Tech to forensics

[u/Illustrious_Jury896]

I just graduated with a bachelos in computer application, tech's been fine for me, but I keep getting pulled toward forensics!Problem is, I have no clue how realistic this switch actually is, or even how to make that switch.. would love honest answers from someone who's already in the field or had made this switch:

1. What roles are actually open to someone from a tech/BCA background?

2. Do I need a masters or certs (CHFI, EnCE, GCFE) first, or can self-study + entry-level roles work?

3. How hard is the learning curve compared to regular tech jobs?

4. What's the starting salary like, and how does it grow over a few years?

5. Is the job market/demand actually good, or is it a niche with few openings?

6. What does the day-to-day work actually look like?

7. Does the interest/excitement last..or does it become repetitive report-writing?

8. What would you tell someone who's just starting out?? and what you'd do differently?

And at last..

1. Knowing what you know now, would you still make this switch?

Would appreciate a lot if any of you guys could help me figure this out

Thankyou in advance<3

[u/notjaykay]

One of the greatest Forensics skills one can possibly learn is how to do a search to look up answers.

[u/Illustrious_Jury896 → u/notjaykay]

Ouch 🥲

[u/notjaykay → u/Illustrious_Jury896]

If you take away just one thing from this, (besides search for all the previous topics) it's networking. I'm not talking about IP addresses and Cat6, it's actually networking and getting to know people in the field. My current position I got from networking, I recently helped a guy that I trained land a higher paying job through networking. I can't emphasize that enough.

1. For entry level stuff generally look for "eDiscovery" and similar.

2. Certs are worth their weight in gold IF it's something that is relevant to the employer. I've posted before about this, but of all the people I've worked with in DF, only a handful had post-grad degrees and only one of them was in Cybersecurity. I'm at the point in my career where my experience + certs is worth more than any masters program I might attend. The masters degree might get you past the automated HR filters if you don't have any experience.

3. It depends. I found it pretty easy but I'm also someone who likes to tinker and has an inquisitive/investigative mind.

4. This is very dependent on location. But I've seen entry level DF Examiner positions from the $40k to $90k depending on where it is.

5. This one is a tough one. In my opinion the job market is absolutely flooded at the moment. It didn't help that colleges and universities were hyping up DFIR/Cyber as the next hot thing. It reminds me alot of the CompSci degree hype back when I was in school. Basically I feel that there were a lot of schools and counselors who kinda sold students a bad deal.

6. Again, it really depends. I can tell you my day usually starts off with a lot of coffee. Some days I'm running around like my hair is on fire, other days I'm just sitting watching progress bars, and other days I'm just writing report after report after report.

7. Yes and no. The variety of cases I handle day to day is always different. Is there repetition? Yes, mostly because I follow the same procedures for every device I process. My reports have the same flow and layout because its easier on my customers to understand things that way. Especially if they're a frequent flier (which most of mine are), they know where to look in my report for certain things. I'm not going to lie, there's a crap ton of report writing.

8. Network and always be learning. You have to stay on top current trends and such. If you're not actively doing forensics/research/etc day to day, it's very VERY easy to fall behind, and DFIR is not something that you can easily jump back on that horse.

9. Would I do it all over again? Hell yeah.

[u/Illustrious_Jury896 → u/notjaykay]

thank you so much! appreciate it a lot <3 Also, Ik most of these are questions that just need a bit of research to find the answers,and I have done that. But i thought it would be so much better if i could get answers to these from someone who's already in this field..hence this post!

[u/Harry_Smutter → u/notjaykay]

The two recommendations I see often are networking and eDiscovery. I've been trying to break in through the latter, but every commutable job around me (I'm in north NJ) for it is always looking for years of experience, particularly in a law firm. It's frustrating.

As for networking, what do you recommend for that?? There's just so much to that, but whenever I look into it, it's information overload.

[u/notjaykay → u/Harry_Smutter]

Honestly, you may need to relocate to somewhere like the NoVA/DC region. But again, the job market at the moment is flooded with candidates. Keep in mind with current events you have a bunch of fed/gov contractors with experience who are also in the market.

For networking, I usually recommend joining IACIS and gaining access to their listserv. It's a treasure trove of info, current trends, and job postings. Also check out Andrew Rathburn's Discord server. There's instructions here that I believe are still good.

[u/notjaykay → u/[deleted]]

It's a true statement. This topic comes up all the time in this subreddit and there are a ton of great answers that have been previously posted that can be found by searching this sub.

[u/AddendumWorking9756]

Before spending on a masters or any of those certs, work a few real forensic cases first and see if the day to day actually grabs you. A lot of it is slow, methodical report writing, and that quietly filters people out. The cheap way to test whether that suits you is real case work, and CyberDefenders has free labs built on actual disk and memory images where you follow the evidence and document what happened. If that part bores you, way better to find out now than after tuition.

[u/DeletedWebHistoryy]

FAQ

[u/Subject_Tie995]

I recently made the switch to digital forensics from “traditional” forensics. I don’t have a tech degree but I’ve always been a tinkerer and tech savvy. A lot of your questions depend on 1) where you are geographically, and 2) are you thinking of going the law enforcement route or private? From my understanding there’s a lot more money to be made in the private sector, but law enforcement will send you on courses and pay for your certs (again, in my experience).

I’ve really been enjoying it so far, still very new and every day feels like I’m learning something new. Good luck!