5 ms·

Ask HN: Computer Forensics

3 points by rorry_Breaker 16y ago

Hey all. I've worked in network infrastructure for a few years, and went back to school to finish up a cs degree. I felt a bit burned out when I left my job, mainly because of boredom... For example, a whole day could be about fixing a connectivity issue in some department or essentially getting their phones and other equipment to work... I know, every job can get repetitive and boring eventually, but I also wanted to work on something that had more substance if you know what I mean... Well, I am really interested in Computer Forensics, and hope to move in this direction upon finishing my degree. Is anyone currently work in this field that can give some pointers as to how I can get started? I'd also love to hear "a day in the life" story if you have any. At the moment I'm researching computer forensic certifications to attain, but any additional info is much appreciated; thanks.

jcr 16y ago
Your previous day job of "making things work" implies you might have a talent for learning and understanding "how things work." If so, this talent will serve you well in Computer Forensics, Reverse Engineering, Security Auditing, and many other related fields. Heck, it will even serve you very well in countless unrelated fields. You should state what you mean by the phrase "Computer Forensics" and what you expect such a job to entail? Without knowing your definition and expectations it's very difficult to give you a good direct answer. Some of the stuff I've done professionally qualifies as "Computer Forensics" (by some definitions), but I'm certainly not an expert in the entire field.
- rorry_Breaker 16y ago
  Yeah, I shouldn've been more specific; I forgot the phrase encompasses a pretty broad range of jobs. Well right now, I'm mostly interested in working in a lab analyzing confiscated equipment for some contractor that does such work for police or whomever to get started. Malware analysis is pretty interesting as well; though I'm not trying to start there.
  - jcr 16y ago
    It seems I wasn't clear... Do you want to work at the physical hardware level, or the software level, or betwixt, or between, or other? There's a big discrepancy in skill sets between knowing how to drive a SEM (Scanning Electron Microscope), knowing how to drive test equipment (signal analysis), knowing how to drive a disassembler (binary analysis), knowing how to drive a text editor (manual source code analysis), and knowing how to drive the "typical" industry tools (automated source code analysis, fuzzing, disk inspection, case management, ...). On top of all that, there's also knowing legal requirements and procedure (evidence handling) as well as proper cost and feasibility estimation ("is it possible?" "is it worth it?"). The most fundamental basis for all of these related fields is knowing how to write code, preferably in a whole lot of different programming languages. You need to know the high level languages used in applications and services. You need to know the common "systems" languages like C and C++. You need to know the low level assembly languages very well, preferably for multiple architectures. You may or may not need to go even lower down to knowing microcode. You may or may not need to know firmware engineering and reverse engineering. You may or may not need to know a good deal about hardware engineering and reverse engineering. There are even people who work at the materials sciences levels, and yes, they're beautifully fun and spooky to work with because they actually can answer questions like, "Was this ATM system board frozen with liquid nitrogen?" --Similar fun is true for the signal analysis folks. As you've probably guessed by now, there's a lot of heavy engineering and sciences involved, as well as a bit of art, so you'll need a nearly masochistic dedication to constantly learning. You might find books helpful to get you started in various topics, but you'll do most of your learning hands-on and on your own. The people who are "truly great" in various fields and topics are at least partially, if not completely, self-taught. Pick an area of interest, and dive into it. Learn to do your own research, and learn to find the research of others. The two things to keep in mind are, (1) all of the areas of interest are inter-related, and (2) there is significant competition between security/assessment vendors. The competition can often make finding the research of others nearly impossible. This is especially true for the malware analysis and security auditing industries where many tools and techniques are considered trade secrets. Even if you are an amazing generalist with both depth and breadth in your skills, you will still most likely still specialize to some degree. The useful skill and knowledge of any single person has limits, so you'll need to know how to work well with others, many of whom are amazingly talented in their own right, if not absolutely brilliant. If you can remain content, helpful and useful while knowing you might be the dumbest guy in the room, then there is hope for you. The technical challenges of forensics and related work are endless and very rewarding, but there is a little known and very damaging emotional toll extracted from you. Every day you at work you must stare at evil. Seriously. You need to stare at the results of truly wicked people committing viciously brutal crimes against other human beings. You will become jaded. If you fail to maintain some hope in the general goodness of humanity, you will become bitter. If you become really good at your job, you will have learned to think like the bad guys... and anyone who recognizes your skills will consider you "spooky" to some degree, even if you're one of the good guys. The absolute nicest and most honorable "good guys" in the various fields are also frighteningly talented. Becoming jaded, or worse, bitter, and always being suspect due to your demonstrated skills tends to be a rather high price tag for a career. --This is really the very first thing you should learn.

3 points by rorry_Breaker 16y ago

jcr 16y ago

Your previous day job of "making things work" implies you might have a talent for learning and understanding "how things work." If so, this talent will serve you well in Computer Forensics, Reverse Engineering, Security Auditing, and many other related fields. Heck, it will even serve you very well in countless unrelated fields. You should state what you mean by the phrase "Computer Forensics" and what you expect such a job to entail? Without knowing your definition and expectations it's very difficult to give you a good direct answer. Some of the stuff I've done professionally qualifies as "Computer Forensics" (by some definitions), but I'm certainly not an expert in the entire field.

rorry_Breaker 16y ago
Yeah, I shouldn've been more specific; I forgot the phrase encompasses a pretty broad range of jobs. Well right now, I'm mostly interested in working in a lab analyzing confiscated equipment for some contractor that does such work for police or whomever to get started. Malware analysis is pretty interesting as well; though I'm not trying to start there.
- jcr 16y ago
  It seems I wasn't clear... Do you want to work at the physical hardware level, or the software level, or betwixt, or between, or other? There's a big discrepancy in skill sets between knowing how to drive a SEM (Scanning Electron Microscope), knowing how to drive test equipment (signal analysis), knowing how to drive a disassembler (binary analysis), knowing how to drive a text editor (manual source code analysis), and knowing how to drive the "typical" industry tools (automated source code analysis, fuzzing, disk inspection, case management, ...). On top of all that, there's also knowing legal requirements and procedure (evidence handling) as well as proper cost and feasibility estimation ("is it possible?" "is it worth it?"). The most fundamental basis for all of these related fields is knowing how to write code, preferably in a whole lot of different programming languages. You need to know the high level languages used in applications and services. You need to know the common "systems" languages like C and C++. You need to know the low level assembly languages very well, preferably for multiple architectures. You may or may not need to go even lower down to knowing microcode. You may or may not need to know firmware engineering and reverse engineering. You may or may not need to know a good deal about hardware engineering and reverse engineering. There are even people who work at the materials sciences levels, and yes, they're beautifully fun and spooky to work with because they actually can answer questions like, "Was this ATM system board frozen with liquid nitrogen?" --Similar fun is true for the signal analysis folks. As you've probably guessed by now, there's a lot of heavy engineering and sciences involved, as well as a bit of art, so you'll need a nearly masochistic dedication to constantly learning. You might find books helpful to get you started in various topics, but you'll do most of your learning hands-on and on your own. The people who are "truly great" in various fields and topics are at least partially, if not completely, self-taught. Pick an area of interest, and dive into it. Learn to do your own research, and learn to find the research of others. The two things to keep in mind are, (1) all of the areas of interest are inter-related, and (2) there is significant competition between security/assessment vendors. The competition can often make finding the research of others nearly impossible. This is especially true for the malware analysis and security auditing industries where many tools and techniques are considered trade secrets. Even if you are an amazing generalist with both depth and breadth in your skills, you will still most likely still specialize to some degree. The useful skill and knowledge of any single person has limits, so you'll need to know how to work well with others, many of whom are amazingly talented in their own right, if not absolutely brilliant. If you can remain content, helpful and useful while knowing you might be the dumbest guy in the room, then there is hope for you. The technical challenges of forensics and related work are endless and very rewarding, but there is a little known and very damaging emotional toll extracted from you. Every day you at work you must stare at evil. Seriously. You need to stare at the results of truly wicked people committing viciously brutal crimes against other human beings. You will become jaded. If you fail to maintain some hope in the general goodness of humanity, you will become bitter. If you become really good at your job, you will have learned to think like the bad guys... and anyone who recognizes your skills will consider you "spooky" to some degree, even if you're one of the good guys. The absolute nicest and most honorable "good guys" in the various fields are also frighteningly talented. Becoming jaded, or worse, bitter, and always being suspect due to your demonstrated skills tends to be a rather high price tag for a career. --This is really the very first thing you should learn.