Are we gullible or just naive?

Heh yeah I just read that this morning.

So now I need to work on my signature/disclaimer. Where's my lawyer.

Paul you didn't get the memo?? And what's this that I hear your having problems with the cover pages of your TPS reports?

http//services.martindale.com/products-liability-law/article_Larkin-Hoffman-Daly-Lindgren-Ltd_919918.htm

It reminds me of this student here in Dublin last year - http//www.guardian.co.uk/commentisfree/2009/may/04/journalism-obituaries-shane-fitzgerald

It reminds me of this student here in Dublin last year - http//www.guardian.co.uk/commentisfree/2009/may/04/journalism-obituaries-shane-fitzgerald

Ian that is excellent - I wish I had known of it when I wrote the article.

Perhaps you would be so kind as to post a link to it as a reply to my blog -I would do it myself but I dont just want to go posting something I have read an some random forum without verifying it )

Such good advice was once summed up as "use some common sense".
Unfortunately it seems like this particular sense is mostly UNcommon. roll

jaclaz

We are in a scientific field and it requires a process.

That sounds like an admirable place to start – are we really? Or is that, too, something we are content to regurgitate? Wanting to be in scientific field, or being required to be in one, is not the same as actually being in one.

However, the receiver of the advice should take it as is - advice on a forum. Yes test what you are told. Then re-test. And ask yourself - wait why I didn’t think to try that myself first? Why didn’t I test with other tools and/or methods?

But … doesn't that advice also apply to the giver of the advice as well? That is, he/she should refer to published, peer-reviewed results.
And where are they, by the way?

Perhaps that's the way include source references with (important) advice. Cite a Microsoft KB article, or Windows Internal 5 or whatever.

Remember, though Research and application are different research should deliver results that are firm enough that they can be applied without further ado. Repeating research and coming to the same conclusion, and publishing the same results is nothing but a waste of time from a scientific point of view at least the new research must look at some new aspect to be worthwhile. But that requires publication – or noone knows what the state of the art is.

Still … most people are paid to apply other's research, results to the cases at hand. Or, ina pinch, to do research themselves. But very few are paid to write up that research and publish it – there's the new case waiting to be done.

Personally, though, I'm beginning to think this field isn't a scientific field. Many of the same skills are required analytical and critical thinking, impartiality, and so on. But to a very large degree, the information we look for is known – just not generally. Any research on Windows, for example, does not produce new knowledge only knowledge that Microsoft hasn't published. And when Microsoft does publish, much of the present research is (or should be) thrashed.

And this, I think, places the field a few rungs below 'science'. The field is much more closely related to intelligence. That field too calls for similar skills – but, that too tries to reveal what someone deliberately or not chooses to hide from public view. And … more important, intelligence is largely done behind locked doors – you don't want anyone know that you know. Particularly not anyone who can use it against us.

Don't take that too literally or seriously – but I think it is partially true, at least as far as the current state of art is concerned.

Having an independent source repeat research to determine the same result is not a waste of time at all. It's at the very heart of peer review, which is what differentiates proper scientific research from junk science. See for example published research on cold fusion and the failure to replicate.

Reproducibility of results is a core requirement of forensic sciences, and that includes computer forensics. Failure to meet this standard would preclude the presentation of expert testimony by virtue of a Daubert challenge, or equivalent voir dire under non-US legal systems.

Darn - Tony got to the Daubert challenge point before I did )

http//en.wikipedia.org/wiki/Daubert_standard

And no, Wikipedia is not a 100% source and but does ad irony to the thread.

It just does have some points well stated
Scientific knowledge = scientific method/methodology A conclusion will qualify as scientific knowledge if the proponent can demonstrate that it is the product of sound "scientific methodology"/derived from the scientific method.[

And…
* Factors relevant The Court defined "scientific methodology" as the process of formulating hypotheses and then conducting experiments to prove or falsify the hypothesis, and provided a nondispositive, nonexclusive, "flexible" test for establishing its "validity"

1. Empirical testing the theory or technique must be falsifiable, refutable, and testable.
2. Subjected to peer review and publication.
3. Known or potential error rate.
4. The existence and maintenance of standards and controls concerning its operation.
5. Degree to which the theory and technique is generally accepted by a relevant scientific community.

I have been saying this for years and in my posts.

People come to a forum with a one post count taking on a case (which a lot of times they are getting paid for or have someone's life in their hands) and doesn't know the answer to a question or a basic one at that.

They get an answer from someone online and maybe they say thanks, maybe we never hear from them. I know 100% that I worked a case against someone who didn't know the answer to a question and posted online at the "other" forum (not DD) and then took the answer they received and then put the data they received in an affidavit. It was said they checked the data, but a simple set of 3 screen shots showed that there is no way he could have checked anything.

We see inadequately prepared examiners every single day come into forums and ask questions and not ever contribute to the community, but more importantly back to the topic, they don't check things out. Most people who have been able to make a living at this have a few different workstations set up with drive images they can swap out to set up and recreate circumstances which they encounter.

People run into problems when they can't afford to have multiple machines or multiple dongles and then they take the easy way out to post to a forum for the answer. Too hard to pull out a hard drive and put windows back on as well as all the updates, etc. so I will just go to a forum and ask there, I mean there are knowledgeable people there right? they wouldn't steer me wrong?

It does have to get back to science and get away from "just because Jim said so"

How many times does someone post a question where the first reply is
"Google is your friend" If you came up with that answer within 10 seconds, what quality of work is the poster providing, and more importantly WHY ARE WE HELPING FOSTER THAT TYPE OF ATTITUDE

Every time someone comes on here and posts a question where the answer is within the first few hits of Google, why does anyone respond? Won't the herd thin itself out if no one answers and they have to actually do some investigative work on their own?

Paul Sanderson of Sanderson Forensics in the UK has a post calling many of us out here and on other forums, social media, etc. about the ease and acceptability of regurgitated advice without proper care given to the truth behind such information. And he is right.

http//www.sandersonforensics.com/forum/entry.php?11-Are-we-gullible-or-just-naive

How many times do many of us rehash (topical pun can be added here) the same stuff. "Well I heard/read that X+Y=Z so it must be true." But if X is 4 and Y is 6 Z cannot be 13. We are in a scientific field and it requires a process.

I think many are well meaning and it is addictive to be the first to answer a question. However, the receiver of the advice should take it as is - advice on a forum. Yes test what you are told. Then re-test. And ask yourself - wait why I didn’t think to try that myself first? Why didn’t I test with other tools and/or methods?

Confidence in ones skill set will never be built on the advice from others. You have to go out there and cross your own hurdles. Forensics is a mindset and no tool can replace your brain.