Knowing “how-to-do-it” is important, but first you need to know “what-to-do”.

My first months as a narcotic detective sucked.  My partner (ie. the senior narc) was less helpful than a doorknob on the ceiling.  The initial On-the-job training basically consisted of “figure it out” and “I am not going to help you figure it out”.   In time, I figured it out.  It took nearly being killed on occasion and suffering through a few investigations.  Did I mention my first months as a narc sucked?

Here is what I learned with that experience: Knowing what you have to do is more important than the how to do it, because if you don’t know the what-to-do, the how-to-do-it doesn’t matter.   It’s like registry forensics.  If you learn all about how to do it, but you have no idea of why you should in one case but not in another, then you are missing the what.

Let’s consider one registry item.  There are probably dozens of software applications that will deliver you straight to USBStor in the registry where you can pull out data on USB devices.  You can spend a week in a registry course working one specific software and then self-learn a dozen more registry tools all for the effort of pulling out registry information. But, so what?  Being able to pull out registry information willy nilly is useless if you don't know what to do with it (or why).

The what is having an objective and purpose to go into the registry for that specific data.  You need to know what you need for evidence to prove or disprove an allegation.  You need to know what you need to make the case.   The what is going to be a lot more than pulling out a registry key.  

Then, after pulling the data out that you determined is necessary to make your case, you need to tie the data to a person.  And you need to articulate how the data you found is relevant and that it is evidence which relates to a person.  Simply finding that a flash drive was plugged into a machine does not make a case if you can’t articulate the connection, no matter how great of a forensic job you did to ‘recover data’.

I bring this up so that when you take a training course in forensics, ask the instructor to also cover the what in addition to the how.  Learn the individual skills, but also learn when you need to employ those skills and why; otherwise, spending a full workday in the registry just because you know how isn’t going to make your case if you don’t know what you need to do in your case. 

The what is the forest.  The how are the trees.  You really do need to see the forest.

Going back to my narc years, as soon as I figured out what makes a good case, my effectiveness (and workload...) skyrocketed.  I initiated more than a dozen international organized drug trafficking cases (aka: OCDETF), seized over a ton of drugs, worked several wiretaps, solved murders, recruited into a federal task force, uncovered terror training cells, and traveled internationally working undercover.  All it took was seeing the big picture in what was needed for a good case. 

The skills? Those are the easy things to learn.  That's why I push the big picture so hard with the training I give and the things I write because once you get it, your effectiveness will skyrocket and you can focus on learning the skills that you know you will need, not skills for sake of having skills.

As a side note, I used this concept when getting into forensics more than a decade ago.  It worked out just fine (but that first month of narc work still sucked).

Rate this blog entry:
0
Kicking in the wrong doors
Bitcoin Forensics - The book
 

Comments

No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Guest
Sunday, 19 November 2017
If you'd like to register, please fill in the username, password and name fields.