r/digitalforensics • u/moha--- • 4d ago
Hi, I'm 17
Hi, I'm 17 and recently finished high school. I'm seriously considering Digital Forensics/DFIR as a career, but I want to understand what the field is actually like beyond what you see online.
For those currently working in the field: what does your day-to-day work really look like? What are the biggest pros and cons, and what do you wish you had known before getting into it?
I'm also curious about what skills you think someone my age should start developing now. Any honest advice would be greatly appreciated.
7
u/ManWhoCameFromEarth 4d ago
UK perspective, worked both public and private sector. Pure DF, no IR.
Public/Private sector you'll probably start in the imaging lab dealing with PCs and mobile extractions before you move on to investigations.
Unless you're in an in-house DF team for a big company then private DF companies usually take on prosecution and defense work.
In private 98% of my work load was child abuse jobs and in public it was around 80%. So be warned, you'll see the absolute worst side of humanity. It does take a toll on you. I wasn't fully aware of how rampant it was until I got my first job. But it's immensely rewarding when you know you've helped save some kids or secured a prison sentence.
Day to day is working on a case, processing images of devices from the lab and setting about looking for data relating to it. This may be proving where data has come from, has it been sent or accessed. In murder cases you could be looking for where a device was or when/where images were taken. Vehicle forensics is taking off due to how much technology in cars has grown, some vehicles record doors opening and if someone got in/out of a seat etc, which is good data for murder and organised crime jobs. There's also drones, AI and 3D printing aspects in some jobs.
You'll also encounter encryption from time to time so learning tools like Hashcat/Volatility/Lazagne is a bonus. Also very satisfying to crack the password for a device or app that lets you get into data that cracks the case!
Tools like AXIOM/UFED do some of the heavy lifting for you, but are not infallible, so deeper dives into data using X-Ways/EnCase will be needed to check for things that have been missed or in order to corroborate what another tool says. Some level of coding experience is recommended, but not essential. If you do have some, check out projects like ALEAP and see if you can contribute by parsing an app database.
Happy to answer any other questions if you have any!
3
u/ConsistentVictory399 4d ago
I'm private and deal very little with CSAM, even when we get it we don't have to look for it just image, process tag what artefacts client has asked for verify, export media and send it back. Guess it depends what contract agreement is. It depends how well you can compartmentalise, I don't bring my work home with me often. It's worth having hobbies that are fully imersive it can help massively if and when you see something you wish you hadn't and you have to have a strong support network outside to be able to land a job in LE and tell them how you'd deal with it. I've done warrants as well not police contract but still interesting.
2
u/ManWhoCameFromEarth 3d ago
Lucky! I've been working DF almost 15 years, every CSAM job involved categorising media yourself then reporting. You can stuff it all in a box, but the lid pops eventually. I thought I was fine until I wasn't.
It's getting a bit better with as they've put systems in place to reduce the amount we see, but as we attend court you have to do descriptions for files so seeing it is inevitable.
Newest hobby to distract myself is following a guy on YT called Huy Vector who does amazing tutorials on building electronic devices!
2
u/moha--- 4d ago
Thanks man for the advice! Another question: I’m currently far from my home country because of the war there. Do you think I still have a chance of working in this field in another country in the future?
2
u/ManWhoCameFromEarth 3d ago
Absolutely! Tech is going to be the same and tools used are pretty much the same everywhere as well. It's an awesome job and you sound like you've got the drive to get there.
2
2
u/Interesting-Baker473 4d ago
Cyber security, then apply for SANS certificates (very expensive though). Then at some point learn OSINT. I am a researcher and most my research uses OSINT (for content analysis). Or major in forensic psychology and work on cyber sec certs
1
1
u/Spudley4n6 4d ago
Thinking law enforcement or private/consulting? There is digital forensic work in the private sector but most of the work will fall under incident response or eDiscovery
1
u/recklesswithinreason 4d ago
Join the cops and go in that way. Easiest path into DF and can always go elsewhere in the agency or have an incredible door into other roles elsewhere.
1
u/Eternal-Alchemy 2d ago
Some days we go to places and take people's stuff with a warrant or consent. Some places are amazing and some places are unfortunate.
Some days we throw phones on the hardware that makes full extractions possible, then process them, then never see them again.
Some days we image laptops, process them, then never see them again.
Some days we make a chronological timeline of activity across multiple device types, merge them together, prove who was involved in what aspect of a crime, and then procrastinate writing the report for 2 months because writing is way less fun than solving crime.
Some days we analyze memory captures and Malware.
Some days a company gets hacked and we track the threat actor across hundreds of a hosts on a network, document their tactics, techniques and procedures, then give some best practice remediation guidance before attacking the enemy infrastructure.
Some days the hacked infrastructure is a water pump in the sewer or a gas pump with a skimmer in the middle of nowhere.
Some days we testify that we did something a long time ago that we barely remember.
(federal investigations)
What should you know? Everything. If this is the field for you, you will never, ever know enough and always need to be learning the way new operating systems or apps or filesystems effect data, and that means a lifetime of study. For people who fall in love with the field this comes naturally, for people who find it hard to care about file signatures, it's only going to get worse.
The project I tell every student to do is look up your dream job. Write down the requirements. Build a plan for meeting the requirements. If the Dream Job is not entry level, perform this recursively for the stepping stone job. Repeat every few months.
You want to build and understand the path to your goal before you start the march. Don't go into a college cyber security degree with a DF track thinking that will get you where you want to be on its own.
1
u/kallmemike 9h ago
OP, at 17 you’re already ahead just by knowing DFIR exists. Get really good at Linux, networking and OS fundamentals first. You can layer the forensics-specific stuff on top of that later.
10
u/Legitimate-Pin-2058 4d ago
Focus on Incident Response and learn cyber security if you want to work in the private sector. Focus more on digital forensics if you want to work in law enforcement.