Computer Forensics: How NOT to interview (Part 2)

Following on from the popularity of Part 1, below are examples of other “outakes” from applicants in the world of computer forensics:

Example 1

An computer forensics student, in the UK, approached a computer forensics examiner and asked:

  • Student: Are there any companies that do computer forensics in the UK?
  • CF: Yes
  • Student: Oh, are they many?
  • CF: Quite a few
  • Student: Oh, I could not find any
  • CF: Where did you look.
  • Student: Around town [student lives in a rural town]
  • CF: Did you try the web?
  • Student: No, where should I go?
  • CF: You could try Google.
  • Student: Ok, thanks
  • CF: To be quite frank, if you can’t find your prospective employer, who advertise themselves, promote themselves, and fill the first few pages of google, then perhaps computer investigations are not the thing for you.
  • Student: Oh, its ok, I am very good at finding out information and researching on the internet.

Example 2:

A student asked a computer forensics examiner:

  • Student: Can you tell what data is on a hard drive, and if the person did “it”, just by picking up the hard drive and “feeling it”
  • Examiner: *Sigh*

Example 3:

A computer forensics graduate has applied for a job, and is attending for a technical interview, the day of the interview the candidate calls in to ask a few questions:

  • Graduate:  Can I confirm the location of the interview
  • Interview: It’s at our offices.
  • Graduate: Oh, ok

Graduate hangs up. Twenty minutes later the gradute recalls

  • Graduate:  Which offices?
  • Interview: We only have one UK office
  • Graduate: Oh, ok

Graduate hangs up.  1 hour  later the gradute recalls

  • Graduate:  What’s the address
  • Interview: We have passed you this information previously, so consider it a test to find out the location of the offices
  • Graduate: Oh, ok

Graduate hangs up.  30 minutes  later the gradute recalls

  • Graduate:  I have looked everywhere, I can’t find your address anywhere
  • Interview:Have you tried our website?
  • Graduate: Oh, ok

Example 4:

A computer forensics graduate is being interviewed for a position:

  • Interviewer: Bearing in mind we are a computer forensics and electronic discovery  firm, and work in the civil sector, and generally deal with data moving in, around, and out of large corporates. What do you think are the most common computer investigations we get involved in?
  • Applicant: Terrorism
  • Interviewer: Err, no
  • Applicant: Murder

Example 5:

A computer forensics graduate comes in for an interview, and  is given a tour of the company.

  • Interviewer: You have been given the tour?
  • Applicant: Yes
  • Interviewer: And you have seen our website?
  • Applicant: Yes
  • Interviewer: So, what do you think we do here?
  • Applicant: Don’t know.

Example 6 :

A computer forensics gradute was applying for a job and the  interview was going relatively well. He knew what a hard drive was, he had a computer, and he had found the company….so far so good.

  • Interviewer: Do you know what a has value is?
  • Applicant: Its a unique value for a file, like a fingerprint, every unique file has a unique hash value
  • Interivewer: Good answer, do you know of any different types of hash?
  • Applicant: Yes, CRC, MD-5, and SHA-1. SHA-1 is the most secure.
  • Interviewer: Good. How can it be used?
  • Applicant: In several ways, it can identify unique files, check to make sure an image has not been corrupted and be used with the NSRL list to remove system files.
  • Interviewer: Good. Moving on now to electronic discovery. This may be a new subject to you, but think of it as problem solving rather than knowing the exact subject.
  • Applicant: Ok.
  • Interviewer: We often collect millions of files, many of which are the same, e.g from multiple backup tapes. How could we get rid of the duplicate files?
  • Applicant: No idea
  • Interviewer: We have millions of files, many of which are the same, and we need to get rid of the files that are duplicates, and keep only the unique files, any idea?
  • Applicant: No, no idea
  • Interviewer: I will put it another way. Think back to what we covered in the interview. We have large collection of files are looking for just the unique files.  Any ideas?
  • Applicant: No
  • Interviewer: What about hash values, could they be used?
  • Applicant: No, I don’t think so. They are for NSRL, and images

Memorising answers to predicable questions, but not understanding the subject, is clearly not the way to pass an interivew.


4 Responses to “Computer Forensics: How NOT to interview (Part 2)”

  1. An Hilven Says:

    3 words: oh… my… god

    Reading these gives me more confidence about my own abilities though 🙂

    • MazX Says:

      No kidding, and I haven’t taken any university courses at all LOL. Sad. Really sad. Good reading fun though.

  2. Computer Forensics: How NOT to interview « Data – Where is it? Says:

    […] These examples will show how utterly pointless many computer forensics degrees are and how some  recruiters really don’t do their job (the recruiters on this site certainly do their job, and do it well). After reading the examples, it will be come clear that none  of these applicants were offered a job.  Part (2) of this is now available […]

  3. Data Predictions: August 20th 2009 « Data – Where is it? Says:

    […] site because its about data and statistics, and if the articles on How NOT to interview Part 1 and Part 2 are anything to go buy, this is a real problem for the quality of graduates being […]

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: