Computer Forensics: How NOT to interview

Update: Part 2 and Part 3 now available

Real examples of computer forensic  interviews

Below are real life examples of how not to interview  for a computer forensics job.

All of the people were graduates, or in the final weeks of their degree, most of them were taking computer forensics courses. In addition to this all had come to  the interviews via a recruiter. [Clearly there was no filtering, whatsoever’

These examples will show how utterly pointless many computer forensics degrees are and how some  recruiters really don’t do their job (the recruiters on this site certainly do their job, and do it well). After reading the examples, it will be come clear that none  of these applicants were offered a job.  Part (2) of this is now available

Example 1

The interviewer showed a S-ATA hard drive to the interviewee, a computer forensics graduate, and asked “What is this?”.

The answer: ” Is it a backup tape?”

Example 2

An IT graduate attended for an interview in a computer forensics  role. Initially the individual was given a tour of the company, and explained what the company does, how it differs and compares to other computer forensics and electronic discovery companies. The interviewer asked the graduate “Why do you want to join computer forensics?”

The answer: “I had never heard of computer forensics before, my recruiter just sent me down, but it seems very interesting so I would like the job please”.

Example 3

The question put to computer forensics graduate was “What do experience do you have in IT or computer forensics”.

Answer: “I worked in a takeway”

Example 4

In a similar scenario to Example 1, but a different applicant the interviewer showed a backup tape to the interviewee, again a computer forensics graduate, and asked “What is this?”.

The answer: ” Is it a hard drive?”

Example 5:

A computer forensics student, who was a soon to be gradute, was interviewed for role in computer forensics. Below is an example of the questions and answers:

• Q: Have you ever taken a computer apart?
  • A: No
• Q: Do you have your own computer?
  • A: No
• Q: Have you ever owned a computer?
  • A: No

  Q: Have you ever imaged a hard drive?

  • A: No

• Q: Have you ever seen a hard drive?
  • A: No
• Q: Do you know what a hash value is?
  • A: No
• Q: Do you know what a file signature is?
  • A: No
• Q: Why do you like computer forensics?
  • A: I like working with and studying technology. I constantly read up about the subject, and try and further my knowledge.

Example 6:

The interviewer designed a series of questions about a particular computer forensics scenario (taken from a real life example). Each part of the problem had to be resolved before the next piece of the puzzle could be put forward. If the question could not be answered by the applicant, they would be given the answer to allow them to move forward with the rest of the scenario.

A computer forensics soon-to-be-graduate came for an interview and was explained the rules for this part of the interview.

The first question was asked and the applicant gave a wildly incorrect answer. The interviewer explained the correct answer, as that information would be needed for the next problem solving question.

The interviewee replied “Your wrong”

The interviewer explained the reasoning again. The interviewee stated “No your wrong”. The interviewer asked for the reasoning for technical difference of opinion and the interviewee stated “that’s what I think”.

The interviewer asked “have you ever worked in this area, or on this type of case, or ever conducted research into this area?”, the interviewee replied “No”.

The interviewer, made a final attempt to resolve the situation:  “So why do you disagree with my technical assessment, of a question which I have written, researched, and worked on over the past 5 years?”.

The last word on the subject went to the application:   “I just do”.

Example 7

A computer forensics graduate, who was waiting on his results, either a 2:1 or 1st class honors was interviewed. The interview went something like this:

• Q:  Are emails important in investigations?
  • A: Yes, very
• Q: Do you feel you have been taught about emails?
  • A: Yes
• Q: Do you know about the different email types?
  • A: Yes
• Q: What is a PST file?
  • A: Don’t know
• Q: What is an OST file?
  • A: Don’t know
• Q: What is an NSF file?
  • A: Don’t know?
• Q: What is an Exchange Server?
  • A: Don’t know
• Q: Can emails be stored on backup tapes?
  • A: Not sure

Summary:

While these students and graduates were of a shocking standard, it is not uncommon to find student university graduates of this nature. In fact these were the norm, not the unusual.

The arrogance of the students who think they know everything can only be blamed on them, the fact that they even got to the interview can firmly be placed on the recruiters.

The fact that so many students know so little about their subject has to be put at the feet of the universities who appear to offer “computer forensics courses” from a purely profit based reason.

Part (2) of this is now available