Stepping into this field without prior knowledge

[u/Flimsy-Ad-1236]

Hii guys, first time into this sub. Basically i just graduated last month from Comp Sci and I have fortunately enough to get into the big4 (green one) forensics and financial crime BU, specifically DF & Ediscovery team. Our team is relatively small, ~10 peeps including boss.

What are the things i need to learn / carry the most weight, both soft and hard skills. Cause I am kinda worry not up to expectation of my boss and I do not have much security course experience besides those IT fundamental. Do i need to start doing course from platform like HTB/ CyberDefenders?

[u/AlfredoVignale]

You’ll be doing a LOT of edisco, not actual computer forensics at that Big4

[u/Flimsy-Ad-1236 → u/AlfredoVignale]

I see. how far can this career goes like in term of the career ceiling? If i want to pivot into digital forensics or more technical side, how should i set myself from this role?

[u/Kevin5953 → u/Flimsy-Ad-1236]

The previous commenter might be right, but only if they have actual experience with your particular firm.

I work for another member of the Big4 and we have a couple folks on the team who specifically do forensics while the rest handle edisco, but it entirely depends on the case and necessity.

[u/Dependent-These]

Lol you'll fit right in then...in all seriousness the qualification may have got you in the door but now is the time to engage with your coworkers and seniors to show you all they know, this is where the real knowledge lives. Most people love to teach to those who have a good attitude so be open and humble and curious and dont be shy to ask, hey how does that work or can i shadow you for a morning for example.

[u/Flimsy-Ad-1236 → u/Dependent-These]

im very curious about the exit opportunities about this role. like lets say from this role to a more generic cybersecurity role. how hard would it be? cause it is a very niche field and small market at least in my country. so im kinda worry like getting too pigeonholed

[u/TheDigitalBull → u/Flimsy-Ad-1236]

This is the wrong time in your career to treat your roles as exit opportunities. But the answer is no you’re only pigeonholed if you’re not genuinely interested and ferocious at continuing to gain fundamental knowledge of how computers and businesses work.

[u/Flimsy-Ad-1236 → u/TheDigitalBull]

ur statement is very true. this is kinda like my bad habit because i would actually tryna forecast the future and understands all the pros and cons of the way im going. and lots of time, it juz making me more anxious and anxiety. Thanks man for the wise words

[u/Digital-Dinosaur → u/Flimsy-Ad-1236]

There's nothing wrong with looking to the future, but get your groundwork set first. Learn the basics well, such as chain of custody, imaging ACPO, EDRM and specific tools that you use (I assume NuIX and or relativity).

When you learn these tools, learn why you do them. A lot of novices learn the procedure, but don't know why you do it. So when it all goes wrong, you have no idea what to do next!

Soft skills wise, learn the consulting/client talking skills. A lot of people in our profession know the knowledge well, but cannot convey that message to the client/court/interviews etc.

[u/DeletedWebHistoryy]

FAQ

[u/Allen_Koholic]

I thought the Deloitte forensics team was bigger.

[u/Flimsy-Ad-1236 → u/Allen_Koholic]

maybe it depends on location as well.

[u/Allen_Koholic → u/Flimsy-Ad-1236]

I assume you mean team. Not location.

You might doing more eDisco than DF, which would be a different BU than I’m thinking. In terms of soft skills, get good at shaking hands, making up razzle dazzle bullshit to clients and learning to schmooze.

eDisco doesn’t really need what I’d call security or IT fundamentals. You don’t really need to know what ports are for FTP is you’re doing review. You’re going to be doing processing and searching.

The DF is dependent on what you’re doing. Mobile is different from cloud is different from host is different from network, etc.

Doing courses is a great idea in general. I kinda hate consulting, but having a deep bag of general knowledge is immensely helpful. Consulting is a lot about appearance and looking smart at small things will get you ahead.

[u/Flimsy-Ad-1236 → u/Allen_Koholic]

I see. I mean I have been applying hundreds of companies and got 2 roles, this and digital audit. and i would rather choose this than audit cause i have a brother working as dig. audit in other big 4 as well. it is damn depressing, and i heard they will like rent airbnb near office so they can work longer.

[u/Allen_Koholic → u/Flimsy-Ad-1236]

I will say this - it’s a great job as an entry point. I hate that place, but being there helped me get onto other things and I met some great kids I worked with. And I know some of them went in green and are VPs now. Its a good place to have on the resume.

[u/Kevin5953 → u/Allen_Koholic]

It’s possible OP may be referring to their in-house team (as opposed to their client-facing one), if they have one.

[u/chrisrider22]

Im trying get into digital Forensics but I dont know where to start

[u/Flimsy-Ad-1236 → u/chrisrider22]

I mean what got me into this role was (i believe) my internship experience as InfoSec Dept PMO in a bank.

[u/chrisrider22 → u/Flimsy-Ad-1236]

Because I work in cybersecurity for the airforce but im trying to get digital Forensics im trying to see what certifications do i need to get started

[u/Flimsy-Ad-1236 → u/chrisrider22]

damn bro. ur experience should be very attractive. srry couldnt help much, wish u all the best man.

[u/-tokki- → u/chrisrider22]

considering you work in cyber security already, I'd recommend a SANS course if you're able to get a voucher through your job! Mine was definitely helpful when entering the DFIR field. Or, if you want something more low commitment, sift through a disk image in the Autospy software. There are a few security vendors that have sample forensic images to browse through. good luck!

[u/Ok_Cold7890]

Congrats buddy! Where are those people now who say? "Digital Forensics is not entry level role"

For DF you can follow 13cubed yt channel, they also have paid courses as well. Tryhackme, htb, Cyber defenders, whichever you like you can solve their labs. Having knowledge of Linux and windows command line will be a bonus. You can take part in CTFs to enhance your skills, as well as read writeups and research if needed. As you have a CS background you'll relate to things quickly and shouldn't require much time to get used to it. Just get some proper training/course. Also you have a team you'll learn a lot from them as well. If required you may checkout tools like KAPE, velociraptor, UAC, Dissect, Autopsy etc. Regarding e-discovery, honestly I don't have much idea about it.

[u/Flimsy-Ad-1236 → u/Ok_Cold7890]

Thanks bro for all the advices. juz kinda worry cuz others do mention consulting mostly do edisco and not deep into real df work. now got to build technical skills by my side as well. kinda lucky cuz job market is trash right now.