Hi,
I have been hanging around the fringes of this forum and field for a couple of years now. I am very interested in making Cf a second career for myself, however, I am totally blind, and I have had several people including the head of a university CF master's program and a CFE working for our local police department tell me that since a lot of CF deals with reviewing pictures/videos on a computer that it would not be a good fit for me.
Is there enough demand for "simple" EDiscovery and/or data recovery that I could make it a viable option?
Are there other angles I should pursue?
Any thoughts would be appreciated.
Police work will have varying proportions of pictures and video files to review, that's true. Corporate forensics doesn't so much at all, though you may find on occasion that scanned documents on a PC/server need review.
If you're comfortable using the forensic apps which are available and interpreting the results from these and you have a suitable workload then I see no reason why CF or E-discovery wouldn't be viable career option for you. I'd be interested to hear other opinions on this though.
Good luck.
Another issue you may have to contend with is the speed at which you will be able to process the evidence. This could be an issue if you charge or are paid by the hour.
You might consider a per/Gigabyte charge instead, IF you find that you are slower than the average examiner.
If you're comfortable using the forensic apps which are available and interpreting the results from these
I suppose that raises the question of how accessible these apps are for anyone who is visually impaired. I'd be interested to learn of any research or testing in this area.
Jamie
I am also curious as to how you "view" the results of programs.
Data recovery could be an area that you could do as from what I understand in a lot of cases running standard programs recovers the data anyway.
Another issue you may have to contend with is the speed at which you will be able to process the evidence. This could be an issue if you charge or are paid by the hour.
You might consider a per/Gigabyte charge instead, IF you find that you are slower than the average examiner.
I think that's true of any CF examiner! Some I've worked with are glacially slow.
Another issue you may have to contend with is the speed at which you will be able to process the evidence. This could be an issue if you charge or are paid by the hour.
You might consider a per/Gigabyte charge instead, IF you find that you are slower than the average examiner.
I think that's true of any CF examiner! Some I've worked with are glacially slow.
Well that depends on what "slow" is -)
I had to try to recover an email from a system where the web-based email client just closed in the middle of the user's writing the email.
I imaged the drive used TSK and ran fls ils mactime and blkls then I ran strings (all on a ubuntu-based laptop).
I found traces of the letter in the swap file and was with a little bit of fancy work with VI extract the letter and sent it to the user all tolled it took about 4 hours ( the drive was a 60gb drive, and the computer I was using to do the imaging etc was a dualcore dell laptop that is about 4 years old.
Also had to keep going back to the internet to see how to accomplish the tasks (this was my first venture into an actual data recovery situation, and I had to figure out how to use the tools).
It helped that the user was my wife so she wasn't too demanding on getting the letter back quickly just getting it back -)