The 4:cast is Bright: a Q&A with Lee Whitfield
Being part of an investigative team at any level, whether on the law enforcement side or the private sector side, can take a toll. It’s hard work and often exposes a darker side to people. This industry needs to find ways to shine light in the dark and celebrate the great work being done.
Lee Whitfield and his family saw a need to bring the industry together and to recognize the dedication of forensics professionals and to celebrate each other and the good work being done: the Forensic 4:cast Awards were born.
2017 marked the 9th year for the awards and the Magnet Forensics team was humbled and honored to receive its fifth consecutive Computer Forensics Software of the Year award and its first Digital Forensic Organization of the Year award (thank you to the community!). We thought in the lead up to the 10th year for these amazing awards, we would sit down with Lee and talk about the need for awards like these and what’s coming for the next 10 years!
Magnet Forensics: Tell us a bit about you. What drew you to forensics?
Lee Whitfield: I like puzzles and forensics is a puzzle. Finding all the pieces and putting them together to make that picture. Anything where I need to figure out an answer given different scenarios interests me. I like those escape rooms. In fact, my wife gets annoyed when I figure out movie plots and spoil them.
I had always been interested in computers and had a love of the underlying workings of them. I was working for an international construction consultancy –and they agreed to keep me and send me to university. Shortly afterwards, they closed the office where I was working, so I lost my job. At that point, I changed my major to a computing degree. Halfway through first year, I learned that there was a computer forensics track. About that time, a person I knew showed me Guidance’s EnCase software and loaned me some books. I went and did that track and started my first job doing computer forensics before I even graduated.
About six years ago, we started to look at coming to the US. My wife is from here. I took on a role at Digital Discovery in Dallas and worked there for five years before going to work for SANS in March of this year and now I am also running my own digital forensics consultancy.
Magnet Forensics: How did the Forensic 4:cast Awards come about?
Lee Whitfield: I was working for a forensics company and we were having a meeting to discuss marketing and growing the company. I had a great idea to create a podcast – like on a weekly or bi-weekly basis – to discuss the latest news in the industry. They didn’t like that idea. But I did. Not too long after that, I left the company and I thought, “Well, let’s just start it by ourselves.” My brother and I put out bi-weekly or monthly episodes.
So that was how Forensic 4:cast started. My brother and I were working together and the company we worked for was given a local business award. As we were sitting at the table for the ceremony, my brother, wife and I started talking about why there wasn’t a ceremony or a way of recognizing people in the field of digital forensics.
So, we decided to start an awards program and we just finished year nine.
Magnet Forensics: What was the reaction from the community like?
Lee Whitfield: The first one was interesting. We went to our office on a Sunday, set up a webcam, and live streamed the awards from there. People thought it was pretty amusing. We weren’t being completely serious with it. But we did it, and concurrently to this, I was doing some research into volume shadow copies and submitted a talk to a SANS event in DC the next year. There was an empty gap, and I said, “Why don’t we do the awards in that gap?” and Rob (Robert Lee) at SANS was like, “Yes! Let’s do that.”
Once we started planning, Simon Steggles from Disklabs had these hard drives and said, “Why don’t you take these and make them into the awards?” When I saw them the first time, they looked amazing. Just phenomenal, unique. Something people would love to display.
I had already got a bit of a name to myself from doing the podcast. After the first awards, stuff was getting circulated on social media and the watch count for the post was crazy. It was like thousands of people watching and starting to take it seriously.
Now people are very serious about it. Companies are campaigning pretty hard for these awards.
Magnet Forensics: How did you know that people and companies were taking the awards seriously?
Lee Whitfield: A few years ago Cindy Murphy (President, Gillware Digital Forensics) won Digital Forensic Investigator of the Year. I had my doubts about whether people were taking it seriously, but it was clear how much it meant to her. This was something people passionately cared about. I even get asked, “Why wasn’t I nominated? What about us?”
There was a point when I had thought about stopping it, but there’s no way.
Magnet Forensics: Why are the Forensic 4:cast Awards so important?
Lee Whitfield: This is an exceptional community of exceptional people doing exceptional work. We need to recognize that. This is a completely community-driven awards program There is no interference by vendors. I don’t pick the awards. This is start to finish about the community. I provide the platform. People submit their nominations and I put out the top three. Put it out for voting and whoever gets the most votes, wins.
People care because their voice matters.
And the community thrives when it comes together. This last year, Eric Zimmerman got his second award for Digital Forensics Investigator of the Year. I said at the summit, “Last year, someone asked him, is there a tool that does such and such? And he went off and wrote it and had it out for testing by the end of the day.” That kind of dedication is quite typical of this community.
When I came into digital forensics and started these awards, I was still a kid in my mid-20s. At that time, I had one of the only digital forensics university degrees that you could get. Now, a decade later, we have this new generation of people who have gone through university and received instruction from people who really have done the job. This new group of people coming up through the ranks – they are smart and they make us push ourselves. It pushes us to be better. We need to celebrate ourselves as we become better. We have to find ways to recognize each other.
Magnet Forensics: What’s next?
Lee Whitfield: I’m probably going to add another category next year. We have blog of the year, organization of the year. But where do we put things like AboutDFIR or This Week in Forensics?
I’m looking at a potential Digital Forensics Hall of Fame. That would be more driven by me than the awards. I would choose people and have a voting panel on who should be included in that.
I want to keep getting the word out about the awards. We have grown so much, but this year, the guy on stage asked who voted and only half of the people there raised their hands. There are those people who are engaged in the community and they drive a lot of awareness and the voting. There are others who are more passively involved. They need to get involved. I know there are people out there doing phenomenal things and getting no recognition at all.
If people are shying away from the limelight, we’ll never know what they have accomplished.
Be sure to check out the Forensic 4:cast site for the latest news about the Forensic 4:cast Awards.
Questions, comments, queries? Please email me at: rick.andrade@magnetforensics.com.