You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits.  In fact, you can probably enjoy the benefit of the lessons more quickly than spending months of being bombarded with ‘training’ every day..recruits have no clue of the value of most lessons that they experience on a daily basis until years after graduating boot camp. You can most likely get it the first day at this stage of working in DFIR, because you know the problems that need to be solved already. You just need a gentle push to the solutions.

These are my Top 10 Marine Corps Boot Camp Lessons for DFIR success

1.  Set the example

Be the leader that you want to follow. Set the example that others want to emulate. If you are not in charge, support the leader as you would want to be supported. You can’t force others to stop complaining or do a better job; but you can do your best so that others may follow, whether you are in charge or not. Take the initiate. Get the job done. This is the person everyone Looks to for answers and direction.

2.  Communicate

Effective communication sets the stage for success. Give clear and concise directions for the casework to be handled. Be sure that you understand the directions given to you. Brief-back (ie; paraphrase back to make sure you understood) your mission and only start your work when you know what the work is.  Communicate throughout the engagement and tasks as an essential part of the work. Share information. This is you being the one who understands the big Picture.

3.  Mission first

Get the job done. Do what you are being paid to do. Learn the skills needed for your job title and responsiblities. Overcome adversity in getting the job done; It is never easy and that is why you were tasked to get it done. You are the only one that can do it, so get it done. This is you being the person that is known as able to get things Done.

4.  Keep calm

Panic breeds panic. Panic destroys confidence in those around you. There is no situation where panic will be helpful, so keep calm by focusing on finding solutions. Abstract reasoning will solve more problems than any scientific model ever will. Reassure others with your command presence and confidence. This is you being the Rock in the storm.

5.  Attention to detail

Take care of the little things, and the big things will take care of themselves. Taking care of the little things takes only small bits of time but not only will save large chunks of time later but will also reduce the risk of failure.  Look for the little things and make sure they are taken care of. Even something as simple as checking the appropriate box on a check sheet, or making sure you check for the common things in an exam that you should always check, like certain registry keys that commonly hold forensic clues. This is you doing everything Right.

6.  Learn from mistakes

You make mistakes. I make mistakes. We all make mistakes. The chasm between making mistakes and owning them is huge!  If you didn't write-protect the evidence while imaging, fess up to it. When (not if) you make your next mistake, identify it, and most importantly - own it. Be accountable. Be responsible. Fix it. Learn from it. Better yet, learn from the mistakes of others.  Even better, teach others about your mistakes so they can learn.  This is you being a Mentor and coach.

7.  Be honest

Be honest with yourself. Know your limitations. But also know your stuff. Do only that which you can do before needing assistance. Be honest with your supervisors and subordinates. The truth of an error or unexpected (ie: unwanted) analysis finding may sting now, but not as nearly much as a lie will hurt later. Be the person whose word is the Gold standard.

8.  You need a team

Drop everything to help a teammate. Your job cannot be done alone or in a vacuum. To claim to know all is to state that you don’t even know that you don’t even know. Choose your team wisely, accept no one can do everything alone, connect each other by individual strengths, and acknowledge their individual and team successes. Assign tasks not by rank or title, but by capability and competence. Be an effective team Leader.

9.  Security

A Marine on duty has no friends. That means to not make any exception for anyone that will cause a break in security. Make for no lapse in security for no one or no thing. Without security, most any work can be lost, including reputations and even entire organizations. If responsible for security, you are the Lock.  

10. Be grateful

No one promised you a rose garden. Being comfortable never solved a problem. Make discomfort your friend. If the job was easy, anyone could do it and it would pay barely above minimum wage. Appreciate the slow times because the hectic times are waiting for you.  Appreciate your team as they will be the ones who solve problems by working together toward a common goal. Appreciate and comprehend the seriousness of every task we have, whether that involves any part of securing a national infrastructure, ensuring that justice is served in a legal matter, or that a hard drive has been stored appropriately. Be Gracious of the gratitude of others.

The list of lessons from boot camp has filled books, created many successful people and organizations, won wars, and saved lives. And the lessons are not proprietary. They can be learned and used by anyone looking for an edge to success or problem-solving solutions.

What’s the biggest problem to solve?

I have found that the most difficult problem to solve is that of a lack teamwork because of not having a leader take charge to lead the team to success. By “leader”, I mean the person who is the leader by action and influence, not by title or paygrade.  This is where a bully in a team can be the leader and destroy a team, yet any team member can do just the opposite by leading from within, title irrelevant. An effective team can solve any problem. Build the team and rule over any problems.

How long does it take for a team to follow and trust a leader?

That depends on you and the team members. How do you handle yourself? How to you treat others? How do you exhibit confidence? How formed is the team now? The time it takes is basically "It depends. But few situations are impossible to fix in regards to building and encouraging an effective team.

One day, many many years ago, I was placed in charge of a different squad unexpectedly and gave my first orders to a team of Marines that I never met before; but I did it as if I knew them all my life, with the expectation that I would lead them in the same manner that I would want follow another, and in a manner that no order I give would be any different than anything I have done or would do. After the first formation, I heard one Marine ask another, “Who is that guy?”, with a reply of, “I don’t know, but he knows his shit.” We made a good team; every single one of them. I was honest, forthcoming, admitted mistakes, asked for suggestions, supported them, disciplined in private, and praised in public.  All the things I want to see in a leader.

The key of Marine leadership is nothing that you see in the movies. Marines follow leaders not due to threats or yelling, but simply in the respect, trust, and confidence of the Marine leader.  Boot camp has a lot of yelling and screaming, but that is just to get the lessons across in a short period of time. After the lessons are learned, it’s gravy train from there.

From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the Suspect Behind the Keyboard. I want to expand upon beyond the registry regarding a computer having a personality.

The bullet point

By examining multiple computers (or a single system) for computer usage and/or configuration, the owner of the computer can potentially be identified or tied to the computer.

The longer version

I am sure that each time you buy a new computer (laptop, smartphone, tablet, etc…), you spend the first minutes or hours setting it up just the way you like it. Whether it is changing the desktop background, colors, fonts, sounds, or general configuration, you make it yours. You do this every time. To every system that you have. You make it yours.

The way that anyone sets up their machine reflects their likes, dislikes, wants, needs, priorities, and general flow of system use. Generally, and most always, all the systems of one owner are set up very similarly. This is a simple observation; however, it can be a very important investigative clue when you have a system that has been disavowed by a suspect. Any computer that has been disavowed by a suspect (“That’s not my laptop!”) just might have relevant evidence on it if it does in fact belong to the suspect. But how do you prove it if there is nothing on the computer that directly names your suspect?

I have only come across this scenario once where the analysis of one anonymous machine seized in a public space, with a suspect disavowing ownership of the machine, needed to be proven against the other machines. Most other cases eventually have the owner admitting possession or ownership before the cases eventually gets close to trial. For the types of cases where the suspect never claims ownership of their computer(s), this post is for you to tie a computer that has no obvious relation to your suspect, but actually does belong to your suspect. I can tell you that it worked at least once for me; I suspect it can work for others too.

Basic and easy stuff

With multiple systems, find what is similar (not the default configurations) among all the systems.  Check for the same things that you configure your personal computers at home or work. Is the customized desktop background image the same across devices? Are the software applications the same? Sound settings? Computing naming conventions the same, such as naming all the systems based off a movie or sports team?  These are the easy and obvious things.

Given odds and statistics as they are, I cannot imagine the odds of two or more computer systems being customized for personal use exactly, or near the same way, across more than one device. Even a throwaway laptop that is being used by a suspect to reduce the risk of personal data being created on the laptop will have personal configurations that can be tied to another machine.

A little more work

The computer activity is another clue.

Programs

Which programs have been custom set to autostart? What is the Internet history? Bookmarks? Sequence of using programs? Does the user open the same programs on all machines?  Do the machines have the same programs, especially the same unique type of programs?

Network connections

Are network connections the same? Even as public WiFi is accessible by anyone, have the machines accessed the same public WiFi?

Time

Length of use for the machines?  Are the times of use for the machines similar, such as being used at a certain time of day, or certain day of the week?  Is the user activity of the machines consistent with only one being used at a time, potentially indicating one user controlling the machines? Did multiple machines connect to the same WiFi on the day or within a short time frame?

Music and video

Whether downloaded or streamed, is there indication that the same music and videos have been played, or the same genre of music and videos?

Internet

Are search terms similar or the same? Identical bookmarks? Identical visited Websites? Same browsers? Same browser customizations?

The list goes on

The amount of unique user activity that you can find on a system is potentially limitless, as each person is different. Yes, it is possible for two different people to have something similar on their respective computers. However, the odds decrease with each similar (but unique or customized) aspect that you can match between systems are found.

This is what I call the Computer’s Personality. The user’s personality of likes and dislikes, preferences, biases, and desires eventually become obvious on all machines that they use on a regular basis. So when you have that one machine in a collection of machines that you need to identify the owner, take a look at the personality of all the machines and see if they match up to one owner. Sometimes it may be easy enough, other times you may have to really dig into the system, but either way, if you can match the computers to each other, all you need is to tie one of the computers to the suspect in order to tie all the computers to him.

Not to ignore non-personality clues, there are many other methods of tying a computer to a person when you have multiple systems. For example, geolocation forensics is a good method, where if you can show two or more systems traveling together for any amount of time, then probably the same owner is controlling those systems. Fingerprints too. The Computer Personality is just another tool to consider when you really want to tie someone to their device and eliminate all arguments to the truth.

Jessica Hyde’s post of Giving Back in DFIR from 2018 is a great write up on contributing to the DFIR community, and I see her post being relevant for some time to come. One thing that I want to add is that of balancing our time in this line of work.

Now, I am not saying that the DF/IR/Infosec world has more stressors than other lines of work, or that one is better or worse than another. So, in that manner, this post can practically be applied to anyone in any career that builds stress.

The two things that I recommend for life-work balance is to do something for others and do something for yourself.

Doing for others

Giving back to your job field

Jessica wrote it best, so refer to her blog post on tips on Giving Back in DFIR. Most likely, there is local association or group that you can join, and if not, plenty of online associations to check out. As many are comprised of volunteers, your call to help the organization will be answered. Giving back helps the organization, the field, and in the same manner, will help you too. You get a little bit of improving your skills by sharing them with others.

Giving back to something to which relates to you, but is not job related

The dab of balance that I am talking about is that of non-tech related giving. Something that can balance against the time you spend in front of a monitor. If you were super excited when you first started this career, and wish to stay excited throughout, you must have some plan to balance it. Self-monitoring is important paramount.

Giving back to something you are related is for those things you have done in the past (unrelated to your job), but that you can contribute in a different way. For example, if you are a military veteran, do not discount the amazing work that a service organization does in which you can be part. I’m a Marine Corps League member and being part of Toys for Tots or helping a veteran move off the street and into a home is a feeling that can’t be reproduced anywhere else. If you were part of any organization in the past, you have a head start in getting involved in something great. Help others who can’t help themselves and you will have made the world a better place to live. That better world is your world.

Give time to an interest that you feel strongly about

I’ll admit, if I still lived in Hawaii, both my wife and I would be volunteering our time with something like NOAA Fisheries.  Helping out marine life like sea turtle and dolphins is something that I find quite cool (and important!). Luckily, living in Washington (State) allows for volunteering for lots of nature projects, none having a lick to do with technology, but makes the world a better place than when I found it. Did I mention that this better world is your world?

Show support for good causes

Given that the DF/IR/Infosec field is darn near a 24/7 callout job, where we are never far from our smartphone, and expected to run out the door at any given moment, time is precious. Spend time with your family and friends to support them and receive support as a priority. But, when time is short and you can’t commit to volunteering for a cause, you can always show moral support to the causes that you believe in.  Your support, no matter how little effort you need to do, can have a great impact on someone else.

Doing for yourself

This is an easy one. Find a hobby. Any hobby. Except taking naps. Something that makes you happy. Write poems or a book. Hike. Swim. Fish. Fly. Walk. Read. Take classes. Get a degree or get another degree. Do something on a regular basis that brings life back into perspective. Change it up when you want to.  Read for weeks and then hike for days or maybe swim on a weekend and walk the next weekend. Whatever you want to do for you.  Your personal time is important. Those who only do for others will eventually burn out.

Which is more important? Giving to yourself or others?

The answer is both are equally important. Giving only to one will likely result in failure in both. Take care of yourself and do something for others. The end result is that your DF/IR/Infosec job will be more satisfying, you will be more productive, and you can excel for the length of a career and beyond without burning out.

Look at it this way:

If you can do something that satisfies you, no matter what happens in your world, you can make it better for you.

If you do something for others that they can’t do for themselves, you just made the world a better place. And remember, that better world is also your world.