Hello everybody. I would just like to thank you all for all the knowledge I have been able to gather both through the forums and the forensic focus website.
My question here is how important is a degree in forensics in order to obtain a career in forensics. I have 4 years of experience working desktop administration and am nearly finished with my degree in Information Security. I am still trying to find my direction within security, but have recently been very interested in forensics. Would a degree in security and the proper certs be sufficient to get a job doing computer forensics or is it absolutely neccessary to get an actual forensics degree.
If it is absolutely necessary to get a degree then where would you recommend. I currently live in a location that does not have any forensics schools nearby so I am limited to online classes. I also would like to keep it as cheap as possible. Past that I am open to suggestions.
Thanks in advance for all your help.
Considering what education costs these days, unless you have limited means, I would try, instead, to get work at a firm where you could learn forensics as part of a team.
Or, you could shell out $5K and get certified in EnCase or become a CFE and get the training that you need for a fraction of the cost of a degree.
Computer forensics degree programs in the US are, at this point, an unknown entity. While there exists certification and accreditation programs for many academic disciplines, including those in forensics, digital forensics lacks such a process. Without a standard curriculum, a method for credentialling teachers, etc., how do you know what you are getting and whether it has value in the market place?
This is just my humble opinion but at this point, I'd go for something that will get you some hands-on experience before I'd recommend going back to school.
A few years back I sat in a room with a small group of other forensics guys and listened to a presentation from an academic from a respected university on computer forensics. Over half of us had over 5 years in the field, some of us had over 10.
At the end of this academic's presentation, I asked the question that was surely on everyone's mind "How much practical experience in computer forensics do you have?" The answer was that he had none, he had only done research. Frankly it showed in what he had presented.
Now I'm sure that there are SOME fine courses out there, but digital forensics seems to be FOTM with many educational institutions right now and I really wonder about the value of these courses. A while back I did look at the content of a few degree courses, and they mostly seems like InfoSec courses where they tacked on a couple of classes on IR, some basic evidence handling but not much else.
I'd really have to agree with Sean. Get an entry level position where you actually do forensics. Get some experience, then look for a good cert from people that actually do forensics on a day to day basis - CFCE if you're in LE (or if we ever open it up to the public) or CCE if you're in private.
I know that there are some of us that are against certs, but if you look at what's going on in Congress right now regarding forensic evidence, it's becoming apparent that a cert will become necessary if you like it or not.
My question here is how important is a degree in forensics in order to obtain a career in forensics. I have 4 years of experience working desktop administration and am nearly finished with my degree in Information Security. I am still trying to find my direction within security, but have recently been very interested in forensics. Would a degree in security and the proper certs be sufficient to get a job doing computer forensics or is it absolutely necessary to get an actual forensics degree.
Interesting question. What are "proper certs"? I know a number of individuals that perform IR/DF work that have NO certifications, and they do a much better and more complete job of everything involved (scoping, triage, analysis, reporting) than folks I know who have several certs.
I think what it comes down to is the individual….what they retain, what they use, etc. No amount of classroom time will change this…but again, it's up to the individual.
If it is absolutely necessary to get a degree then where would you recommend. I currently live in a location that does not have any forensics schools nearby so I am limited to online classes. I also would like to keep it as cheap as possible. Past that I am open to suggestions.
I don't think that its absolutely necessary to get a degree…there are plenty of us who don't have degrees in forensics (computer or forensics in general) who perform these functions on a daily basis.
Having conducted two rounds of hiring at my former employer, I would suggest that demonstrating an ability to do the work is more important than a degree in computer forensics. One of those things that I found off-putting during this process was the need of so many applicants to sit in a classroom in order to obtain training. If you're working for a consulting firm, and need to take 5 days out to go sit in a classroom in order to learn something, then that's 5 days you're not available to do billable work. So when I looked at applicants, one of the things I was looking for was the ability to demonstrate that they could conduct an analysis, cradle to grave…and that's not necessarily something I've seen offered in courses.
Thank you all for your input. It is encouraging to hear from people in the field that the degree isn't everything. It sounds like there may definitely a place for me with my current credentials if I can just build my personal skillset. I agree completely with you, keydet, on your comment about the classroom. I am currently working at a government facility and company sponsored training (or even getting time off for training) is rare at best. I get a large chunk of my knowledge from experimenting and researching on my own in the evenings.
Once again, thank you for the input and I look forward to learning more and more each day from this forum.
..a degree is not everything. You are about to receive a degree - so you already have a foundation. The forensic education field is still only making baby-step progress and thus far from fully developed.
When I started out with computers many years ago, I was self-taught.. and I was able to get a job because I was able to demonstrate my skills; many people who hold a degree (or, in this day and age, several) show that they may be education junkies who have the theoretical aspects down pat but have very limited practical knowledge. The ideal candidate should possess a mix of both education and experience.
In terms of credibility, it's unfortunate that most often greater emphasis is placed on the educational aspect rather than the hands-on experience… I would suggest that the degree you're about to get will serve you well - if you feel the need for further education, look at certifications that will enhance your knowledge and complement your degree. There are quite a few grad certificates available that will provide you with more knowledge in the area of digital forensics; of course there are also certs (already mentioned) that will also complement your degree… (my undergrad, e.g., is in Information Networking and Telecommunications (Computer Networking with an emphasis in Telecommunications - also not in forensics per say but knowing computer architecture and how information is relayed between systems is an integral part of conducting certain investigations…)
..why not pick up some good books and start dabbling with the information in the books to build your experience, rather than looking at obtaining another degree?
It is encouraging to hear from people in the field that the degree isn't everything. It sounds like there may definitely a place for me with my current credentials if I can just build my personal skillset
+1 - you had the good sense to conduct some basic research and ask the right question.
-1 - you are near completion of an undergraduate degree in information security which should have equipped you with the reasoning skills to understand a degree in the subject area of digital forensics is not necessary given these degrees are a relatively recent creation by academic institutions.
+1 you rightly asked whether at this point certifications or experience counts more in the practice of forensics; obviously experience reigns although certification(s) can be helpful or mandatory to gain an entry-level position.
+1 you recognized the importance of developing one's skills; certifications can assist in this undertaking but aptitude is important too; your work experience indicates your interest in information technology in general.
As you approach graduation begin researching positions which will help you build more experience. Network administration is a good ground-level position that will expose you to security-related concepts and practices. I recommend you develop basic programming skills, if you have not done so already, and familiarize yourself with the operating systems Microsoft Windows, GNU/Linux, and Mac OSX. After a couple of years you should have the real world experience to move into an entry-level digital forensic position and maybe have earned a certification along the way. Good luck on your journey. )