Digital Forensics | Mobile Forensics | Expert Witness | Adjunct Professor | Former FBI Senior Forensic Examiner
YOU. HAVE. TO. KNOW. HOW. YOUR. TOOLS. WORK. Whoever you are. Whatever you do. You have to know how your tools work. For example, I've been trying to reduce my phone time, so I got an app for that. After a mad dash run to the airport to swap rental car (flat tire 😡 😭 ), I got a pop-up for using my phone for two hours straight. What the heck? I took a look at the app (my tool in this case), and even though my phone screen was off, it was still measuring the time the apps were running; I had the GPS and an Audiobook going at the same time. I checked the stats, and sure enough, there it was. I learned my tool tracks time even if the screen is OFF. Do I get a new tool or just account for that? If I'm constantly using the GPS and listing to books it's not the best tool for me. I'm saying all of this to demonstrate to you how not knowing how your tool works can easily give you the wrong answer. That's why push button forensics will never cut it. NEVER. Yes, leverage automation to filter through the data. But we still have to know the HOW and the WHY that piece of data was presented by the tool. Then, we must be prepared to stand up in court and state the how, the why, and the significance. It's not a sprint. It's a marathon. #DigitalForensics #Forensicator #MobileForensics #DFIR
Agreed. its incredibly important to know the limitations, expectations and primary function of each tool. If you do not grasp then you are not ready to use this tool! I experience this first hand in Product management, on gauging deployment criteria.
Matthew Harris
8mo
Not to mention fewer keystrokes and clicks!
Gen X Over 45 UGC Content creator | Social Media Marketing | UGC Management
8moStacy, you nailed it! Knowing the ins and outs of our tools is crucial, especially in our line of work. Your story about the app tracking time even with the screen off is a perfect example. It's all about understanding the nuances to avoid getting tripped up. Thanks for the reminder!