Authors: Josh Hickman (Kroll)
DFRWS USA 2020
Abstract
The digital forensics body of knowledge is vast, covering a wide range of topics with contributions coming from a number of sources. Every day new artifacts, scripts, investigative techniques, and raw data are discovered by examiners and researchers, but sometimes these new discoveries are not shared with the digital forensics community for various reasons. Practitioners can face a number of obstacles that prevent them from sharing information they have discovered. Because of this, vital information could be missing from the body of knowledge which could be beneficial to other examiners and could have societal implications. This presentation will cover some of the common obstacles in sharing information, including lack of time and/or resources, perceived minimal skill level, “imposter syndrome,” and employer prohibitors. It will also provide some mechanisms and suggestions to overcome these obstacles such as DFIR Twitter, blogging, DFIR Review, and leaning on other researchers in the digital forensics community to effectively share and contribute to the digital forensics body of knowledge.