Join Us!

Advanced forensics ...
 
Notifications
Clear all

Advanced forensics concepts  

Page 3 / 3
  RSS
jhup
 jhup
(@jhup)
Community Legend

His quote is funny.

I was thinking more on the line of what qualifies someone as an expert witness in court…

We classify people as experts; individuals with more knowledge than laymen on a subject. They are aware and understand "advanced concepts" laymen does not.

That sounds almost like a feed-line from a straight man.

Google for 'Niels Bohr's definition of expert' – an attempt at definition that I find rather refreshing.

ReplyQuote
Posted : 30/10/2013 9:07 pm
joachimm
(@joachimm)
Active Member

From my original post, my interest goes back to what individual forensics practitioners consider advanced concepts.

Then why make the jump to

We consider "advanced forensics concepts" to be technical knowledge which is not readily available and requires validation and experimentation. “Advanced forensics” requires critical thinking to interpret, describe and convey relevance and meaning by itself and in relation to other evidence.

I'm saying what you define here as "advanced forensics concepts" are the essentials of forensics. I repeat
"Forensic science (often known as forensics) is the scientific method of gathering and examining evidence."

So can you be clear on what you are asking here?

You did not answer my questions. Not fair. o

Same here I'll trying to answer your questions as far as I can but if you're not being clear and don't answer my follow up questions. So how am I supposed to answer you questions? I'm trying to get to the core of what you mean with your original question so I'm able to answer it. Alas since the question is so broad and you seem to be adding all kinds of different angles "educating people", "'advanced forensics 'wisdom'", to question, this is a very tedious process.

It very much sounds like you are saying there is no such thing as advanced forensics concepts, but then you turn around and state that we must start with basic concepts. The notion that there are basic concepts implies there are intermediate and advanced concepts.

Again you're misinterpreting me and alas missing a vital nuance here. I'm saying there are no "advanced forensics concepts", because that does not make sense in the definition of forensics and advanced. There are however "advanced concepts" but these will be mostly related to the digital domain.

My "advanced" word choices where not the best, as I stated before.

As you indicate advanced is a poorly chosen term, highly subjective and diverse. But can you tell me what explanation of advanced are you referring to? Maybe use this as a reference http//www.thefreedictionary.com/advanced are you referring to "being ahead in development, knowledge, progress, etc." or "Highly developed or complex." ? I would say this diversity in the terminology makes for two different discussions.

Being at the edge of a knowledge circle (sphere) with expertise in several areas, your perspective as to what is advanced and what is fundamental is different than for someone who is just setting out on forensics.

Also if you want to see the world in circles (spheres) or as binary distinctions, yes there is fundamental knowledge and non-fundamental knowledge. But I don't think this non-fundamental knowledge is always "advanced" (in both terms).

Thinking about fields of knowledge as circles is a limiting thinking model, knowledge nowadays is highly intertwined. The model of the circle over simplifies this.

Also "what is advanced" will vary over the course of your professional career, what "fundamental" is not. That is the core of the point, which alas does not seem to get across. Fundamental knowledge is that type of knowledge that the rest of your understanding will depend. To frame it into your example someone who starts out (assuming an utterly blank person here) does not have fundamental knowledge and will need to learn this knowledge first.

Which you then perfectly address in

Put it in an other way - is it necessary for someone to understand basic addition, subtraction and multiplication first, before tackling ax^2 + bx + c = 0?

So my guess these are largely a mismatches of semantics in our discussion which are taking us nowhere.

From my original post, my interest goes back to what individual forensics practitioners consider advanced concepts.

You might have meant the same but you'd asked for

What do you consider "advanced forensics concepts" within the digital forensics realm?

This also did not show from your 'Data-Information-Knowledge-Wisdom Pyramid' recap.

My request to you is to a bit more explanatory in your initial question, maybe give an example of what you mean. Also explain why you are doing a recap. Hence my question jhup what's the goal of your original question? (which BTW you did not answer 😉 )

Since your question (looks to be a bit more clearer formulated) now and assume by advanced you are referring to "being ahead in development, knowledge, progress, etc."

I would say improving the temporal (as in time) information we can obtain from them, especially in cases where the currently understood time sources do not contain relevant facts.

ReplyQuote
Posted : 31/10/2013 8:05 am
jhup
 jhup
(@jhup)
Community Legend

From my original post, my interest goes back to what individual forensics practitioners consider advanced concepts.

Then why make the jump to

We consider "advanced forensics concepts" to be technical knowledge which is not readily available and requires validation and experimentation. “Advanced forensics” requires critical thinking to interpret, describe and convey relevance and meaning by itself and in relation to other evidence.

It is simply a feedback from the information provided by others both here, and elsewhere to my original question. No jump, but review of the comments others have provided.

I'm saying what you define here as "advanced forensics concepts" are the essentials of forensics. I repeat
"Forensic science (often known as forensics) is the scientific method of gathering and examining evidence."

So can you be clear on what you are asking here?

I continue to disagree that it defines "the essentials of forensics". By who's standards are they "essential"? I have no disagreement with your quote on what forensic science is. What I contend with is the presumption that it is a monolithic pool of knowledge. It is not.

You did not answer my questions. Not fair. o

Same here I'll trying to answer your questions as far as I can but if you're not being clear and don't answer my follow up questions. So how am I supposed to answer you questions? I'm trying to get to the core of what you mean with your original question so I'm able to answer it. Alas since the question is so broad and you seem to be adding all kinds of different angles "educating people", "'advanced forensics 'wisdom'", to question, this is a very tedious process.

The question is still "what do you consider 'advanced forensics concepts' within the digital forensics realm?".

It is asking for individual forensic practitioner's subjective opinion.
It is about concepts used in digital forensics.
It allows the answering practitioner to define for themselves what is, and is not "advanced".

All other material I talked and presented are circumstantial to answer questions, and to elucidate the original question.

. . .There are however "advanced concepts" but these will be mostly related to the digital domain.

Which I clearly indicated in my original question ("within the digital forensics realm").

As you indicate advanced is a poorly chosen term, highly subjective and diverse. But can you tell me what explanation of advanced are you referring to?

I specially left it to self-define by the practitioner ("what do you consider").

Also if you want to see the world in circles (spheres) or as binary distinctions, yes there is fundamental knowledge and non-fundamental knowledge. But I don't think this non-fundamental knowledge is always "advanced" (in both terms).

Thinking about fields of knowledge as circles is a limiting thinking model, knowledge nowadays is highly intertwined. The model of the circle over simplifies this.

It is a model, which I thought was sufficient to express my thought on that specific sub-topic when you asked for explicit definition of "advanced".

Also "what is advanced" will vary over the course of your professional career, what "fundamental" is not. That is the core of the point, which alas does not seem to get across. Fundamental knowledge is that type of knowledge that the rest of your understanding will depend. To frame it into your example someone who starts out (assuming an utterly blank person here) does not have fundamental knowledge and will need to learn this knowledge first.

And, I keep pointing back to my original post. It is to be defined by the responder.

Which you then perfectly address in

Put it in an other way - is it necessary for someone to understand basic addition, subtraction and multiplication first, before tackling ax^2 + bx + c = 0?

So my guess these are largely a mismatches of semantics in our discussion which are taking us nowhere.

That response was to refute your statement that there is no distinction between "advanced forensics" and simply "forensics".

From my original post, my interest goes back to what individual forensics practitioners consider advanced concepts.

You might have meant the same but you'd asked for

What do you consider "advanced forensics concepts" within the digital forensics realm?

This also did not show from your 'Data-Information-Knowledge-Wisdom Pyramid' recap.

The DIKW model example was to refute again that there is no such thing as "advanced". It is not the core of the question.

My request to you is to a bit more explanatory in your initial question, maybe give an example of what you mean. Also explain why you are doing a recap. Hence my question jhup what's the goal of your original question? (which BTW you did not answer 😉 )

It was answered

I search for the framework for instructional purposes.

To further elucidate with an example, if you have two books front of you on digital forensics, one of them will be more advanced than the other. How do you determine which is more advanced?

Since your question (looks to be a bit more clearer formulated) now and assume by advanced you are referring to "being ahead in development, knowledge, progress, etc."

I would say improving the temporal (as in time) information we can obtain from them, especially in cases where the currently understood time sources do not contain relevant facts.

Thank you.

I believe what you were looking for is more definitions to the words within my question. The point of the question was not to force the responder into a very stringent box (specificity is a curse of our field), but to provide a wide channel. However uncomfortable this is, I wanted the question loosely defined.

ReplyQuote
Posted : 31/10/2013 4:54 pm
jhup
 jhup
(@jhup)
Community Legend

Isn't "advanced" or "intermediate" really dependent on the aptitude, drive, and experience required to master the topic? That is where I was going, albeit not clearly, in my post.

Would this answer define "advanced" practitioner more rather than "concepts" themselves? I would like to narrow it to concepts only. Can you rephrase your thought to target concepts?

ReplyQuote
Posted : 31/10/2013 4:56 pm
jhup
 jhup
(@jhup)
Community Legend

. . .
But here we are not talking of expert vs. intermediate vs. beginner (as people), we are talking about the topics, we could draw a line saying that anything that is known, documented and taught in college is "basic", that anything that is fully documented and verified and part of an established procedure (or taught in the various post graduate or vendor courses) is "intermediate" and anything that is not obvious or a simple derivative of known approaches, procedures and documented (and verified) theories is "advanced".

Then maybe we could change the term from "advanced" to "innovative" or anyway use this latter as a synonym.

jaclaz

P.S. Ooops, cross-posting with Jhup

I like the word "innovative", and how you defined "advanced" - anything that is not obvious or a simple derivative of known approaches, procedures and documented (and verified) theories is "advanced" - specially the "not simple derivative on known".

ReplyQuote
Posted : 31/10/2013 4:59 pm
jhup
 jhup
(@jhup)
Community Legend

I believe I got my answer, and we burned it to the ground in the process.

joachimm and others, I appreciate the ability to have a good debate. Thank you.

ReplyQuote
Posted : 31/10/2013 5:02 pm
joachimm
(@joachimm)
Active Member

I believe I got my answer, and we burned it to the ground in the process.

joachimm and others, I appreciate the ability to have a good debate. Thank you.

Noprob. Thank you too. At least let me give you some answers on your last questions, but I'll try no more follow up questions 😉

The question is still "what do you consider 'advanced forensics concepts' within the digital forensics realm?".

Then my answer remains there are no advanced forensics concepts 😉 So we agree to disagree. But maybe the following answers give you some insight into why.

I believe what you were looking for is more definitions to the words within my question.

As I said mismatches of semantics in our discussion are taking us nowhere. I like clarity, details, not vaguely talking about vague concepts.

To further elucidate with an example, if you have two books front of you on digital forensics, one of them will be more advanced than the other. How do you determine which is more advanced?

Not. It does not matter to me which is one is more advanced. The one that provides me with the most insights is the one I value most and this does have to be a book on digital forensics at all. I'll be reading "Building Machine Learning Systems with Python", "Windows Internals" maybe a book on Rhetoric instead.

Why? Because I think it can help me gain new insights where these books discussing tools and artifacts no longer do. So roughly for me there is no distinction between basic and advanced (as in complex) anymore. Some very basic things can be very complex.

The point of the question was not to force the responder into a very stringent box (specificity is a curse of our field), but to provide a wide channel. However uncomfortable this is, I wanted the question loosely defined.

I search for the framework for instructional purposes.

I can recommend phrasing the question different next time e.g.
If you were to teach a workshop/class to experienced forensic practitioners what would you teach them and why?

(Still slipped in a question here 😉

I'll leave with a quote attributed to Albert Einstein "The only thing that interferes with my learning is my education."

ReplyQuote
Posted : 31/10/2013 11:43 pm
Page 3 / 3
Share: