Sam,
I think the main difference is the public nature of posting on forums. If you read from a book or an article online then there is no public record of that ever happening. Post a question here and it is easily found with a simple Googling.
I think the main problem with people asking fundamental questions on here is that they will take what is said as gospel and not go away and independently determine if what they have been told is accurate.
I have a scenario in my head that goes something like this
Lawyer Mr Smith as a computer forensic expert can you tell the court how you interpreted the INFO2 file on this exhibit?
Mr Smith Certainly, (goes on to explain)
Lawyer Mr Smith, on February 17 2010 you posted a question on FF regarding this matter, was that relating to this case?
Mr Smith It was.
Lawyer And the question was answered to your satisfaction?
Mr Smith It was.
Lawyer And what processes did you use in order to determine that the answer was correct?
Mr Smith Sorry?
Lawyer I assume you tested this for yourself and came to the same conclusions as the person that posted the answer?
Mr Smith …
At which point his credibility as an expert witness is gone.
This is only a short example but you can guarantee if there is public record of someone asking one of these 'simple' questions I will try to exploit it. If people want to be spoon-fed answers then they are in for a rude awakening.
It's an old adage that "there is no such thing as a stupid question". One which I must admit that I occasionaly wonder about the truth of, but none the less, it stands I think. What may come accross as a stupid question could be someone wanting to make damn sure, because of the gravity of their case, that they have their facts right or possibly wondering what on earth is going on because what they thought to be true _isn't_ what is exibiting on the system that they are currently looking at …
Not my field specifically, but I know that I've looked at security systems, and gone to my colleagues to ask what might on the surface seem dumb, but is to reassure myself that I'm not insane when the reality differs. A sanity check if you will - and I think that we all have moments like that ! One of the nice things about FF is that you tend to get an inteligent response within a few minutes - so for a freelancer this may be their sanity check and I don't think that we can really criticise that.
Unfortunately, even though it is the main form of communication now, people often don't take enough time to re-read what they post - I'm as guilty of it as others - and this can often lead to misrepresentation of the true nature of the request, along with poor spelling (again my hipocracy knows no bounds !), punctuation and capitalisation ( or to be fair people for whom English isn't a first language ) often gives an impression of lack of professionalism which isn't justified.
Returning to the ethical question and any possible solution - I think that the profession ( both forensics and security ) should be leading us to seek context and thus from both sides of the question "a little knowledge is a dangerous thing" and to slander another professional could be an issue ! The long term solution, as mentioned above, is regulation and certification - however even then, as with other things - there will always be those who are certified whom are not as good as their peers or those who aren't certified.
The idea of using a forum as ammunition against an opposing examiner is, at least dishonorable, if not unethical. And, to roll out my last saying of the day "People who live in glass houses, shouldn't throw stones"
[EDIT] - Because DFICSI got in just before me, please this isn't an attack ! Just an unfortunate timing event !
I do have to agree though that pretty much any information needs to be confirmed irregardless of source … And failure to do so deserves a kicking.
Let's say that I face an opposing expert in a case and, while researching the opposing person (as I do in EVERY situation) I find that they have posted a basic query to Forensic Focus or Digital Detective what am I likely to do next? Even worse, what if that question related directly to the case being contested?
You need to specify please - what exactly is it you do when you find someone you're up against has asked a question in the past that you decide is basic?
It's interesting that you yourself post here anonymously.
Jonathan, I couldn't agree more!
In fact DFICSI (or I suspect that should be Lee?!), I believe you asked (from my perspective) a rather basic question about the MFT over on digital detective rather recently, the crux of which was that you had not accounted for the update sequence array. This, to me, is basic knowledge, and part of several academic courses' foundation modules.
However, I appreciate that it is impossible for any single person to know everything about a field that is as diverse as forensic computing. This is something that people seem to struggle to accept.
Working in a 'sausage factory' environment, I personally find these forums most useful purely because they are a convenient and quick reference; within minutes of asking a question, a poster can have their answer. This is far more convenient than trawling through several textbooks. I don't consider this laziness, it just makes sense especially if you subscribe tot he old slogan that 'time is money'.
There is a key difference between knowledge, understanding, analysis etc. (anyone interested should go read about Bloom's taxonomy) The point here is that whilst we cannot know everything, it is perfectly possible, and acceptable, to come across new knowledge and understand, and even apply it, without the need to know and remember it.
Kind regards
Ben
This is only a short example but you can guarantee if there is public record of someone asking one of these 'simple' questions I will try to exploit it.
No, sorry, and sorry for my language but that's what one of my old friends would call a bit of a "wanker's trick". It's not a forensic specialist's role to exploit another forensic specialist's learning. If you have an issue with someone's report or technique isn't it better to raise this pre-trial with them directly rather than get your brief to roast them on the stand? If you're good at your job you can persuade them to remove/amend the contentious part of their report. Result is that the other side is wiser and wouldn't try that again, you remain on good terms and you get the same end result as if you'd 'exploited' them on the stand
Ben
Absolutely. It is only with knowledge that you realise what you don't know! My personal view is that you will never know everything about a particular area (in fact, CF is so vast you'll only be able to scratch the surface).
It is knowing what you don't know but can find out - research and problem solving are the key skills.
There is also that underused phrase of "I don't know"……..
Kind regards
Sam Raincock
Ben and Jonathan,
I, by no means post anonymously. Look at my signature for one. I've also posted my Twitter username for people to follow. I've even signed off with my own name before! Anonymous? Absolutely not.
But… Fair point! I've been stung. But if I were asked I could honestly say that it was not for casework, it was for programming software. Yes, I momentarily forgot. I see your point but…
My point still stands is that people ask questions and then blindly go away believing what they've been told without any testing.
Working in a sausage factory environment is no excuse! If you hear something from someone, whether it be a colleague or on a forum, you need to confirm it. This is a fundamental part of our field as a forensic discipline.
I don't, for a single second, believe that I know everything about this field. The truth is I always say the more I learn, the less I know. But I still face-palm at some of the questions that get asked on forums and list servs on a regular basis.
As far as I see it if you post ANYTHING on the internet it is fair game. You put it up, you will eventually need to find a way to defend it whether its your Facebook photos, blog posts, or questions.
DFICSI
Within your example, if the expert has got it wrong then you should highlight why their opinions are incorrect, and indeed as Jonathan states, this really should be occurring in expert meetings and not on the stand. That way you'd go for a revised report or a joint statement about the points that were previously in contention.
I don't see why it would be necessary to use the forum post - they are either correct and you agree with them or you disagree and need to resolve the issue. Attempting to discredit another expert does nothing in assist in the justice process. My view is that it's all about putting the correct evidence before the court and leaving the personalities at home!
Kind regards
Sam Raincock
Sam,
But how does he know it is the correct evidence if he hasn't tested it for him/herself?
My point still stands is that people ask questions and then blindly go away believing what they've been told without any testing.
I don't disagree with you there, and I think you would be hard pushed to find anyone that actually would disagree with you!
Working in a sausage factory environment is no excuse! If you hear something from someone, whether it be a colleague or on a forum, you need to confirm it. This is a fundamental part of our field as a forensic discipline.
I am not using the sausage factory nature of the work as an excuse, merely highlighting that time is often very tight. Indeed, from my perspective, a post on a forum such as FF or DD may well be the very confirming step you are saying people do not take. From my own perspective, if I think I know something, I may want to just check I am not barking up the wrong tree, and a one-liner question followed by a quick answer form one of the myriad of helpful forum users will do just that!
The convenience and efficiency of a forum generated answer should not be underestimated, nor should it be confused for laziness without reason. There is a phrase I am particularly fond of, which summarises sausage factory forensics (and other walks of life for that matter) rather well 'Work smarter, not harder'.
I also (partially) agree with various posters, whose collective points have been to complain about people not bothering to do research. But often the reply berating such a poster has no basis to assume that the original poster has been lazy at all. We place a high premium in this field on not over-reaching and not drawing unsupportable conclusions, but far too many of the 'angry reply mob' have assumed far more about work ethic than was in evidence from the original post in the first place!
To these people I ask why bother even replying, why waste your (supposedly) valuable time venting? If you have nothing nice to say, don't say anything at all!
Kind regards
Ben
Azrael,
How dare you! 😉