Sunday, January 22, 2012

Mentoring in Digital Forensics

After running the gauntlet of forensic certifications, I have come upon one that is meeting my need for mentoring - having someone else look over my methodologies and give me some feedback.  I am currently working through the mentoring portion of the CFCE (Certified Forensic Computer Examiner) certification program through IACIS.  This is historically a certification only open to Law Enforcement, but just a year or so ago, they opened it up to those who meet other criteria. (https://www<dot>iacis<dot>com/certification/cfce_faqs)  What makes this one different is the mentoring phase - where the candidate performs acquisition/analysis/report writing and sends it to the mentor for critique.  The mentors in the program are volunteers - professionals who are just trying to "pass it forward" and further other examiners' knowledge. 

You may ask, "Why is mentoring so valuable?  Doesn't everyone get that through OJT (on the job training)?"  I can answer that question with a simple "No."  In my past experience, some forensics teams have such a heavy workload that the mentoring/on-boarding process is quite brief.  In other instances, managers decide that peer case reviews are a waste of time.  When I asked to initiate a monthly case review at one of my old workplaces, I was told that I must have "low self-esteem" and that our cases were so routine that time spent reviewing the analysis and reporting of a case as a team would be wasted. 

Whatever the reason, the importance of mentoring, or as they call it in the educational realm, "scaffolding", cannot be overlooked.  Scaffolding is a teaching strategy that supports the novice by limiting complexities and gradually removing those limits as he gains more skills and confidence.  For a new forensic examiner, this type of model would involve working cases with another examiner on the team, then performing supervised acquisitions, working up to analysis and report writing.  This type of mentoring is an excellent way to ensure all examiners on a team are aware of and are performing within the organizational SOPs.  No matter how strong a team you have (or think you have), collaboration and group think can strengthen individual skills and build esprit de corps.