If you come from less, you must do more to make it in DFIR

One certainty is that life certainly is not fair. If you want the solution to this problem, skip to the last paragraph, but you’ll miss a lot of good points.

Life is unfair!

A positive reaction to this life fact is to accept it and move forward. A negative reaction would be to nothing but complain.

Let’s talk about the results of a negative reaction: Nothing happens. That’s it. You won’t move forward. You won’t even have a chance to achieve your desires and goals.

Now, the more important point is the positive reaction.  Yes, life can suck and others will always have an upper hand due to their position in life. Sometimes this is you but most times it is someone else.

Three things generally regulate getting into DFIR

Exposure

Some who want to enter DFIR today will have more specific exposure to the field due to family or friends than others.  The exposure to the field is your starting point. Were you 10 years old or 40 before seeing what this DFIR field was about? Some get it earlier than others, and they have a head start.

Access

Open access is everywhere on the Internet. Free tools, free test data, videos, and instructional guides. The drawback is that open access typically means being overwhelmed with resources and underwhelmed in how to actually put any of it together to learn.

Access that is not freely open is a faster route.  Colleges, courses, workshops, and conferences are generally created by taking tons of open access information and putting it into some semblance of order, saving months or years of self-learning.

All have access to the free information. Not all have access to the curated, massaged, and pre-packaged information. Limited resources prevent access to these resources.

Opportunity

There are those who make opportunities and those who happen to have opportunities dropped in their lap. Take my word for it, it is better to make your opportunities than hope for some opportunity to come to you.

Opportunities can be found in a job, in a volunteer position, in an apprenticeship, in a cooperative effort with another, and fully creating an opportunity out of thin air (ie: hard work and creativity).

You must at least do the minimum

My path to DFIR was from law enforcement, which without getting into my 5+ year journey to get hired, let me give some stories on emails and phone calls that I’ve received from law enforcement and private companies asking how to move into DFIR. Over the years, I’ve fielded many of these questions.  Here are the most common comments and statements that I’ve heard from those who have had no forensic training or experience but wanting to leave their current job or retire to work in DFIR.

1. How can I get into forensics?

2. Will you hire and train me or do you know someone who will?

3. I am not going to pay out of my own pocket to learn.

4. My agency/company won’t send me to training, and I am not going to pay with my money.

5. There are no open spots at my agency/company, so how do I get training?

6. I retire in a month, how soon can I expect to be hired in forensics without any skill now?

7. I don’t want to get a degree or certification.

None of these comments made me move an inch to help. None were willing to do anything other than be welcomed with open arms into a field that is crying to hire anyone because of perceived shortages. To be fair, I have most always sent a follow up email with a long list of steps to take to get a bare minimum resume of maybe getting looked at to be hired somewhere.  Unfortunately, the list of steps requires effort, money, and time which many people just don’t want to do. You must do at least the minimum.

My answer to these questions is do the work or do something else or do nothing. This is the way.

I also have gotten statements (excuses) like:

1. I can’t get hired because I am “x” (with “x” being something related to age, race, gender, education, experience, or something else that is irrelevant).

2. Everyone else can get hired because they are “x” (with “x” being something related to age, race, gender, education, or something else that is irrelevant).

3. I can’t afford to pay for training/education.

4. There is no way to get experience.

5. I can’t spend the time to learn in college or courses.

6. I am already working 50 hours a week and have a family.

All of these are legitimate reasons/excuses to not try if you let them. Like I mentioned, some people get access and opportunities that most others will never have. This is life.

My answer to these obstacles is to squeeze what you can, when you can, and how you can to build your foundation. This is the way.

My path was easier than some, harder than others

In police work, my agency did not have anything even closely related to forensics. They didn’t do it at all, and when it was necessary, the work was farmed out to a private examiner.  I may have written about this before, but it took me more than 2 full years to get a forensic “unit” approved in my department. I was that “unit” eventually..

Before you think that this was easy, consider that I was travelling internationally, undercover, while also being on call as a SWAT member, and working cases with all the alphabet soup agencies that you can think of, including the national security type agencies with the “T” types of cases.

I squeezed training in when I could get it. I paid for courses out of my pocket, which needed family approval because the family would suffer from it. I bought software, hosted courses, attended conferences, found free/donated/granted gear, and turned a storage closet on the second floor of my agency into the forensic lab.  I then did the bare bones work of forensics for cases that other detectives worked on (all the types of crimes that you can think of). Then I volunteered for ICAC work.  Then I volunteered to federal case work. And I sneaked training in during work, while at the same time, working cases, juggling it all. Most all of my forensic foundation was done on my free time, with my money, which took time away from family.

Eventually, that lab became a formal forensic capability with policies that I wrote, supported by cases that I did, and now is staffed with full time examiners.

This is the point. It took years. I took a lot of risks. I spent a lot of money. I used a lot of personal time. I created something that didn’t exist with things that I didn’t have.  At the end, I had to deliver on my promises, so I made sure that I could.  The other option would have been that I could still be driving around a patrol car and never lifted a finger to do any of that hard work. That would have been so much easier.

The result of having it difficult (should you take the road less traveled)

You sacrificed. Your family sacrificed. Your pocketbook sacrificed. Your passion gave you a blatantly apparent drive to succeed. You suffered. You cried. You took risks. You nearly gave up 1,000 times but always had 1 reason to keep going.  You gained more relevant skills than just DFIR.  You learned how to solve problems that most others cannot or will not try to solve. You had less and worked more, and because of that, you are most valuable to those hiring managers who see it.

That is the solution to having less to get into DFIR. You must work harder than everyone else. For the hiring managers that don’t see it, you seriously do not want to work for them. Work for someone who can see overcoming life struggles as a job skill and not as a “class status”.

I can talk personally about the Marine Corps because I was there at a point in my life. The Marines have two main rules to live by:  1) Mission accomplishment. 2) Troop welfare.  Meaning, the mission gets accomplished first, and if it didn’t get accomplished, that meant everyone died trying (take care of the troops after...).

I’m not saying to go DFIR or die trying, but I am saying that a “mission” is generally something that has a high risk of failure, is very important, and requires a high degree of drive, creativity, resourcefulness, and various skills to accomplish. 

If you are the Mitch Rapp (some may get the reference…) of getting into DFIR, then a hiring manager knows that you will be the person that can solve practically any problem, regardless of the obstacles of the organization or the problem itself. They know that if you don’t know something, you will not only learn it, but also master it to the point that you will own that skill outright.

Getting into DFIR is a mission for some. For others, it is a fleeting thought that is gone by the time the credits roll in the movie Sneakers. Which are you?