Time to think

Posted on March 29, 2012. Filed under: forensic | Tags: , , , , , , |

I’ve just spent the day at the RSA running a workshop as part of a project I’m engaged on for a major client. The theme was, unsurprisingly, based around digital forensic standards, processes and scenarios.

Lots of good stuff came out of it and there’s been a huge amount of support, but the disappointing thing was the response from just one organisation. Asked to participate in the project by coming to a one-day workshop and letting me visit them to observe their methods, they responded  (paraphrased)  :  “No. Too disruptive, no time, we have too much of a backlog”.

It seems to me that if you spend all your time trying to use your current methods to reduce a backlog of work, and failing, perhaps a bit of disruption and time off might pay dividends in the longer term.

What are your thoughts ?

Make a Comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

2 Responses to “Time to think”

RSS Feed for Forensically sound(ing off) Comments RSS Feed

I see here next reasons:
1. They do not want to disclose their methodes because of unique know-how (but I am not really sure about it)
2. The same as above, but because there is nothing (or more probably there is not so much to show)
3. They do not belive you (not personaly, but not belive that your project could help them to solve their ever-ower-loading or to do it better) … yes, all “standardisation” brings only problems, administrative load and wast time… could be? Standardisation is regulation need, in general. It brings only complications to the individual approach. Generally they understand needs in standardisation, certification, etc., but in real life it brings only problems and extra expenses, so it is difficult to wait their real support, no matter they know that it will come in the near future. Once it will be regulatory, then they will invest their time and money to it, because it could bring new cleints, business. But why to do it in advance?
4. They think they do all the best and do not need advices (or outputs from the project)… but probably this is not right reason, because once somebody do his work good (really well) he know that he coud do it better and every idea could bring some positive inputs…

So in result, both we have similar view 😉


1 & 2 I can live with – people are usually quite open about the need to keep some things secret. It’s been mentioned a few times in relation to this work, but hasn’t become a barrier yet. Most are quite happy to negotiate some sensible “rules of engagement” which will allow me to observer what I need to, without them disclosing sensitive material.

3 & 4 are, I think, much the same thing. They are so busy struggling with their current systems, that they can’t accept they need to take some time to review & rethink, and possibly even let someone else try to help them (or at least offer some ideas which they can choose to ignore).

I just found it odd that of the 50 or so organisations involved in this work, only 1 has had such a negative response. It’s really quite heartening to know that the spirit of co-operation is so widespread.

Where's The Comment Form?


    This is the weblog of Angus M. Marshall, forensic scientist, author of Digital Forensics : digital evidence in criminal investigations and MD at n-gate ltd.


    Subscribe Via RSS

    • Subscribe with Bloglines
    • Add your feed to Newsburst from CNET News.com
    • Subscribe in Google Reader
    • Add to My Yahoo!
    • Subscribe in NewsGator Online
    • The latest comments to all posts in RSS


Liked it here?
Why not try sites on the blogroll...

%d bloggers like this: