Raising the Bar: Establishing a Common Baseline in DFIR

There’s a growing conversation on social media in DFIR around what every practitioner, especially at the entry level, should know before turning on a computer to work a case. Technology’s sheer complexity and advancing pace makes formal, standardized training feel like a moving target, and we avoid looking at it.

On the other hand, if we continue without any well-defined standards, we leave newcomers confused about where to start and employers uncertain about what to expect in a candidate.  That means our attrition rate is comparable to BUD/S training.  The hiring rate is no better.

Striking the right balance between foundational education, practical hands-on skills, and the appropriate level of tool training is at the heart of “raising the bar.”

Building on Our Roots: Human Investigative Thinking and Modern Tools

Early on, DFIR work (aka: computer forensics) was largely manual. Without today’s sophisticated software, professionals had to rely heavily on investigative thinking, logical reasoning, and developing methodical processes to uncover digital evidence. As tools evolved to handle larger volumes of data and automate complex tasks, we gained efficiency—but we also lost some of that original human-driven approach.

The truth is, we need both. We need the human investigative mindset to guide the use of advanced tools, ensuring that technology doesn’t replace understanding but enhances it. The fundamentals of critical thinking, evidence preservation, and sound methodology haven’t gone out of style; they remain the core of what makes a DFIR practitioner effective, regardless of the tools at hand.

A Common Baseline of Knowledge

What should this baseline include? This is the funny part. I looked up SWGDE’s version of of “Best Practices for Digital Evidence Laboratory Programs.” Guess what? They were on to something.  The funny part: This was written in 2003.

SWDGE

So then, I went to look at their current core competencies paper.  There are a lot of papers there now…then I checked out NIST…and then SANS Cyber Security Skills Assessments…then another…then another…and another…

https://www.swgde.org/documents/published-complete-listing/

On several occasions, I’ve already hashed out my opinion on what constitutes a basic foundation that covers both DF and IR. The reason for this post is how it is possible that we had decent guidelines published at least by 2003, and it’s been over two decades later, and we are further behind in this topic than we were in the 1990s.

Tool Training

Tool training is tool training. Don’t expect it to teach you forensics. Spending a week or two in a class that teaches the tool must teach that tool.

Forensic Education

Education in forensics is forensic education. Don’t expect it to teach you tools. Spend time to learn forensic artifacts, how they fit in the totality of the data, and all the things needed to investigate, document, and testify, all within the boundaries of ethics and law.

Moving Toward Structure Without Overcomplication

As DFIR matures, there’s a need for clearer pathways, something akin to structured tiers or roles. This doesn’t mean creating rigid, exclusionary gatekeeping systems or making entry into the field overly complicated. Instead, consider something like a tiered licensing or certification approach that measures foundational competence, ensures ongoing professional development, and helps both practitioners and employers know exactly what a certain credential represents. A well-thought-out system could mirror other professions, offering a progression from entry-level to more advanced roles, supported by both educational milestones and experiential learning.

Collaboration Across the Community

No single group, be it academia, government, practitioners, vendors, or NGOs, should unilaterally decide these standards.  Stop creating yet-another-NGO that will solve this problem with yet-another-cert-for-sale.

Each stakeholder has strengths and biases, and each brings different insights to the table. A balanced approach, with broad input and constant refinement, is more likely to produce standards that are fair, workable, and relevant. DFIR isn’t limited by borders, either; collaboration across jurisdictions and cultures will be critical for creating guidelines that make sense on a global scale.

Call to Action: Contributing to the Future of DFIR

We had a good start of foundational requirements way back in 2003.  But we (the entire community!) let scope creep turn what should be a simple thing into a spider’s web of confusion, over-complication, and unnecessary requirements that will either (1) scare away, (2) force out, (3) flunk out, or (4) stress out everyone at some point in this field in trying to figure out what they need to know to do their job.

If you took more than 4 years to figure out what you need to know to do your current job or get into this field, you wasted time and money that you will never get back.

It does not have to be that way.  It should not be that way.

As for me and my peers (who most are much better in DFIR than me) in this period of our careers….do we plan on leaving this field worse off than when we entered? Is that our legacy? To have created such a confusing mess of degrees required or not required, and mandatory tools to know or not know, or not even know what is legal when accessing someone’s data?

I, for one, do not want that to be the legacy.