Absence of ‘investigative mindset’ in DFIR

Every organic profession begs the responsibility of staying up-to-date on new trends and expanding one’s knowledge as far outward as possible. This is unconditionally true with the health, legal, engineering, and more specifically for our purposes the DFIR, realms. However, a question has been bouncing around in my head, not about this universal truth, but with the totality of the idea itself. Can this action of constantly attempting to absorb more information like a sponge be enough?

We all know the basic notion that it is important to stay up-to-date on material, and that anything is possible with enough time, energy, and willpower. But what about re-writing our own personality? I believe a very demanding obstacle with fields like Digital Forensics & Incident Response is the requirement of an ‘investigative mindset’. If you are unfamiliar with this term, in the “Introduction to Criminal Investigation: Processes, Practices, and Thinking”, Rod Gehl identified the ‘investigative mindset’ term as partly defining an individual who embodies passion for discovery, who is detail oriented, tenacious, and capable of thinking outside the box. These are not often traits that can be learned – but rather only refined. Many colleagues I have met over the years with a shared interest in the DFIR / investigative field, along with myself, believe the tenacity and general motivation of DFIR work via persistence, is something that can neither be learned or absent. Research has gone so far to show that persistence “may be linked to specific areas in the lateral orbital and medial prefrontal cortex and the ventral striatum. [of the brain] (Gusnard).” In short, it is possible that the physical construction of one’s brain may favor interest and overall success in DFIR, over another individual’s.

So I ask the question of whether or not it is possible for an individual to enter – and succeed- in DFIR work without this mindset, or if they would find themselves truly attracted to it at all. I, like many of you reading this, have encountered a fair share of individuals who did not excel in this type of work. Their ambition was low and the response to their efforts showed it. They eventually admitted to themselves (and others) that it did not excite them as much as they initially hoped.

This is a completely fine internal realization, but what happens when this realization does not happen to individuals without the mindset? What happens when this individual tries to put in all of their time and energy and never reaches the conclusion that it really isn’t what they are ‘meant to do’? When the passion is there, but the forensic and investigative mindset just isn’t? Can a good investigator still rise from someone who’s only strength is their passion?

I truly believe passion can outweigh almost any other obstacle standing in someone’s way, but am not entirely convinced that it can go as far as rewriting someone’s overall personality. Let me know your thoughts!

Gehl, Rod, and Darryl Plecas. “Introduction to Criminal Investigation: Processes, Practices and Thinking.” Introduction to Criminal Investigation Processes Practices and Thinking, Justice Institute of British Columbia, 1 Aug. 2017, pressbooks.bccampus.ca/criminalinvestigation/chapter/chapter-1-introduction/.
Gusnard, Debra A., et al. “Persistence and Brain Circuitry.” PNAS, National Academy of Sciences, 18 Mar. 2003, http://www.pnas.org/content/100/6/3479


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Blog at WordPress.com.

Up ↑

Create your website with WordPress.com
Get started
%d bloggers like this: