Everyone working in a computer forensics role has at least one thing in common - they know a lot more now than they did when they started. No matter how knowledgeable someone is today, there was a time when they knew next to nothing about forensic matters.
Something not everyone has in common, though, is a willingness to share that knowledge. In the 15 or so years that I've been involved with IT (not just forensics) I've had the good and bad fortune to meet some very different personality types, on the one hand true professionals who are only too happy to share what they know and on the other those who take an almost perverse delight in hoarding their knowledge. I've often thought about what it is that makes one person willing to give up their time to teach others while someone else will only ever seem to act in their own interests. I don't necessarily have a good answer to that question but what I have noticed is that those most willing to share their knowledge have always been those who truly understood the subject matter at a deeper level and genuinely enjoyed thinking and talking about it. They felt secure in their own position yet were comfortable talking about their own limitations.
No matter how much we know now, the pace of change is such that there will always be something new to learn tomorrow. Furthermore, the scope of high tech investigations is such that no one can possibly know everything. At some stage we all need to turn to the resources which are available in order to increase our knowledge. Those resources are many and varied. For most forensic examiners studying, training and research (if you're lucky) are the main paths to increasing knowledge and understanding. Frequently, though, a problem or question arises the answer to which is not covered in any training course and the time to research it in the lab is simply not available. On these occasions we need to turn to others who may already have answered the same question.
How we ask that question, especially for those new to the field, can be crucial in determining the type of response we receive. More on that tomorrow...