Moving from helpdesk to DFIR: what transfers, what misleads

Most of what you learned on a helpdesk transfers to DFIR: file systems, Windows internals, networking, log reading, and the habit of writing down what you did. What does not transfer is the reflex that made you good at the job — restore service, reimage, clear the log, patch and move on. Every one of those destroys evidence. The transition is less about new tools than about re-pointing what you know at a different question: not "how do I fix this" but "what happened, and how do I know".

Which IT skills transfer directly?

More than career-change advice usually admits. These are the ones that show up in the first week of forensic work.

Operating-system fluency. You already know where Windows keeps things, what a service is, what a scheduled task looks like, what a normal process tree looks like on a healthy machine. That last one is the single most valuable thing you have, because almost all triage is anomaly detection against a baseline, and you have spent years internalising the baseline. Someone from a pure security-theory background has to learn it.

Log reading at volume. You are used to reading event logs to find why something broke. The forensic version asks what a logon type means and whether the account should have been doing that, but the mechanical skill — skim, filter, correlate, notice a gap — is the same skill. Hayabusa and Chainsaw apply Sigma rules directly to EVTX files and produce a prioritised, timeline-ordered set of hits, which is the fastest path from a folder of logs to a shortlist. Take the caveat seriously: a quiet result often means logging was never enabled rather than that nothing occurred, and you of all people know how often it was never enabled.

Identity and access. If you have administered Active Directory, you understand group membership, delegation, service accounts and the difference between a permission that exists and a permission that is used. In insider-misuse matters that knowledge is the case. LVRC Holdings v. Brekka drew the line where digital-forensics evidence can actually be found — in the access-control configuration, not the insider's motive — and the useful artefacts are the permission grants, the account status at the time of access, and the date access was revoked.

Scripting and the command line. Nearly all serious forensic tooling is command-line first. If you can write PowerShell or Python to parse a CSV and join it to another, you can already do most of what a forensic analyst does with parser output.

Documentation discipline. Ticket notes are not chain of custody, but the instinct to record what you did, when, and why is the instinct forensic work is built on. Most people entering the field from a purely technical background have to be taught it.

Imaging and backup familiarity. You have cloned drives and restored from backup. The forensic version adds verification and write protection, and the conceptual distance is short. FTK Imager will feel familiar immediately — with the critical difference that it is not a write blocker and nothing about running it prevents you from writing to a source device.

Which habits actively mislead?

This is the part worth reading twice, because each of these is a virtue in operations and a fault in an investigation.

• Restore service first. Rebooting clears memory. Memory is where decrypted content, unbacked code and network state live, and none of it survives a restart. Volatility 3 and MemProcFS analyse memory images; neither can acquire what you have already discarded.
• Reimage the box. The fastest remediation is the total destruction of the evidence. In litigation that becomes a spoliation problem rather than an IT decision, and the standard of conduct is not the one your change-control board applies.
• Clear the log to free space. Obvious once stated, routine in practice.
• Patch and close the ticket. Patching alters the very artefacts that would establish initial access.
• Trust the tool's output. Operations rewards accepting what the dashboard says. Forensics requires knowing which version of which tool produced a result, and being able to say why the tool is right. That is what the free NIST CFTT test reports and Federated Testing suites exist for.
• Treat administrative access as authority. You can reach the mailbox, so you read the mailbox. In Van Buren v. United States the Supreme Court held that exceeding authorised access is a gates-up-or-down question about what you were permitted to reach — which cuts both ways, and is exactly why an internal investigation needs written authorisation scoped to what you will actually collect. Separately, the Stored Communications Act treats post-delivery webmail as protected, which is why Theofel v. Farey-Jones is the reason account content is ordinarily obtained from the party rather than the platform.
• Assume the likely explanation. Operations is a probability game — it is usually DNS. An investigation has to survive someone arguing the alternative, so "usually" is not a finding.

What is the preservation obligation you have never had to think about?

In IT, retention is a policy question. In an investigation it is a legal duty that can attach before anyone tells you. Zubulake v. UBS Warburg is the origin of the modern framing of that duty and of counsel's obligation to make it real inside an organisation, and Rule 37(e) is where the consequences of failing it now live.

The practical shape of it for someone coming from operations: the moment litigation or an investigation is reasonably anticipated, the routine things you do — rotating logs, recycling backup tapes, wiping returned laptops, letting a departing employee's mailbox auto-delete — stop being routine. Calsep A/S v. Dabral is the case to remember on scope, because the destroyed evidence included material deleted from a source-code control system: developer infrastructure is ESI subject to preservation, a point still missed in preservation letters.

And Jones v. Riot Hospitality Group is worth knowing for the opposite reason. The Ninth Circuit upheld orders directing a party and non-party witnesses to surrender their phones to a jointly retained forensic specialist, with stipulated search terms and a privilege review — which reads as a template for how a device examination is supposed to be scoped, rather than something to be improvised.

What do you have to learn that no IT role teaches?

Four things, and they are the actual gap.

1. Acquisition that stands up. Write blocking, verification, hashing, documentation. The free authority is the SWGDE best practices for computer forensic acquisitions, and ISO/IEC 27037 covers identification, collection, acquisition and preservation at standard level. The ACPO Good Practice Guide states the principles in four lines on a page and is free — whatever jurisdiction you end up in, it is the shortest statement of what handling evidence properly means.

2. Timeline construction. Correlating many artefact sources onto one clock is the skill that most distinguishes DFIR from log reading. Plaso / log2timeline builds the super-timeline; Timesketch makes one reviewable and shareable, with saved searches, per-analyst annotation and multi-host comparison. Neither parses anything you did not feed it.

3. Bounded opinions. Operations answers questions. Forensics states conclusions with stated confidence and stated limits. Error, Uncertainty and Loss in Digital Evidence is the paper that named the problem, and Standardization of forming and expressing preliminary evaluative opinions on digital evidence is how an opinion should be expressed and bounded. Read the first one early; it will change how you write a ticket.

4. Writing for a reader who is hostile. A report is read by someone trying to find the hole in it. The UK Forensic Science Regulator's guidance on expert report content and the ENFSI guideline for evaluative reporting are both free and both more useful than any course on the subject.

What is the shortest technically credible path?

There is an ordered reading path for exactly this transition in our reading paths — "Moving from IT into DFIR" — and it is deliberately tool-heavy because that is how the work is done. In outline:

1. NIST SP 800-86, to unlearn the operations reflex and learn the process that keeps evidence intact while you still fix the incident.
2. Incident Response & Computer Forensics, for the end-to-end investigation written for people doing it under time pressure.
3. Windows Forensic Analysis Toolkit, for Windows artefacts as an examiner sees them.
4. Eric Zimmerman's tools — start with the shellbag, jumplist and LNK parsers and learn what each artefact proves and does not prove.
5. Plaso, then Volatility 3 alongside The Art of Memory Forensics.
6. Velociraptor, to scale collection and hunting across a fleet rather than one machine.
7. 13Cubed kept open while you work — one artefact taken end to end on video is the fastest way to close a specific gap, and the channel is free.

Expect three to four months alongside a day job. It is Windows-endpoint-centric, which is where the volume of work is, and it covers mobile and cloud barely at all.

One tooling warning that catches people moving from internal IT to consulting: KAPE is documented as free for government, educational, research and internal company use, and as of 1 January 2026 no longer available for commercial use — meaning third-party networks or paid engagements. If you learned triage on KAPE inside an enterprise, that workflow does not travel with you into paid engagement work.

Which certification fits this transition?

If your employer is funding it, the GIAC GCFE is the natural first step from an IT background: Windows examination, 82 questions in three hours at 70%, $999 for the attempt with the paired FOR500 course listed at $8,780. GIAC describes the audience as anyone with a background in information systems, information security and computers, which is precisely you.

If you are funding it yourself, Blue Team Level 1 at £399 assesses a 24-hour practical incident-response exercise, has no entry requirements, and is certified for life with no renewal fee — and it names zero to two years of experience as its target. Certified CyberDefender is the more forensics-weighted practical alternative, examined over 48 hours across network, disk and memory forensics, perimeter defence and threat hunting; it does not publish its price or renewal terms, so ask before committing.

If you want depth on one platform rather than a credential, 13Cubed's on-demand courses are $795 for Investigating Windows Endpoints and $795 for Investigating Windows Memory, with $895 each for Linux and macOS — artefact depth comparable to the SANS equivalents at a fraction of the price, with the honest limitation that the bundled certifications carry no third-party accreditation and are not what hiring filters look for.

And before any of that, check DFIR Diva's index of over 500 free and affordable resources. It is maintained by a working incident responder, it includes career and résumé advice rather than only course links, and it is the right place to find out whether a free equivalent of what you were about to buy already exists.

What should you stop doing on Monday?

One thing. When something looks like an incident, stop touching it and write down the time. Capture before you remediate, or record explicitly that remediation took priority and what was lost. That single change of order is most of the transition, and it costs nothing.