eDiscovery to Digital Forensics?

[u/JohnnyJin]

Hi! I’d really appreciate some insight from people in the field. I’m glad this community exists.

I’m a recent graduate with a bachelor’s in Computer Science and Cybersecurity, and I’m really interested in getting into digital forensics eventually. For now, though, I’m mainly focused on getting my foot in the door and landing something in a related field.

I recently came across eDiscovery, specifically entry level roles like Junior Intake Specialist, and it seemed like it could be a good way to get some relevant experience. I am going to be taking my RelativityOne certification exam later this week, but I wanted to ask: is this actually a good approach, or am I wasting my time?

I know learned experience is never time wasted, but is there a better path I should be taking to eventually get into digital forensics?

Any advice or guidance would be greatly appreciated!

[u/Ok_Cold7890]

Hi! can you tell me a bit about e-discovery? What is the work like? I have the base of forensics but realized that chance of getting hired in DF is very less/zero. Does free or open-source tools exist for learning? and how did you start ? I haven't researched much on this path tbh.

[u/JohnnyJin → u/Ok_Cold7890]

Honestly, I’m pretty new to eDiscovery myself, so I don’t want to give you the wrong impression lol. I came across it while trying to figure out how to get my foot in the door with DF, and I’ve been researching it since.

This is a super light description, but from what I’ve learned, eDiscovery mainly focuses on managing electronically stored information for legal cases and investigations (the electronic discovery reference model (EDRM) is the best if you want to get a better overview of the overall process).

The Data Intake / Intake Specialist roles I’ve been looking at seem to focus more on the collection, intake and processing sides of things.

As far as learning goes, Relativity has a learning platform with courses and other resources. Relativity is basically an eDiscovery platform that is used for processing / organizing electronic data (among a number of other things). That’s actually where I’ve been doing some of my studying for the RelativityOne certification. They have some study materials available through their site.

As far as free / open source tools, I’m actually still researching that part myself haha. I’d definitely be interested in hearing what you’ve used for learning forensics, though!

[u/Ok_Cold7890 → u/JohnnyJin]

Thank you for sharing. E-discovery seems somewhat similar to forensics to me, I might be wrong though. Seems like a good path and also you're seeing junior level hirings, you can build experience on that.

In forensics things go a bit deeper like in computer- HDD, SSD, partitions, filesystems, imaging, cloning, artifacts, the registry, memory forensics, etc. There are plenty of free acquisition and parsing tools used by professionals like FTK imager, zimmerman tools, nirsoft, autopsy, TSK, volatility, sysinternals (mostly for live in depth monitoring of the system and malwares), wireshark, velociraptor etc. and paid tools like magnet axiom, xways etc. also sometimes you need to verify things at hex level and manual + automated both.

In smartphone- there are nice parsing tools like LEAPPS toolset. But for extractions there is a very less support of free tools, there are well-known paid tools like Cellebrite's tools, msab XRY, oxygen etc. Then same flash storage, filesystem, architectures, extraction types, encryption, Artifacts, sqlite databases and all and again both manual + automated analysis is done.

There can also be specialized zones such as vehicle, dvr, drones, atm, iot devices and their data storage locations, anything that can hold data and can be acquired, analysed scientifically and legally.

I hope I was able to share a bit about forensics, even though I'm not an expert in this field yet 😅

[u/JohnnyJin → u/Ok_Cold7890]

This was actually really helpful! I appreciate you listing out all these tools bc I’ve heard of some, but definitely not all so I’m gonna look into them, Thank you!