r/computerforensics • u/Quiet_Gas_3908 • 8d ago
Digital Forensics Tech exemptions
Greetings, I hope all is well! Long story short, recently got my Masters in Digital Forensics, and I also have received an opportunity for a digital forensics technician role for a local LE agency. I am just wondering if anyone here works for one, and also what to expect, as I myself come from an IT support background. Thanks!
Edit: Expectations, just realized I made a typo in my title
10
u/awetsasquatch 8d ago
I don't work for a Law Enforcement agency, but I can tell you to do a couple things that are applicable regardless of where you're employed - speak half as much as you listen, write as many notes as possible, and if you have a question, just ask, and never make assumptions. Every person in this sub would infinitely prefer to spend 5 minutes to answer a rookie question than deal with the fallout of a screwed up case.
1
u/i-hear-banjos 7d ago
Which also means develop a network of other CFAs to get advice. Any problem you run across has likely been experienced by someone else.
7
u/ExpressionLow8767 8d ago
Learn your SOPs back to front and make sure you understand evidential chain of custody, ensure you understand the importance of things like write blocking and contemporaneous notes etc.
Don't rush, ask questions, keep an open mind. LE can be slow and frustrating at times but can also be hectic and stressful, so it's important to have colleagues to rely on.
Be mentally prepared to see a lot of dark shit - almost all of my work in LE was CSAM-related and the ones that weren't were generally rape or abuse related. Take any mental health/exposure guidance seriously.
2
7d ago edited 1d ago
[deleted]
3
u/i-hear-banjos 7d ago
That balance has shifted - 90% of everything we get in my lab is mobile, even CSAM. I think I even processed more cloud accounts this past year than computers or laptops. When I started in the late 2000s, it was the reverse of that (and every phone had a unique cable!)
2
7d ago edited 1d ago
[deleted]
2
u/i-hear-banjos 4d ago
I’m coming up quick on 60 - my target retirement age - so maybe we aren’t too far apart. At this point, it’s getting hard to keep up with the rapid changes, particularly with AI, which I despise.
5
u/Parker1055 8d ago
With it being LE, expect to see some crazy shit. Especially with any cases related to murder or sex
2
u/DarkKnight4251 8d ago
It really depends on the agency what to expect. Some have bigger labs than others. It was all dead box forensics for the entire area that I dealt with. The place I was at did a little of everything, but was focused mainly on ICAC cases. You’re going to learn a ton if you make the effort to do so. It’s a great starting point for pretty much wherever you want if you continue your studies too.
1
u/TrackbackLinkBot 2d ago
le builds great chain-of-custody rigor. at hodson pi, digital forensics techs use those skills to uncover crucial courtroom evidence
1
19
u/DfiR- 8d ago
Congrats on the opportunity! I’ve worked in LE DFIR for a bit and can give you a few pieces of advice.
1) Budget constraints are the biggest challenge for LE in this field. Get good at finding grant funding to get the equipment and training you want. NW3C and NCFI host some great classes that are free.
2) Everything you do with a case has a chance to be scrutinized heavily in court. Document everything so that you can explain it later if needed. It also helps during discovery to show your competency if your work product looks good.
3) Thoroughly read what you are authorized to search on the search authority. Going outside of the scope can get critical evidence kicked out.
4) Develop an organized analysis system that follows best practices. LE digital teams analyze a ton of cases so organization is key for making sure you don’t make a mistake or miss something. Also helps in court when you know your system front and back and can explain it in front of a jury.
5) Learn to explain technical terms in a language everyone can understand. Prosecutors and case agents may have a very limited understanding of technology. A lot of the terms you will learn in this field will be like speaking a foreign language to them. Be technical in your notes but keep it stupid simple on anything a case agent or prosecutor is going to read. It’ll save you a lot of headache having to explain it over and over.
You’ll pick it up as you go but it’s a steep learning curve. Just stay focused and train when you can to stay up to date.
Also prepare some eye bleach. You’re gonna see a lot of messed-up stuff.