Image via WikipediaI have a background in philosophy. My undergraduate degree was in philosophy, and I credit much of my success in digital forensics to the study of this discipline.
I am not proposing that an understanding of existentialism or Platonism is particularly useful in digital forensics. However, what I learned in the study of philosophy, at its root, is not the knowledge of different schools of thought, but how to think.The ability to focus one’s mind on the task at hand, to bring to bear the full force of all your mental faculties on a problem is an invaluable ability that should be fostered as a digital forensics examiner.This leads me to my next point; “Education proves you have the potential to accomplish something. Experience proves that you have.” - Larry E. DanielThere are many exceptional conferences, training programs, and schools that can teach you a breadth of knowledge about digital forensics. But if that knowledge is not put to use, if it is not exercised, then it will fade away and eventually die.We cannot master our field from nine to five. I learn a lot in the process of my work, but if your work day is like mine, it is filled with constant distractions; responding to emails, conference calls, consultations, and so forth.So then, how to we turn our education into experience?If you want to master any subject, sacrifices must be made in order for it to happen. In this case, you cannot have your cake and eat it too. We all have a limited amount of time and many things in our lives that must take priority. But many of us sure have a lot of distractions that provide us with little benefit in the long run.To turn this education into experience, we must pursue knowledge of digital forensics through repeated study and practice. Repetition is the best schoolmaster I have ever met. To perform as best as we can, we must be disciplined to read and practice, to play with new methods of examining data when we can as often as we canMalcolm Gladwell, in his book Outliers has said it takes 10,000 hours to become an expert in a discipline. These 10,000 hours are not composed primarily of hours doing the work itself, but in the disciplined study and practice related to the discipline.There is little doubt in my mind that if we do not stay focused on learning and practicing our discipline, outside of our “paid” employment hours and the limited time we get to spend in training we will undoubtedly fall behind.Lars Daniel
Digital Forensics Examiner & Forensic Artist