One of the most recognized names in the industry thanks to its Forensic ToolKit (FTK) software, conference Platinum sponsor AccessData Group has trained digital forensic examiners and cyber crime investigators for years.
We wanted to find out about the training and what attendees could expect when they walk through the lab doors in September. Keith Lockhart, AD’s vice president of training, was kind enough to answer our questions about what makes his teaching tick.
HTCIA: What do you like best about training?
KL: Learning – on both sides of the classroom. You won’t find anyone attending a training event that doesn’t learn something – that includes students and instructors. It gives new rise to the phrase “learn something new every day”… especially in the world of constant technology change.
HTCIA: Can you give me an example?
KL: I am a draconian proponent of repeating a question when one is asked in a classroom setting or presentation event. As a learning point for an instructor, repeating a question accomplishes the following educational value adds:
a. It allows the rest of the students in a room to hear the conversation so it doesn’t appear as though an instructor is having a sidebar conversation with the person originally posing the question (and in turn alienating the remainder of the class).
b. It provides validation for the student asking the question – almost praise for taking the time to bring clarification to a point or furthering a point to the benefit of others.
c. It provides legitimacy for the instructor. When a and b are accomplished, c naturally occurs – the instructor exudes confidence and rapport with students by this simple interaction.
HTCIA: What do you like to see from your audiences?
KL: Application – the ability to apply what is being presented to the audiences. It matters not if the audience is sitting at computers or simply listening to an oral presentation. When the question of “Why would you need to know that?” is presented, and the audiences can exemplify the answer… learning is taking place!
HTCIA: In what way?
KL: This varies greatly, and is best analogized when an instructor recognizes an abundantly relevant question to a topic just covered. The good instructor will not provide the answer to all of the questions posed in class. Learning takes place when a student question is recognized for its merit and returned to the student body to allow them a chance to apply what they’ve learned to satisfy an answer.
One step further was the personal experience with someone on my staff. There was a day that this person, as a student of mine, asked such a pertinent question (where I could also observe other students in the class struggling with the same issue) that I told him I would only answer his question if he in turned showed the person next to him how overcome the obstacle.
I provided the answer syntax, and the poser of the question exemplified the syntax in an answer for the person next to him. I don’t know how or what he did, I just observed him understand my syntax and turn it in to something that worked for someone else… a true education event personified. (He then came to work for me!)
HTCIA: What have you enjoyed most about past HTCIA conferences?
KL: The audience and the ability to collaborate on new ideas / techniques while gaining exposure to some of the latest technological innovations. I’ve presented at many local and international HTCIA events and one of the constant strengths of the membership is communication between investigators in all realms of the public and private sector.
HTCIA: How so?
KL: Many times, given the opportunity and appropriate environment, students “come out of their shells.” It is common knowledge that people fear asking the “dumb question” (of which there are none). A good instructional technique that facilitates collaborative work AND fosters more interaction in the classroom is to encourage collaboration with properly designed questions that challenge the students.
For example: ask a multi-part question, or one that has multiple answers or interpretations of answers. When student A provides part of the answer, even if it’s incorrect, it gets pushed back to the group with the storyline of “You’re on the right track!”, followed by “Who can help student A?”
This elicits another piece or version of the answer, and then another, etc. until the instructor can finally commend the group with, “Congratulations, you just put all your heads together to successfully attack this problem!”
In the AccessData world, we equate that with “DNA’ing” the problem with reference to our Distributed Network Attack technology that uses multiple computers to attack encryption – much as the students just used multiple heads to come up with the answer to a problem.
Thanks, Keith, for taking the time to talk with us so in-depth! AccessData’s labs will be presented during all three conference days on the following topics:
- Collaborative Forensic Analysis: Reducing Caseload through Division of Labor
- Advanced File Carving: Custom Carvers and File Identifiers
- Live Device Acquisition and Analysis… And Why You Should Care
- Strategies to Streamline Explicit Image Identification, Classification, and Reporting
Lab registration is now open, so conference registrants who have not yet received the email, keep a lookout!
Images via AccessData