thought about becoming a certified law enforcement officer, but not to become a police, just to have a law enforcement background. Do you all think it would be wise to just go for some entry- level certs and maybe get certified in law enforcement V.S M.S in Info Security?

Computer Forensics career rocks, but is not like "C.S.I." show. Its pretty boring almost the time.
I would like a Master degree in Security. But, to help you better, could you post here College Name and a link to the M.S. course? Will help a lot to make a comparision with "tech" courses...

The program is at nova southeastern. They are supposed to be certified by the NSA, But I don't see the school listed as one of the schools of excellence. This maybe because they just got started this summer. Anyway, here is the site. http://www.scis.nova.edu/

Ive read MSIS curriculum on that site.

I think is too generic. Too basic concepts and too few "sec" classes. maybe it was designed for I.T. people.

If you a good knowledge of I.S., skip it (for forensinc career)

Instead, seek out for a CISSP or try to go deeper into:

- networking;
- programming (including ASM)
- investigation methods

I had to reply to this post. I was in your situion only a few months ago. I had graduted from a local university with a Bachelors in Information Systems/Application Development. I've always wanted to get into the Computer Security area, but found myself doing web devleopment for a very large company. Today, however, I'm living my dream - doing some very cool computer security work - and getting paid for it.

So - my adivce. I read books, researched info on getting a masters in InfoSec and spoke with many many people in the field. What paid off for me in the end was the "informational intrerviewing" I did with people. I located several people who were currently in the field (using my carrer center at school and also locating people at my work who were in the field) and setup interviews with them. In these interviews I asked questions about the field and let them know I was interested in getting in the field and would do what it takes. I even picked up a mentor who taught me what to read, what to study and was there if I had any questions. In the end, it was my mentor who got me my job. Not my skills, nor my degree, although I am sure they helped :-)

This is kinda long, but my conclusion is that it helps to know the right people. Get out there and make contacts!

Best of luck,
Smartin

smartin77,

Thanks for the advice. I think I will just focus on my job now, and just use those skills to open doors to get me closer to security. I definitely will be trying to build a solid contact list and I think I have a good jump on that right now. All I need to do is keep at it ,and something will come my way.
As far as schooling goes, I'm lookng at going for the M.S in MIS, so I would have something more general and not so specialized. If I get into security and I like it, then I may look at some certifications. Thanks again.

I am in this situation now, I am wanting to get a job in computer security. I am thinking about trying to get a job with my local police departments computer crime unit, but I'm not sure what to do to prepare for such a job. I also do not think they would take me seriously because of my age, so I'm not sure if they would answer my questions. I'm only 17. What do you guys suggest for getting started for such a job?

Greetings:

Computer Forensics is probably NOT the best field to start out in. It should probably be preceeded by YEARS of experience as an administrator and/or preferably a security expert.

The knowledge that you need to become a Forensics expert is really just overlay on top of a very thorough understanding of as many different architectures as humanly possible.

You're right, at 17, there is NO WAY you could get a job with anyone in the law enforcement field as a Computer Forensics Expert. To enter the forensics field in the law enforcement arena, you must be able to be certified as an expert in a court of law. A defense attorney would rip even the most knowledgable 17 year old a new one on the stand, considering they could easily call people that have been experts longer than you've been alive.

There are very few Police Departments that employ full time Computer Forensics experts. Most of them rely on individuals in their communities to assist when needed.

When I lived back up north, I was called upon on a regular basis to help with Computer Forensics work by local police departments. I got to go along to serve search warrants, secure and catalog the evidence on scene, do the analysis, write the reports, maintain chain of custody, and provide testimony as necessary. I was hired as an independant consultant to do these things, as are most people in the industry.

The FBI has a full time forensics staff, but outside of that, most departments have a "Computer Crimes Task Force", which is made up of forensics experts from the private sector, and law enforcement officers that are pulled out of their regular day-to-day duties to work on a case when one arises. Usually these task forces are invitation only, and usually only experts and law enforcement officials are allowed to be around when any real case is being worked on. Chain of custody issues demand as much.

If you want to be a full time forensics expert, I suggest you get a 4 year college degree in information security or computer science, then apply to the FBI (you need a 4 year in order to become an agent). They provide all of the forensics training for their agents in-house, which is as good as it gets.

Most law enforcement agencies don't carry in house experts as JP said, but they do have in house examiners. The program I am in for forensics places people directly in law enforcement agencies or other corporate environments. A friend of mine just got accepted to the state police force and will be serving as an officer for a few years, then he's getting moved to the forensics lab.
I am currently working with sponsorship from a local police department and a few select individuals to further my forensics career, and the option may exist to get FBI sponsorship to attend the dcfl training or perhaps even to try to get in. i am trying to get a research project off the ground and running, but who knows if it will.
What has it taken to get to this point? 7+ years now in the industry as an admin/consultant/engineer, long hours, lots of reading and lots of hard work, and hanging my nuts out there to get the attention of the right people. This hasn't dropped in my lap, and I don't expect that it will for most people. I personally wouldn't want to be an expert witness..I'd probably reach out and throttle the lawyers :D

Quote:

---

Originally posted here by hogfly
A friend of mine just got accepted to the state police force and will be serving as an officer for a few years, then he's getting moved to the forensics lab.

---

Exactly my point! What in the heck kind of techie would want to play police officer for a few years just to become a forensics "examiner" eventually. I've never understood the mentality of departments that do this.

ME chasing after some 300lb drunk biker dude that just beat the shat out of his wife, and 6 other men that tried to stop him? Haha, I think not.....

heh..that's why I am trying to get right in to the labs. I don't want to screw with being a cop. They do have accelerated movement..but you have to show knowledge in said area. he said he might be able to get in to the lab in around a year and a half or so.

Quote:

---

Originally posted here by JP
Exactly my point! What in the heck kind of techie would want to play police officer for a few years just to become a forensics "examiner" eventually. I've never understood the mentality of departments that do this.

---

I'm certain to an extent there is a mentality of "you should do your time as a newbie to the force", and part of it would be the experience factor. You don't want a geek to go with some uniformed officers to seize computer equipment if it happens to go bad. It could also be a case of they can't justify having someone on full time, but would like someone in the department with the knowledge, so you get to be a cop 90% of the time and a forensics geek 10% of the time.

I know up here in the great white north the RCMP requires you to do basic Mounty training before placing you with a special division. I'm pretty sure you're just required to go through the training course everyone else is, and then you can go direct to say, their computer crimes division provided you have relevant education and experience (obviously). It's actually kind of weird up here. Because the RCMP is essentially the federal police force as well as the provincial police force for every province except Ontario and Quebec, they have almost exclusivity over computer crime investigations. Do most state police departments invest a lot of money developing a computer crime division, or do they leave that sort of thing up to the FBI?

Greetings:

Quote:

---

Originally posted here by chsh
You don't want a geek to go with some uniformed officers to seize computer equipment if it happens to go bad.

---

Well, i've been on a few raids, and honestly having me along wasn't a big deal. They gave me a vest to wear, and had me outside waiting behind a patrol car with an uniformed officer until the guys that went in came out and gave us the all clear.

The uniformed officers on the inside had everyone secured, and I went in with the officer that was "assigned" to me just in case. I felt totally safe the entire time, everything was well under control. I did what I need to do, and the uniformed officers did what they needed to do.

chsh: the state police department in NY has a large cybercrime division(as cybercrime divisions go), as do the NYC police. Even the place I live employs 2 full time cybercrime officers(although they are probably as you state..90% cop..10% geek). I think it's based out of neccessity rather than wasting tax payers money. AFAIK The FBI only takes over if someone has caused MAJOR damage, has done things across state lines, or has attacked federal computers.

Quote:

---

Originally posted here by JP
Well, i've been on a few raids, and honestly having me along wasn't a big deal. They gave me a vest to wear, and had me outside waiting behind a patrol car with an uniformed officer until the guys that went in came out and gave us the all clear.
The uniformed officers on the inside had everyone secured, and I went in with the officer that was "assigned" to me just in case. I felt totally safe the entire time, everything was well under control. I did what I need to do, and the uniformed officers did what they needed to do.

---

Well damn, just vaporize my misconceptions why don't ya? :D
I guess white collar criminals tend not to be the "go out in a hail of gunfire" type. I do tend to envision the worst possible scenario.

Quote:

---

Originally posted here by hogfly
chsh: the state police department in NY has a large cybercrime division(as cybercrime divisions go), as do the NYC police.

---

New York may not be a run of the mill example since it is really the largest financial centre in the country, but I get what you're saying.

Quote:

---

Even the place I live employs 2 full time cybercrime officers(although they are probably as you state..90% cop..10% geek). I think it's based out of neccessity rather than wasting tax payers money.

---

That's what I assumed. To have someone in house but idle is useless, but if you can put them to work as cops it can be cheaper than paying consultants all the time. I envision there being a financial pheasibility cutoff point where hiring consultants becomes financially impractical.

Quote:

---

AFAIK The FBI only takes over if someone has caused MAJOR damage, has done things across state lines, or has attacked federal computers.

---

Would the FBI have jurisdiction over an investigation if it were an international problem? For instance, if someone in New York were to break into a computer up here in Ontario and steal trade secrets/cause damage, who would handle the case, the state police or the FBI?

JP, in your work with the military, do they themselves have a computer crime investigation group, or would they rely on civilian authorities like the FBI for such investigations?
EDIT: I'm asking because I'm trying to envision the lengthy chain of custody involved in international prosecutions.

Quote:

---

Originally posted here by chsh

Would the FBI have jurisdiction over an investigation if it were an international problem? For instance, if someone in New York were to break into a computer up here in Ontario and steal trade secrets/cause damage, who would handle the case, the state police or the FBI?

JP, in your work with the military, do they themselves have a computer crime investigation group, or would they rely on civilian authorities like the FBI for such investigations?
EDIT: I'm asking because I'm trying to envision the lengthy chain of custody involved in international prosecutions. [/B]

---

The FBI would take over if it was international. State police have jurisdiction within the state only.

Quote:

---

Exactly my point! What in the heck kind of techie would want to play police officer for a few years just to become a forensics "examiner" eventually. I've never understood the mentality of departments that do this.

---

I would. It would be a good experience. That is why I'll be getting a degree in Criminal Justice as well.

Greetings:

Quote:

---

Originally posted here by chsh
JP, in your work with the military, do they themselves have a computer crime investigation group, or would they rely on civilian authorities like the FBI for such investigations?
EDIT: I'm asking because I'm trying to envision the lengthy chain of custody involved in international prosecutions.

---

Let me start off by saying that my work with the US military did NOT involve any of their criminal investigative arms such as DCIS (Defense Criminal Investigative Service). Although, I have worked with individuals from these organizations on various things in the past.

To answer your question in relation to them, yes, they have their own forensics teams made up of both enlisted and civilian personnel. This all falls under the DC3 (Department of Defense Cyber Crime Center), which is made up of DCCI (Defense Cyber Crime Institute), and a few other multi-letter abbreviations that I can't remember off the top of my head at the moment (it gets confusing so you tend only to remember organizations from people you have actually worked with/for, haha).

You really need to remember what the role of the US military is though, and their primary role is NOT that of law enforcement. So while you have to worry about issues of chain of custody and such when you want to PROSECUTE someone (US Nationals, other military personnel), you do NOT need to worry about such things when you want to "Eliminate A Threat".

My work with the military was the lead of several private contracts to the Air Force's Defensive Information Warfare Unit, as well as a couple of other agencies (nda yada yada). When you're talking about this level, they're worried about determining what foreign country or terrorist cell is attempting to breach critical infrastructures, if this appears to be the case. For SURE this involves a lot of computer forensics work, and beyond (hack backs, etc. etc.) But they really don't give a flying flip about chain of custody, or even laws of foreign nations in some cases (if national security is the issue). All they want to do, is determine the source, determine its motivation, determine what information if any was compromised, and formulate a response if any is required.

JP, thanks for the info. Part of what I had in mind in terms of "international attacks" was kind of along the lines of both an outside source attacking US Military hardware, but also an inside source performing unsanctioned attacks on outside sources. I find the difference in motivation interesting, especially considering we have the US Military to thank for much of our current technology.

I wonder if anyone on AO has connections to the Canadian military. I know our military by virtue of its size and tiny budget has nowhere near the number of resources and/or departments the US Military does, but I wonder how they do things nonetheless.

Quote:

---

But they really don't give a flying flip about chain of custody, or even laws of foreign nations in some cases (if national security is the issue). All they want to do, is determine the source, determine its motivation, determine what information if any was compromised, and formulate a response if any is required.

---

Funny that you should mention that. The work I am doing right now..they don't really care about forensically sound investigations. They want me find the problem, how it was carried out, how to fix it, and how to prevent it from happening again.
They said "go through the proper steps for a forensic investigation in case there is sensitive data, but this is what we really want".

AFAIK, the feds won't get involved unless...

A.) It's a federal matter.. Ie. across state lines, or involves the federal government.


B.) The total money (damages, theft, whatever) is greater than at least $10,000.



I know that when a friend of mine got busted (I did not know him at the time, I met him afterward) the Secret Service made the bust, started the investigation, but dropped the case to the State of Florida when they found they only had about a 3-4,000 dollar case.

Greetings:

Quote:

---

Originally posted here by Winston
AFAIK, the feds won't get involved unless...

A.) It's a federal matter.. Ie. across state lines, or involves the federal government.

---

That pretty much describes almost ALL computer crimes. What the feds choose to prosecute or not, at this point in time, is mainly decided by the greater "impact" the prosecution will have. IE, how many people will the prosecution help to deter, or how hot-button of a political issue is the subject matter, how high profile is the case, etc. They are simply too backlogged to deal with everything that's thrown their way.

Well I cant speak for what goes on in the US, but over here in the UK the police do have and require full time Computer Forensics experts. However in that line of work for the police over 60% of your time will be spent on child porn cases. This kind of work is not for the faint hearted, and is something you should think long hard about if you wish to go into forensics. I know that I could not handle that kind of work.

SittingDuck

Greetings:

Quote:

---

Originally posted here by SittingDuck
However in that line of work for the police over 60% of your time will be spent on child porn cases. This kind of work is not for the faint hearted, and is something you should think long hard about if you wish to go into forensics. I know that I could not handle that kind of work.

SittingDuck

---

Here in the US the majority of pedo cases are handled by a unique working group inside of the fbi/doj called "Innocent Images". I had the honor, and I do mean honor, of meeting some of these people when I was lecturing once down at the FBI Training Academy in Quantico.

These were some of the most dedicated, caring, intelligent people you could ever want to meet. Many of them were female agents, and you could easily tell the true devotion that all of them had for the work that they do.

You're right, this is NOT easy stuff to deal with. I worked on a forensics case once involving a man who was molesting his own daughter, and taking pictures of it to send around the internet. It wasn't pleasant work, to say the least.......

First post, so "Hi all".

Just wanted to chime in here and say a few things. This thread is weighted fairly heavily on the police side of forensics work, with little attention to forensics in the corporate world.

I do forensics in the corporate world. There's a steadily growing trend in the industry (especially the financial industry) toward acquiring in-house forensics people for both the incident response (server farms) side and the internal forensics (fraud, harrassment, etc) side.

As far as breaking into the field in the corporate world however, the general trend is that the people that do this work are "experts". You don't find private companies hiring forensic people fresh out of college. I'm probably fairly typical, with about 15 yrs of security experience both DoD and private industry.

With products out there such as Encase that are becoming more and more corporate use friendly, and more easily used in conjunction with intrusion detection systems, heads are turning toward predeploying forensic software in server farms and using the tools as part of an incident response program, as opposed to limiting forensics to a more true to form "after the fact find the facts" tool.

All that having been said, the best way to break into forensics without going the law enforcement route is probably to find an organization that uses forensics tools as part of an incident response program and get hired there as a general security practicioner, letting your interests be known. Once there, cross-training into the incident response program could be a viable course.

Good luck.

Quote:

---

Originally posted here by shadowshiv
First post, so "Hi all".

Just wanted to chime in here and say a few things. This thread is weighted fairly heavily on the police side of forensics work, with little attention to forensics in the corporate world.

As far as breaking into the field in the corporate world however, the general trend is that the people that do this work are "experts". You don't find private companies hiring forensic people fresh out of college. I'm probably fairly typical, with about 15 yrs of security experience both DoD and private industry.

With products out there such as Encase that are becoming more and more corporate use friendly, and more easily used in conjunction with intrusion detection systems, heads are turning toward predeploying forensic software in server farms and using the tools as part of an incident response program, as opposed to limiting forensics to a more true to form "after the fact find the facts" tool.

Good luck.

---

Hi, and welcome.
Yes corporations are getting in to forensics and they are getting very supportive of it. This was weighted towards law enforcement because that's pretty much how forensics began. It was the government that created the field so it could protect itself and prosecute violators.

Products like encase are becoming corporate friendly and that marks the beginning of the end of the real forensics field. Companies like guidance churn out so called experts at the rate microsoft turns out MCSE's and we all know how worthless MCSE's are...
Encase is a point and click forensics tool, where any idiot can be a forensic investigator. Just point, click and voila. But I guess since we live in a Microsoft world of point and click..it's the industry standard... That's my take on it anyways...

Interesting response.

The tool is easy to use, therefore any idiot can be a forensic investigator? I'll ignore the indirect slight to me personally as I'm sure it wasn't the intent.

But that aside I still have an issue with the basic premise. The tool that one uses has no impact on the quality of the investigator. "Any idiot" cannot sit down behind Encase and hope to actually do the job. There is no button in Encase called "Find Evidence".

Just like any other tool, one must understand the science behind forensic investigation in order to be effective with it.

The reason that Encase is becoming popular in the corporate world while admittedly in part because of it's ease of use, is more directly tied to its ability to conduct investigations over the network without impact on the network itself or the normal use of the systems that its being used to investigate. That opens up a whole world of capability that we've not been able to really enjoy before.

You also state that products becoming corporate friendly marks the end of the real forensics field. I don't see the logic in that statement. Did the prevalence of windows mark the end of the "real electrical engineering field", or the end of the "real programming field"? I think not. There will always be a need for "real forensics", and a place for "real forensic scientsists".

Products like Encase simply expand the use of the tools that people in "the real forensics field" use into areas where they've not been useful before. In the corporate world, forensics takes a place not only in the "real forensics field" as you seem to know it, but also in the incident response field.

Point and click, and network usability will never replace what forensics is, nor remove the need for it. What it will do is expand it's usefullness.

There was absolutely no slight intended. If you took it that way, I apologize. I don't intend to discredit anyone, and don't get me wrong..Encase is a good tool.

I really question the accuracy of any investigation that occurs over a network. Talk about avenues of data corruption...injected packets in to a forensic investigation..whoa baby..hold on to your hats with that, although I guess it doesn't matter for internal audits.

Do you have to understand the science to be good at anything? With point and click utilities you don't have to be..you can always subpoena an encase programmer to come and explain anything you need.

I do question it becoming overly corporate friendly. While more companies are creating incident response and investigative teams..a lot are just handing it to their admins and saying "here, you are our investigator now". Only the big companies can afford to have specific investigators. I do agree with a need for these teams and people but it's a double edged sword. Technology has a way of degrading as it progresses. It all began with the military, then the corporations get a hold of it, then the home owner gets a hold of it, and by that time...yes any idiot can use it. It's a natural progression(or is that regression :D).

I understand forensics as it is, and as it is becoming. The 2 sides of the coin..incident response and "real forensics". Right now, Incident response seems to be driving the field, because first responders need to be able to process machines in a way that protects the evidence in case something serious(crimes) has occured. I certainly hope what the field is quickly becoming does not take away from the "real forensics", because that is the really interesting piece of the industry.