On Mentoring

Stokh,

One of the issues I've seen…and this is just my opinion…it that mentoring can take a great deal of time for the mentor. That gets worse on sites such as this where there are many posters who simply do not seem to want to do much for themselves, and would rather have someone point the way for them…this makes it much harder. There is a great deal of basic information available on a variety of topics, both on this forum and via other resources, and yet I see many posts that could've been easily addressed had the poster simply done a Google search, or some work on their own.

Keydet89,

Thanks for responding and I agree with you on most parts as I see the same thing you do every day. I see it in every business type, including at my office from the people I work with and interact with everyday and I am sure we have all done something similar at one point in our lives.

But when using that analogy what happens is the people who are hard workers, that do think outside the box, that do the research on their own, that use Google and every other resource, most often times get lumped into the group with all the other non-thinkers, inside box thinkers, take and bake people, students not wanting to do their own work and all the like….

Which is so unfair because what happens to those good people? We all know what happens; when that person’s turn comes to pay it forward there is some hesitation there when it comes to them helping out the next person down the road. The question is in the back of your head, you already know what you’re thinking and asking yourself. It is that line of thinking that makes us so self absorbed and why this generation of kids is the way they are.

I don’t know what type of mentor you were thinking about probably more along the lines of a real protégé which was a little more then I was trying to get across. wink I think just in general to have someone to relate to, ask questions to, to point that person in the right direction, someone to check in with and someone to bounce ideas off of or to see someone else’s line of thinking about the subject matter, a tool, writing a report or whatever else falls within that.

Not so much as even getting together with that person, someone to email back and forth or chat with online or whatever, I believe they call all that e-mentoring or something. I get the whole time thing as I am a mentor to a few people and I don’t have any spare to begin with to do it yet I make the time to do it. I end up doing it no matter what I am doing, in a class, on the job, with someone new, with my staff or whatever else comes along. It’s the good feeling that I helped someone out, which was appreciated and they learned from it that makes me continue to do it.

I am aware of the hesitation, the time, the effort, and the questions like “really does this person have what it takes to do this” or” am I just wasting my time” kind of thinking. I was just pointing out that there are so many of you with a wealth of knowledge that it would be nice to be able to tap into that on a more one to one basis and that in the end it may be well worth all the effort that you put into that individual. Plus what happens to the mentors that need a mentor? idea

In the end it’s a personal choice for everyone and one of the freedoms we have is the freedom of choice.

Thanks for hearing my point of view !

Greetings,

I'd be happy to mentor someone - in person. I spend way too much time at a keyboard as is and adding more keyboard time to mentor someone is a high barrier for me. I've met with a couple local people for lunch and done some mentoring in that manner and it worked well.

-David

Kovar - I figured you would be one to respond like that…

After reading hundreds/thousands of the posts you get to know a little something about each of you. It's to bad your about 2000 miles to far (

As has been pointed out, mentoring can come in two forms. The first being a real mentor/mentee relationship, which is time consuming, but is a commited relationship which produces real results. The second is the "phone a friend" type of relationship where the mentor is only there to answer questions.I have been involved in both forms of mentoring, and have both positive and negative views on both types.

The real mentor relationship is for me the best form. where both parties form a real relationship and the mentor is committed to the development of the other party. The key to success in this is that the person being mentored must be committed to improving themselves and be prepared to put in the hard hours. In many ways a good mentor does not give the right answers, but helps the other party find them themselves. The only drawback (at least from the point of view of the mentor) is that it is a time consuming relationship and emotionally taxing at times. It is also something that cannot be done en mass, and is often a long term commitment.

The "phone a friend" type relationship is certainly a quick solution to get answers, but does not always lead to the creation of lasting relationships, which seems to be crucial for a good mentoring relationship. In our wired world of forums, blogs and e-mails, this has become an almost typical form of "mentoring". The biggest problem for me is that it is often not a quality interaction, and secondly, it is easy for the mentor to become bogged down with requests.

Maybe the solution is to create a "mentors" forum on Forensic Focus, where people who are genuinely interested in mentoring other digital forensic examiners, could be listed, and could be approached to act as a mentor. I am also not talking about a "questions" section, that is one of the roles of the existing forum. I am talking about a kind of online meeting place where mentors could volunteer some time to mentor people that they could form a real mentor/mentee relationship with.

I have been lucky to be both mentee and mentor in my career and it is an extremely fulfilling experience.

But when using that analogy what happens is the people who are hard workers, that do think outside the box, that do the research on their own, that use Google and every other resource, most often times get lumped into the group with all the other non-thinkers, inside box thinkers, take and bake people, students not wanting to do their own work and all the like….

I'd suggest that the people who think outside the box and do their own research end up not needing a mentor in the first place, but maybe someone to simply ask a few questions of.

I don’t know what type of mentor you were thinking about probably more along the lines of a real protégé which was a little more then I was trying to get across. wink I think just in general to have someone to relate to, ask questions to, to point that person in the right direction, someone to check in with and someone to bounce ideas off of or to see someone else’s line of thinking about the subject matter, a tool, writing a report or whatever else falls within that.

I wasn't thinking of any particular type of mentor…I was just basing my opinions off of my experience, is all.

I am aware of the hesitation, the time, the effort, and the questions like “really does this person have what it takes to do this” or” am I just wasting my time” kind of thinking. I was just pointing out that there are so many of you with a wealth of knowledge that it would be nice to be able to tap into that on a more one to one basis and that in the end it may be well worth all the effort that you put into that individual. Plus what happens to the mentors that need a mentor? idea

Well as far as tapping into anything on an individual basis, I've always been accessible via email…

Perhaps the biggest issue that I have with mentoring is that most of my time is billable to clients and most of my cases are time sensitive. As a former university professor, I would love to teach if I could get paid to do it, but my private sector employer has different ideas.

I would suggest, however, that there are a number of resources where you can get practical experience.

First, there are the courses put on by various vendors as well as certain security consultants. These cost money but many of them include practicals, though the practicals are typically mini-cases.

Second, there are at least of couple of downloadable forensic "challenges" which provide you with the opportunity to work on your own time with and image and a set of tasks to perform.

The greatest teacher, however, is (IMHO) your own computer. It should be relatively inexpensive to image, and you have the advantage of knowing what the "suspect" (yourself) did. Armed with that and your favorite forensic toolkit, you can practice your approach to analysis and reporting.

If all that you want is to have a place to go, from time to time, to ask a question I think that you have already found it. These fora contain many such requests and many experienced investigators still find that there are things to learn from your colleagues. I'm not really sure that there is a need for a separate forum for this.

What you will likely find, from time to time, is that questions to which the answers are easily researched are not, often, answered. In USENET newsgroups these questions would commonly be answered with "RTFM".

There are many fine resources out there to address questions like "How can I tell when a USB device was attached" and, often, the answers to those questions have been heavily researched by an individual who, then, publishes that knowledge in a book or paper. It isn't really fair to deprive that individual of the benefits of their work when, for $40, you can buy the textbook and, in the process, make it possible for the author to continue to research important issues in computer forensics.

Interesting to see such divergent views on what mentoring means. Personally, I think it has very little to do with answering technical questions and I'm somewhat surprised to see those issues mentioned in this context. For me, mentoring is much more to do with support, encouragement and guidance - softer aspects of computer forensics work, if you will, related more to personal and career development issues, although no less important for that.

It is something I've thought about as an area we could explore here at Forensic Focus (in a similar vein to that suggested by Jason above) and I'm very keen to hear what other people think.

Jamie

Interesting to see such divergent views on what mentoring means. Personally, I think it has very little to do with answering technical questions and I'm somewhat surprised to see those issues mentioned in this context. For me, mentoring is much more to do with support, encouragement and guidance - softer aspects of computer forensics work, if you will, related more to personal and career development issues, although no less important for that.

It seems to me that much of that is already being done. For the most part, responses to request for help, guidance, assistance, etc., have been informative and collegial. I'm not sure how much more can be done in a format like this for a couple of reasons.

First, if the individual seeking guidance is being paid to render a professional opinion, there is a kind of slippery slope where the "mentor" risks liability for the actions of the "pupil". In most real mentoring situations, there is more of a formal relationship that protects all parties.

Second, I am always reminded of the Peter Steiner New Yorker cartoon of the dog sitting at the workstation connected to the Internet with the caption "On the Internet, no one knows that you are a dog." With all due respect to the members of this forum, there is always the concern that both parties are fully and honestly representing their intentions and abilities, as well as their reasons for asking for help.

These kinds of communications have been subpoenaed as evidence in courts of law including in liability cases. For the most part, they are or should be treated as heresay but there may be situations where they are not and that can be problematic.

For these and other reasons, I think that the issue of mentoring an individual with whom you have no formal relationship and no direct knowledge or familiarity can be problematic.