Chapter 40 — Further Reading

Foundations (🔬 / deeper)

• U.S. Bureau of Labor Statistics, Occupational Outlook Handbook — "Information Security Analysts" and "Forensic Science Technicians." The two federal categories the field is awkwardly split between (one with a median well above $120k, one in the mid-$60ks). Read both to see why no public statistic captures a "digital forensic examiner" cleanly — and why you must triangulate your own number rather than trust any single source.
• SANS / GIAC annual DFIR survey and the SANS digital-forensics career and salary resources (sans.org/digital-forensics-incident-response). The most useful current, role-specific compensation and skills data in the field, refreshed yearly. Anchor a negotiation to this year's edition, never to a number printed in a book.
• EDRM — the Electronic Discovery Reference Model (edrm.net). The canonical lifecycle (identification → preservation → collection → processing → review → production) that defines the 📜 eDiscovery career. Read it once and the litigation-support world stops looking like a black box.

Approachable explanations (everyone)

• AboutDFIR.com. The best free, continuously updated map of the field: education programs, certifications, tools, and — crucially — how people actually break in. The single best starting point for anyone planning an entry from any of the four doors.
• "This Week in 4n6" (thisweekin4n6.com) and the wider DFIR community on its blogs and socials. The weekly roundup that keeps you current after the book ends; following it is the continuous-learning habit theme #4 demands.
• Brett Shavers — DFIR.Training and his writing on the investigative mindset. Practical, opinionated, career-grounded guidance on becoming and staying an examiner, from someone who has done the work, testified, and taught it.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 🔍🛡️ SANS DFIR Summit, DFRWS, and your regional HTCIA or ISACA chapter. The conferences and chapters where reputation is built in public — attend, then present. Speaking is the fastest route to the name recognition that Daubert qualification (Chapter 27) and consulting pipelines both run on.
• 🔍 IACIS (CFCE) and ISFCE (CCE). The examiner communities and credentials behind the law-enforcement and independent-examiner tracks (Chapter 39).
• 📜 ACEDS (CEDS) and the Relativity certification ecosystem (RCA). The credentials and community of the eDiscovery path — the large, stable, frequently-overlooked 📜 career.
• 💾 The data-recovery industry — DriveSavers, Ontrack, Gillware — and Chapter 13. The bench career, its Tier 1 → Tier 4 capability ladder, and the human-service reality of the counter.
• 🔍 NCMEC / ICAC examiner-wellness guidance and the secondary-traumatic-stress and vicarious-trauma literature. Required, not optional, for anyone weighing exploitation-adjacent work; the playbook for lasting in the hardest corner of the field (Chapter 28).
• 🛡️📜 Glassdoor, levels.fyi, and the Robert Half Technology Salary Guide. Employer- and metro-specific compensation for the negotiation — the local, current data the book's deliberately illustrative table is not.

Reference (this book)

• Appendix I — Certification Roadmap and Chapter 39 — Certifications: the credentials that open each door and keep your knowledge current.
• Appendix J — Practice Images and Lab Setup: the raw material for the portfolio that beats a list of certifications.
• Chapter 28 — Ethics, Chapter 27 — Expert Testimony, Chapter 13 — The Data Recovery Business, and Chapter 37 — Building a Forensic Lab: well-being, the stand, the recovery trade, and the room — the four chapters this career chapter stands on.

Do, don't just read

• Write the career plan. Do the chapter's Progressive Project: name your target path and sector, your door, your next three credentials and portfolio piece, your specialty, and your sustainability plan. Date it; put a reminder to re-read it in twelve months.
• Build the portfolio. Work three practice images from Appendix J end-to-end and write three sanitized reports. A hiring manager who can hold your competent report skips a hundred candidates who can only list certifications.
• Run the trackers, then ask the question. Set up the credential/CPE tracker and the content-free experience ledger from the chapter, pull this year's compensation data for your role in your city — and ask one prospective employer how they protect their people from burnout. Weigh the answer as carefully as the salary.

Next: there is no Chapter 41. What comes next is the work — and the appendices built to sit beside it: file signatures, artifact locations, the command-line reference, legal frameworks, and the certification roadmap. Write your career plan, then go to work. Deleted is not destroyed; the capability to find what is lost and prove what happened is now yours.