Computer Forensics

[MAC_Addy]

Hello all.

I am interested in pursuing a career in Computer Forensics. I was wondering what the best route to go is?

I currently have a full time job (really good job) and not able to move to go to a special college.

I was wondering if there are any self study books out there so I can learn everything there is to know.

What certifications should I go for?

Thanks,
Jamie

[Kasor]

This is a field that not possible to break in unless you are Law Enforcement or working with the LW in City/State/Federal system.

[dynamik]

Check out this thread: Path into Computer Forensics

I wouldn't say it's not possible without that type of background, but it certainly helps. It's definitely not something you can just start out in though. Check out the SANS 508 course/GCFA certification if you want to get some serious training/certification on that. That's definitely on my to-do list, but it's out a year or two.

[Paul Boz]

SANS is definitely a great place to get forensic experience. There are also tons of books on the subject. Just do a search on Amazon for several examples. I'm taking the SANS Incident Handling course in January then hopefully the Forensics class after that.

[TheShadow]

This is a field that not possible to break in unless you are Law Enforcement or working with the LW in City/State/Federal system.

Hi Kasor long time no type, I remember you from the old days at other sites too. Had a serious injury and typing has been difficult until recently, been reading though. I may be opening a can of worms but I could not resist.

I don't mean to disagree with you entirely but you are crushing his hopes so thoroughly. Maybe too much TV and movies for you. If you check the various job sites you will find that very few in the category computer forensics have anything directly to do with law enforcement. Except for the big names FBI CIA etc. most law agencies can't afford a full timer and it is farmed out to consultancies. Considering that a great percentage of computer crime is the typical (inside job) more and more companies are opening a forensics section. Even the Target store chain in the U.S. had an opening last month.

Probie (original poster) besides law enforcement a shed load of forensic jobs will be with any organization that must create a computer trail and chain of custody. It does not have to be because someone committed a crime, it is often simply to show due diligence. Look at insurance companies, accounting firms, underwriters for corporate mergers, internal audits, checking for industrial espionage and of course law firms for the defense if it turns out to be a crime.

They all are going to want you to be able to analyze code, learn some java, C++, a SQL varient; grab a CCNA (hardware networking include wireless), a Linux cert, maybe C|EH and C|FI; Security+ lately is a given. Join a local CISSP group and (people network) JDMurray can amplify here maybe. Get that Bachelors Degree if you don't have one.

It will not be easy but it is certanly possible if you really want it.

Please excuse any typos; I am still on the mend

TheShadow grabs cape and heads for the door

[7lowe]

I just finished my degree in Network Security & Forensics in August and want to get into forensics, but it seems pretty unlikely at this point. Pretty much every opening I've seen is only interested in people with previous professional experience or security clearance. I've tried talking to LE forensic people and they say that there is no opportunity for someone without a LE background.

Having none of those things I've resorted to applying for contractor jobs in Iraq and Afghanistan. They seem to be willing to hire people with less experience as long as they are able to obtain clearance. We'll see if I actually get any response from those apps. I figure that I'd at least get some experience and a clearance out of it and presumably a very high salary (considering the work environment.)

7

[JDMurray]

If you want to work in the legal part of the field (e.g., investigations, collecting evidence on-site, testifying in court, lots and lots of paperwork) then you will not be in consideration for a forensics job unless you have a legal or law enforcement background. There is simply too much legal knowledge and experience that you will need that you can't get taking only forensics classes. I met a guy who actually joined a police academy to get his initial investigative training and he did get a forensics job out of the contacts he made.

You can work as a forensics lab tech without a legal background, but that's neither glamorous nor high-paying. Also consider that there are IT-related jobs that can greatly benefit from having knowledge of computer forensics, such as incident investigation, reverse engineering, and data recovery. Computer forensics a skill that can easily support your primary occupation rather than being it.

Here's an online computer forensics course and certification (CCE) I'd love to take, but can't afford: http://www.gatlineducation.com/foren..._overview.html

[Xcluziv]

I was wondering about this field as well. I know this is an up and coming field which I think will become an intricate part in the Computer/IT field as we know it

[Kasor]

I believe that I saw some Computer forensics program at the college, which might be another way that help to build the experience and education.

TheShadow - welcome back to the IT world. Don't worry about disagree or agree. This is part of being at the open public forum.

Computer Forensics is a hot field,, but just not for beginner. I saw LE guys with ENCASE/FTK Cert and still fail to do a basic work because they are lacking common experience - LE and legal background, plus strong IT foundation.

[JDMurray]

I believe that I saw some Computer forensics program at the college, which might be another way that help to build the experience and education.

Yes, there is a community college near me that has two computer forensics classes taught by the forensics guy from a local police department, and a nearby university has a forensics certificate program that has several one- and two-day classes featuring guests lecturers in computer forensics.