The DFIR world is your oyster because...

Every job skill requires some level of training. Some jobs require education in the form of degrees or certifications. None of these guarantee competence in any skill. It also doesn’t indicate that learning occurred. I look at training or education documentation as proof that time was spent in a seat and information was given (but not necessarily received...).  

Practically however, if someone has the requisite training and/or education of a skill, one can assume that at least a foundation of the skills taught was learned since it was taught (per the paper).

The learning aspect is a huge individual issue as everyone has different motivations and learning styles. The presentation aspect is also a huge individual issue as every presenter has different perspectives and teaching styles.

The learner (you?)

Going into training or education as a learner requires motivation and that motivation most likely will determine how well one learns or if at all. If the goal of the learner is just to gain a piece of paper (certification or degree) in order to check a box, then the learning motivation will be low. 

Chasing coins and acronyms for the sole purpose of collecting puts learning as a secondary motivation. 

I am certainly not discrediting certifications or degrees. I am giving my opinion that hiring managers should not base hiring solely on certification or degrees, but I know this is the way it is in many organizations, particularly in government agencies. Still, learners should still go into degree programs with the intention to learn and the degree being secondary to the experience.

The presenter (you?)

Presenters have different motivations, different perspectives, different presentation skill levels, and different presentation styles. 

I have taken courses with presenters who gave amazingly informative training that was engaging and worth every minute. I have also taken courses from presenters that for all practical purposes wasted my time and money. This included both private vendor and college level courses.

Given if the information being presented by someone is accurate, the most important aspect in learning from another person is that the presenter’s style of conveying information matches the learner’s style of comprehending that information. The secondary aspect is “who is the presenter” by either name or organization.

If the best presenter gives the best information in a manner that the learner does not learn, then both waste their time. There may be a piece of paper documenting the instruction, but learning did not occur.

Typically, we choose the organization first in training and education. This may be a big-name college or a major software corporation. The "big name" may be enough for you to not even care who presents information. You just might want a fancy name on the paper.

I have it on good word that at an Ivy League law school, the students are told not to worry about grades or failing, because they will all pass since the hard work required was getting into this elite school. 

A fancy name will help get hired by those organizations that fancy the fancy names, but if we are lucky, we also get great presenters.

One consideration

Sometimes it is the presenter that is most important. I have personally never met a well-known DFIR presenter who was arrogant, self-centered, or a narcissist. It is quite the opposite. Great presenters want to help others avoid pain that they went through. This doesn’t mean the learner won't have pain in learning but rather means the pain will be from new discoveries, not the same discoveries presenters have already gone through.  Why repeat the past when you can blow right by it?

Another aspect of great presenters is that of being able to see through their eyes with a different perspective. You cannot go through this career field with one (only your) perspective, as you need to look at every case and every minute forensic artifact with as many different perspectives as possible to get the true and fuller picture.

Some of the best presenters also have the skill to share some of their best investigative and analytical experiences. 

As a personal example, I had an opportunity of sharing a breakfast with Jessica Hyde and some of her crew at a conference. During this breakfast, Jessica told me of a case that she cracked that I never would have thought of if it were me. Then she told me another. In less than half an hour, I learned a different investigative mindset that I did not have before this breakfast. For Jessica, this was probably nothing amazing to her. She was just sharing things she had done and in a manner that I completely comprehended.

There are some in DFIR that I had the fortune to learn from who are now long gone.  These experiences are priceless.

Conferences are great for learning from many different perspectives from many different presenters in just a few days. I tend to grab as many perspectives as possible from as many presenters as possible before it is impossible. I do this because it makes me a better investigator. It makes me a better analyst. And it makes me better abled to share with others who can then do the same thing.

So, for me, I tend to look at the presenter first. For any conference, while I am looking at the agenda, I am reading the bios of the presenters to see if they have perspectives to share that will benefit me or others that I can share with. I want as wide a range of perspectives as physically possible.

Don’t get me wrong, I am not advocating that only well-known DFIR presenters should be sought out. I am saying that different perspectives are important as they come from experiences that I don’t have.

There are many presenters today who may not be well known today, but will be well known in their careers at some point. I consider the lesser known or unknown presenters to be like an opening act to a famous band. As one personal example of this, I once saw John cougar Mellencamp open for a band where he had beer bottles thrown at him (not that we would do that at a DFIR conference!). This was when Mellencamp was not famous, and long ago when I was a teenager. But the example rings true. You never know who turns out to be someone you will admire in the future.

Mentors and role models

I have several role models. They don’t know that they are my role models but I try to emulate their work. Sometimes I am in the crowd of their presentations. I read their books if they wrote books. 

I also have now and have had several formal mentorships along the way. These are those who have physically and mentally helped me in DFIR. 

In my opinion, without role models, you can only hope that you’re doing it right because without following the path of others, you risk blindly walking a trail over a cliff of failure. With role models, you can at least follow their proven beaten path and avoid pitfalls.

If you only have role models, you will probably only go as far as those you follow. With an effective mentor, you can be led to blaze a trail beyond anything that your role models have accomplished.  It may be only 1% improvement from a mentor, but this is the difference between good and great.

Role models are like maps telling you where to turn. Mentors help you create the maps that others will follow.

A role model example

Jessica Hyde has been teaching college-level courses for some time, but I've not been in her academic program. Her DFIR background is quite incredible, comprehensive, and wide reaching. Like a said, I gained more from breakfast with Jessica in half an hour than I have gained in entire days of some training courses.

So now I see that she is teaching courses online. Of course, she told me this was upcoming months ago and I was waiting for it. Jessica is very humble and says nice things about everyone, but she is also one of my role models who have blazed paths that I would like to follow on certain aspects. I am taking one of her on-demand courses right now even though most of the information I have already been exposed to in one form or another. But it is the different perspective that I want to gain from someone who has done what I want to be better at.

There is an end to all good things

We all wish to have a great career to eventually move into another stage of life. This next stage could be a different career or retirement. If there is someone that you wish you could learn from, don’t hesitate if the opportunity arises. The day will come when that opportunity will be gone. Again, that could be another stage of life or it could be that this person no longer presents or teaches by choice or by being too busy working.  Get it while you can!

When you know it all

When the day comes that you no longer need a different perspective on how to do things differently or how to look at things differently, then that is the day you are no longer blazing a path or even walking on a path beaten by another. You simply have stopped, sat down, and will now watch others walk past you in both skill and knowledge.

 Your training plan

Maybe you will now consider more perspectives in how you seek out training and education that will help you stay on a proven beaten path. Or maybe you will be propelled you to blaze a trail for others. It is cool to be successful in DFIR but it is so much way cooler to point the way forward to others. 

The DFIR world is your oyster because there are practically no rules to be “certified” or “regulated” which also means nothing and no one (besides you!) can hold you back.