Jelle Niemantsverdriet is the Principal Consultant, Forensics and Investigative Response EMEA, Verizon Business Security Solutions. In this interview he introduces the reader to the world of digital forensics and talks about computer forensics tools, privacy concerns, the fundamental differences in investigating different operating systems, and offers advice for anyone interested in learning more about computer forensics in general.

Niemantsverdriet will be teaching what can be learned from investigations into confirmed data breaches at the 2011 European Digital Forensics and Incident Response Summit.

Many security professionals are curious about digital forensics. What advice would you give to those just starting out?

Start reading. There is a lot of information out there, I would recommend to keep a good balance between reading about the technical stuff, the investigative strategies and especially also about reporting. There is also a very active community on Twitter or the various forums which is keen to share experiences - as long as you show you are not afraid to do some work yourself and that you participate as well.


The field is very broad on one hand (there are a lot of devices or systems that can hold information and be used in an investigation) but can also be very detailed and specific: you can become a super specialist on forensic artifacts on a specific operating system or type of mobile phone.

And again, I keep stressing that: it is way more than just the technical side of things. Having an investigative mindset, being able to interpret and report your findings are key characteristics on top of knowing 'how things work'.

What are the essential steps involved in conducting a forensics investigation in a large organization? How do you approach such a challenging effort?

I think the main challenge is to take and maintain the 'trusted advisor' role, which stretches from providing advice on technical and investigative steps to providing crisis management recommendations. Imagine, such a company is - especially during a data breach or security incident - in crisis-mode and everybody is under a lot of stress. You are one of the few persons who deals with these situations on a regular basis and are brought min to get them through this, so be prepared for a lot of heads turning your way. And those heads are not only IT or security related, but often also HR, general management or other involved departments within the organization.