computer/digital forensic

ironman682

Please do anyone have or idea about digital forensic certification, how long, job market and more. Am in Dallas FT. Worth Location

JDMurray

First, let talk jobs in computer (digital) forensics. Many states in the US require that a person working in and with computer forensics (computer forensics examiner) have a Private Investigator's (PI) license. In some cases, an examiner may only need to work under the supervision of a PI, or directly for a licensed law firm, to be considered legal. I would guess that Texas is a state that wants all forensics examiners to have a PI license; I know that in California a PI license is not required.

As for computer forensics certs, there are vendor-specific certifications for EnCase (EnCE, EnCEP) and Access Data, and non-vendor certifications, including Certified Computer Examiner (CCE), SANS (GCFA), and EC-Council (CHFI). There are currently no academic forensics certifications, but there are Masters degree programs that do specialize in digital forensics.

The forensics community is absolutely nuts for certifications. They wear them like badges of rank, and it seems that you can't have too many of them. Besides the forensics-specific certs, I've noticed CE's flaunting Apple and Cisco certs because they specialize in Macintosh or network forensics. CE's are also aware of the CISSP, but I don't see a big rush towards it outside of the DoD community. The FBI requires its examiners to have the A+ and Network+ certifications, and will pay ridiculous amounts of money for its agents to obtain the simple training that can be found at very reasonable prices at a local community college.

Back to jobs, check dice.com, monster.com, etc. for forensics jobs in your area. Also have a look at the local FBI RCFL and local police department job boards. Many private companies also have opening for "forensics analysts," but they often want lots of Malware and reverse engineering experience in their positions too. Many forensics people are only into the IT side of things and know little about software engineering.

I recommended LinkedIn.com, Twitter.com, and SANS as places to find people in the digital forensics community. If you do not have a legal or law enforcement background, you will also need to look into eDiscovery as a way to get into computer forensics, and LinkedIn and Twitter can help there too.

Sancho1199

Excellent response from JDMurrey, and being a forensics guy would agree with what he says.

To elaborate a bit on a few of the things (just my two cents...) As for the certs, I have never got any "forensic" certs and have been in the biz 10+ years. That may change for me as I see more requests for "forensic" certs in the job market.

I did go and get the MCSE a while back only because during initial contact during jobs (these happen quickly and usually overnight/weekends and within a 24 hour period) many times the point of contact (or at least a decision maker) would be someone from HR. Now HR, for the most part, has no CLUE what forensics is all about so they would ask "are you MS certified?"

What that has to do with forensics I never figured out, but getting tired of trying to make them understand they were asking the wrong question became tiring and it was easier to just get MS certified...

If you don't have a law enforcement background (just my two cents) it is usually more difficult to break into forensics. Now if you are a uber nerd that can handle really difficult cases that is good and would be your niche. As JD mentioned having a strong programming background would be very helpful. I've been in numerous training classes with cops and geeks. Each has their strong suits, however when it boils down to an "investigation" cops (from my view) usually prevail.

Gearing up to move into computer forensics for someone with just basic IT experience would be best accomplished via JD's recommendation... through eDiscovery which is a newer field and you can easily set yourself apart from the Litigation Support companies (or even align yourselves with one).

Hope this helps!