Meet the Magnet Forensics Training Team: Kevin Goodram
MF: Tell us about your life before becoming a Trainer.
KG: Before coming into the industry, I worked in the hospitality sector (late nights and fun times). At the age of 30 I had a bit of a mid-life crisis and had finally decided what I wanted to do in life so returned to full time education in forensics computing.
I stepped out of university into the private sector of digital forensics doing cell site analysis alongside mobile device and computer examinations, primarily acting on behalf of defense. From there, I made my first move into law enforcement working for the National Crime Agency (NCA). Whilst there, I encountered pretty much every crime you could imagine, including human trafficking, weapons trafficking, fraud, and child sexual exploitation.
My first move within law enforcement took me to the Counter-Terrorism Northwest Police unit (CTPNW, formally Special Branch). This involved carrying out digital analysis of mobile and computer devices in cases of right-wing terrorism from both domestic and international threats.
MF: What made you want to be a Trainer?
KG: I enjoy passing on my experiences and knowledge to others as well as hearing about other people’s experiences. I’m a firm believer in making connections so people have a vast knowledge pool that can be called upon. I’m very much a people person, so sharing and passing on a wealth of knowledge is a key attribute to training.
Before joining Magnet Forensics, I fortunately had access to the Training Annual Pass (TAP), so I managed to get onto all but one of the Magnet training courses in person. I’ve also taken part in training on mobile device analysis and Mac OS with other vendors as well as analysis of the Linux OS. I was also fortunate enough to head out to Orlando, Florida for two weeks to take part in the IACIS training where I made some great connections and friends over the pond and further afield.
MF: What excites you the most about a new class?
KG: The new trends and issues that people are seeing in the field. As much as I try to stay up to date, it’s near impossible to know everything that’s going on in digital forensics and the best people that can inform are those that are on the front line doing the job. Each new class continues to bring these points forward so I can try my best to stay on top of what’s going on. Additionally, I’ve sat in these classrooms myself and have seen firsthand the diversity of people that attend—be it prosecution, defense or corporate, each person can bring something different, even more so when it stretches to different countries and territories.
MF: Do you ever learn anything from the students?
KG: Of course! The saying goes, “if you’re the smartest person in the room then you’re in the wrong room.” Everyone has different life skills and experiences, no matter who you are or what you’ve done. You should never stop learning or listening. Learning doesn’t ever stop.
MF: Is there a particular moment that stands out the most to you in your career in the classroom?
KG: I once attended an online training course and recognized the trainer’s name but couldn’t place him. It was only once I logged on and saw him that I realized that back in the days of me working defense cases, we were in court together—him the prosecution and myself the defense. I thought it was going to be a little awkward, but professionalism took over and thankfully we could laugh about it.
MF: What do students get out of training in person that they can’t get on their own?
KG: I’m a visual learner myself, so I benefit from having that immersive environment. I think this is key. This is not to take away the benefits of the virtual environment though. I like that in person you have that option to say “I don’t understand” (multiple times) or “can you come and show me that on my machine.” Training on your own doesn’t give you that option. In a virtual environment, I think people are hesitant to do that for fear of interrupting the class because they can’t gauge the people they’re training with like you can in person.
MF: How prepared do you feel students are to use Magnet Forensics products after taking the training course?
KG: Taking the Forensic Fundamentals (AX100) & Magnet Axiom Examinations (AX200) courses will keep them in good stead. I took them both on at my own pace online and even though I had been using the products for some time, I still learnt new things.
MF: What is most unique about Magnet Forensics’ approach to training?
KG: No slideshows or PowerPoints—this is great! Sitting through a PowerPoint presentation can be mind-numbing at times. Magnet focuses on demonstration, so particularly for visual learners like me, it works so much better.
MF: Why do you think certification is important to examiners?
KG: It demonstrates comprehension. It shows that “yes, I’ve done this training course but here’s my certification to show I’ve actually used the skills.” It tells the jury in court that you’ve not just attended a course and sat through some PowerPoint for a certificate. It shows that you’ve implemented the skills you’ve learnt and been assessed.
MF: How do you manage to keep up on the latest trends in digital forensics?
KG: People. I talk to friends and current/former colleagues that are still doing the job. I ask them what kinds of things they’re seeing and asking about problems they’re encountering. Blogs and vlogs are handy, and social media sites like LinkedIn are full of useful information on growing trends.
MF: What trends do you see coming down the pipeline in digital forensics?
KG: AI is growing massively. I can see this being implemented to streamline digital forensics, and it’s already started making an impact. Also, cloud storage will become even more prominent. I can see a time where mobile devices don’t store user data any longer and it will be all floating around in the cloud. This is going to prove an issue (here in the UK) as there is no precedent set as yet for a criminal case like this. Portless mobile devices is another trend. How are examiners to extract data from devices in the future without a data port? I imagine examiners will require further training in device disassembly going forward.