So You Want to be a Forensicator: Digital Forensics Careers | Catherine Ullman | BSides312 2026

Imagine starting your first day on the job with a single clue: a five-second gap in the logs that absolutely shouldn't exist. What happened in the missing moment? This talk uses that small but mysterious anomaly to illustrate the heart of digital forensics. Attendees will learn how people actually break into computer forensics and the skills that matter. We'll examine the core personality traits that make one effective in this career, including the ability to clearly communicate what the evidence does (and does not) prove. The session also sets realistic expectations for daily work in digital forensics. Attendees will understand not only what it takes to be a forensicator but what it feels like to think, work, and solve problems like one. --- About Catherine Ullman: Principal Technology Architect, Security Dr. Catherine J. Ullman is the Principal Technology Architect, Security at the University at Buffalo. She is a contributor to O'Reilly's 97 Things Every Information Professional Should Know, the author of Wiley's The Active Defender, and has presented at many infosec/hacker conferences. In her (minimal) spare time, she enjoys visiting her adopted two-toed sloth Flash at the Buffalo Zoo, researching death and the dead, and learning more about hacking to make the world a more secure place. Recorded live at BSides312 2026. --- Chapters: 0:00 Introduction 1:05 About Catherine and Flash the Sloth 1:50 The Missing Moment: Your First Day 2:40 An Outbound Connection to Russia 3:15 Triage, and a Company That Actually Runs Sysmon 4:10 A Gap in the Logs 4:40 "Service of Doom" 5:25 Phantom: Killing the Logging Thread 6:30 Event Logs Are Only the Tip of the Iceberg 6:50 Why SOCs Over-Rely on Windows Logs 7:35 Locard's Exchange Principle 8:55 What Digital Forensics Actually Is 9:10 What "Forensically Sound" Means 10:00 Forensics vs. Incident Response 11:20 The Write Blocker, and Why DNA Is Different 12:30 Triage: Prioritizing and Scoping 13:00 Why We Can't Always Image First Anymore 14:30 Kinds of Forensics: Disk, Live, Memory, Network 15:10 Cloud Forensics 16:15 Cloud Logs Are Frequently Misconfigured 16:50 Training: SANS and Its Cost 17:20 IACIS: Two Weeks and 75 Pages of Answers 19:30 Why the Law Enforcement Mindset Matters 20:35 Vendor Training, DFIR Diva, and 13Cubed 21:20 Employment: Law Enforcement and Its Toll 22:20 Consulting as Trial by Fire 23:00 How I Became the University's Forensicator 23:20 The Personality Traits That Matter 23:50 Good Under Pressure: "Are You Done Yet?" 24:40 Your Tools Only Interpret the Data 25:20 Little-Endian vs. Big-Endian: Two Right Answers 26:30 What's Not a Good Fit 27:05 Communication Above All 29:15 What People Think the Job Looks Like 30:00 It's the Journey, Not the Destination 31:00 Work-Life Balance and Imaging a Terabyte 32:30 The Rewarding Parts 33:00 Cheating Cases and Academic Integrity 33:35 The Ticket Fraud Case That Ended in an Arrest 34:00 Finding Missing People on the Network 35:10 A Close-Knit, Helpful Community 36:30 Why This Job Is Future-Proof 36:50 Summary 37:55 What TV Gets Right (and "Enhance" Doesn't) 39:00 The Active Defender 40:05 Q&A: Where to Practice 41:10 Q&A: What Does AI Forensics Look Like? 44:25 Q&A: Keeping Up With New Techniques 45:30 Q&A: A Crash Course for Sysadmins 47:40 Q&A: The Dissatisfaction of No Flag 50:55 Q&A: Forensics for Compliance --- Mentioned in this talk: - Sysmon - log2timeline - IACIS - SANS - Cyber Triage - DFIR Diva - 13Cubed - "The Active Defender" by Catherine J. Ullman Full BSides312 2026 playlist: https://www.youtube.com/playlist?list=PLZnyzZE8j8jw