I see the digital forensics training market reaching a saturation point in some aspects. Most, if not all, forensic software companies provide training, govt agencies provide internal training, individuals provide training, every college looking for a new revenue stream is adding forensic programs for training, and a new forensics book comes out every few weeks or so. Add that to those who can teach themselves and you have DF/IR training market that is fat. By the way, if you can teach yourself forensics by gobbling up every crumb you can find, you will have a long career in this field.
There have been a lot of blog posts, articles, forums, and opinions posted online about how to break into the field of DF/IR. Here are a few decent links, and of course, a Google search will find dozens more. You will see by the dates that it has been years of the same question being asked...
https://digital-forensics.sans.org/blog/2010/08/20/getting-started-digital-forensics-what-takes/
http://www.techrepublic.com/blog/it-security/breaking-into-the-digital-forensics-field-melia-kelleys-path/
https://www.reddit.com/r/computerforensics/comments/1o2s5x/looking_to_get_into_computer_forensics/
http://www.techexams.net/forums/jobs-degrees/99839-looking-enter-into-digital-forensics-field-need-advice.html
http://smarterforensics.com/2016/08/so-you-want-to-break-into-the-field-of-digital-forensics/
https://www.thebalance.com/how-to-become-a-digital-forensic-examiner-974633
https://articles.forensicfocus.com/2011/10/07/advice-for-digital-forensics-job-seekers/
The common theme is asking, "How do I get into digital forensics?" when the better questions to ask are, "Which college program will work best for me?", "Which discplines in DF/IR should I focus on?", "Which programming languages are relevant?", "Which software should I learn?", "What are hiring managers looking for?".
You won’t usually find this topic constantly being brought up in other career fields. For example, if someone wants to become a doctor, there isn’t much to the answer other than, “go to a medical school.” If someone wants to become a lawyer, the answer is typically, “to go a law school.”
To become a digital forensics analyst, there isn’t an answer like “go to a digital forensics school” because there are more than a few ways to get into the field depending upon your individual and unique situation. On top of that, simply getting a degree in digital forensics doesn’t automatically make you qualified. Many forensic analysts fell into the job while working another job, like a police detective suddenly having to do computer-related crime cases, takes lots of training, and works major cases. The rest have to fight to get into the job or to at least get through the door.
My brief opinion on getting into the field is that a new person needs one or more (sometimes all) of these:
- Certs and/or degrees
- Helps check the boxes on the job application
- Shows that you sat in a chair and passed tests
- Shows that you paid lots of money (or may have lots of student loans)
- Shows that you can complete a system of training/learning
- Implies you should know what the paper says you should know
- Experience in a close-enough-related-job
- Shows that you have been doing the job, or close-enough-related-job
- Implies that you have competence, since you were being paid
- Competence
- Hardest way to get in without something else (experience and/or education)
- Difficult to get past the application if blindly applying to jobs if you can’t check the required boxes
- Have to prove yourself beforehand (write a software program, discover something useful for the field, etc...)
- Nothing is implied, because you need proof of competence.
Each of these require time. If you want to get into a good digital forensics job within a year, and the only thing you have ever done is read a blog about forensics, then consider that it might not happen as quick as you would like. If you don’t want to spend any money (on tuition, tools, books, training courses), then you must be able to learn open source forensics…and teach yourself. Lastly, you need capability. Not everyone can or wants to spend the time and money to become competent. You have to put in your dues to get the potential rewards. If you don't work on being able to do the job, simply wanting to do it is not going to be enough. A lot of people want to be a cyber hero, but not a lot of people want sacrifice for what it takes to get there.
So, to be able to at least submit an application, get qualified enough to check the boxes. One of the things I have never understood is that some (many?) jobs require a bachelor’s degree in virtually anything in order to apply for a job that clearly does not require a college education. If that is the kind of job you want, which is a considerable amount of federal jobs, get the degree or you will not even be able to check the one box that is required to apply, no matter your experience (for exceptions, refer to the previous note).
On picking a training path, be choosy because it’s not only money you are spending. It is also your time. I started a college program once, only to quit because I could have taught it since the ‘professor’ never ever never even imaged a hard drive, nor did a forensic exam ever. It was clearly a new revenue stream for the college. I’ve taken a few private courses that had the effect of me trying to forget what I learned because so much of it was incorrect or out-of-date. I’ve been "taught" how to testify in court by someone who never testified in court…or tried a case…or ever practiced law. Conversely, I have taken some outstanding training, college courses, and attended superb conferences that made all the difference in the world. The trick is sorting through which is which. Those are the questions to ask.
Disclaimer: I am but a lowly forensic guy, not the end-all-be-all or know-it-all (I learn something every day). These are just my opinions. I have hired and fired employees, passed and failed students, taught and been taught forensics. But like everyone, experiences, perceptions, education, and opinions vary.
