From Digital Forensics Practitioner to Technology Provider

For most of my career, technology was something I used to solve problems. 

As a Digital Forensic practitioner, my focus was on the investigation in front of me. I needed to recover and interpret data, maintain evidential integrity, comply with legislation and quality standards, and provide investigators with reliable results. The tools were important, but they were only one part of a much bigger process. 

Over the last 19 years, I have worked across law enforcement and corporate investigations. Beginning my career with Surrey Police in 2007 as a Designated Detention Officer, I have been fortunate to experience a variety of roles before specialising in Digital Forensics. Those experiences included working in a custody environment before moving into digital investigations, laboratory management and forensic quality processes. 

Today I find myself looking at many of the same challenges from a completely different perspective. 

Moving from being an operational user of forensic technology to contributing to the development and delivery of investigative solutions has been one of the most rewarding and challenging transitions of my career.

Why Move from Digital Forensics to a Technology Provider? 

After spending many years in Digital Forensics, people have occasionally asked why I decided to leave practitioner roles behind. 

The answer is actually quite simple. I wanted to learn more. 

Digital Forensics had provided me with a rewarding career and countless opportunities to develop professionally, but I also recognised that there were areas of investigations, governance, information management and organisational processes that I had only been exposed to from the outside. 

I wanted to broaden my horizons and gain a better understanding of how those different areas come together. 

There is a quote by Sir Ken Robinson that has always resonated with me: 

“Life is not linear, it’s organic. You have to be prepared to open up and go out there to create new opportunities.” 

Looking back, that idea has probably influenced more of my career decisions than I realised at the time. Moving from a custody environment into Digital Forensics, from law enforcement into corporate investigations, and eventually into a technology provider role were not steps in a carefully planned route. They were opportunities to learn, develop and experience something new. 

At the same time, I believed in what BlackRainbow is building with NIMBUS, particularly with the National Police Chiefs’ Council (NPCC) new Dynamic Decision and Case Management System (DDaCS) project. Having worked in investigative environments for many years, I could see the value of a platform designed to support investigations, information management and operational decision-making. The opportunity to become part of that journey genuinely appealed to me. 

Moving into a technology provider role felt like the right opportunity to challenge myself, develop new skills and see a different side of the industry. 

Besides, I was confident that as long as nobody tried to turn me into a salesperson, I’d probably be alright 😊 

So far, that seems to be working. 

A Different Perspective on Digital Forensic Investigations 

As a practitioner, my focus was usually on the case in front of me. An exhibit arrives in the laboratory, an investigator has a question, and there is a deadline to meet. 

Every case is different, but the objectives are clear. You need to recover, interpret and present the evidence in a way that is accurate, repeatable and defensible. 

Working for a technology provider has forced me to think differently. Instead of focusing on individual investigations, I now spend more time considering how processes, information and technology support investigations across an entire organisation. 

That change in perspective has probably been one of the biggest adjustments in my career. 

The Biggest Adjustment: From Evidence to Ideas

Perhaps the biggest surprise for me has been the shift from working with tangible evidence to working with evolving ideas. 

Throughout my career, the work was usually very concrete. Whether I was working in a custody suite, supporting a digital forensic laboratory or assisting an investigation, there was always something physical or observable in front of me. There were exhibits, records, statements, reports and investigative actions that needed to be completed. 

The challenges varied, but the environment was familiar. 

My current role is very different. 

Although my job title is Solutions Consultant, I am permanently attached to the DDaCS project. Unlike supporting an established forensic product with a mature user base, much of my work involves contributing to a capability that continues to evolve through operational feedback, testing and collaboration with subject matter experts. 

Rather than learning how to use a finished product, I have found myself helping to shape how the solution develops and responds to real-world investigative challenges. 

The end result eventually becomes something tangible, but the starting point is often an idea rather than a completed process. 

That transition has required a different mindset. 

As practitioners, we are trained to focus on facts and evidence. Product development requires you to think about future requirements, emerging challenges and operational scenarios that may not yet exist. Instead of asking, “What happened?”, you often find yourself asking, “What could happen?” or “How should this work?” 

More Than Digital Forensics 

When I first joined BlackRainbow, I naturally expected my digital forensic background to be my main contribution. 

To a large extent it has been. What I did not fully appreciate was how much broader the DDaCS world would be. 

Unlike many forensic products that are familiar within law enforcement, DDaCS draws on much wider operational disciplines. It extends beyond forensic investigations and information management to provide a platform for dynamic operational decision-making in complex and high-intensity operations by enhancing situational awareness and providing an operating picture.

My previous experience certainly provides useful context. However, I quickly realised that Digital Forensics is only one component of a much wider investigative environment. 

Even my earlier experience as a DDO has proved valuable because it exposed me to different operational processes and challenges. At the same time, it has been humbling to discover how many areas sit outside my own experience and expertise. 

That has probably been one of the most interesting parts of the transition. 

The Value of Practitioner Experience 

One thing that has not changed is the importance of understanding the operational environment. 

Having spent years working with investigators, prosecutors and other practitioners, I understand many of the pressures faced by end users. I know what it feels like to deal with competing priorities, urgent deadlines and the expectation of producing reliable results under scrutiny. 

That experience helps me contribute in ways that go beyond technical knowledge. It provides context. It helps me understand why certain processes exist, why some requirements matter more than others and why operational realities do not always align neatly with theory. 

At the same time, moving into the vendor side of the industry has taught me the importance of remaining open-minded. 

Just because something worked in one organisation does not mean it is the best approach for another. Different organisations have different priorities, governance structures and operational models. Success comes from understanding those differences rather than assuming everyone should work the same way. 

A Humbling Experience 

The biggest lesson from this transition is simple: there is always more to learn. 

When I moved into the technology-provider side of the industry, I arrived with over 19 years of law enforcement and investigative experience.  

What I quickly discovered was how much I did not know. 

Working on the DDaCS project has exposed me to disciplines, challenges and perspectives that extend far beyond Traditional and Digital Forensics. Every conversation seems to introduce a new concept, operational requirement or way of thinking about a problem. 

It has been both challenging and humbling to realise that being an expert in one area does not necessarily make you an expert in another. While my Digital Forensic and investigative experience gives me a solid foundation, there are many aspects of the DDaCS project and the wider business that are completely new to me. That realisation has probably been one of the most valuable lessons from this transition. 

Fortunately, I am surrounded by people with an incredible depth of knowledge and experience. Their willingness to share that knowledge has made the transition far easier than it might otherwise have been. In fairness, I’ve been fortunate throughout my career to work alongside people like this, and it’s something I have never taken for granted. 

I’d be lying if I said I never questioned whether I’d made the right move. Starting any new role can bring a degree of imposter syndrome, especially when you’re stepping into a world where so much is unfamiliar and everyone around you seems to know exactly what they’re doing. 

How long that feeling lasts is probably different for everyone, but I think it’s a fairly normal part of any significant career change. Over time, as your knowledge grows and you begin contributing more confidently, those doubts start to fade. 

The experience has reinforced something I learned long ago in Digital Forensics: the moment you think you know everything is usually the moment you stop developing. 

Looking Back on the Move from Practitioner to Provider 

Moving from digital forensics practitioner to technology provider has not meant leaving the profession behind. 

If anything, it has helped me appreciate the profession even more. 

I still rely heavily on the experience I gained as a practitioner, but I now see many challenges from a different perspective. I have a greater appreciation for the complexity involved in designing solutions that work across different organisations, operational environments and user groups. 

Most importantly, I have learned that the best solutions are developed when practitioners and technology providers work closely together. Practitioners understand the operational reality, while technology teams bring different experiences and perspectives. Bringing those viewpoints together usually leads to better outcomes than either side could achieve alone. 

For me, the transition is still ongoing. I am learning every day, just as I did throughout my career. The difference is that I now have the opportunity to see those challenges from both sides of the fence, and that perspective has proven to be one of the most valuable lessons of all. 

If there is one thing I have learned over the last 19 years, it is that careers rarely follow a straight line. Sometimes the most rewarding opportunities come from stepping outside your comfort zone and being prepared to explore something unfamiliar. 

Looking back, I am glad I took that chance. 

About the Author: 

Tomasz Czerko is a Solutions Consultant at BlackRainbow, working with law enforcement, government and enterprise organisations to address complex investigative and digital evidence challenges. With more than 19 years of experience in digital forensics and investigations, he helps organisations translate operational requirements into effective technology solutions that improve efficiency, accountability and investigative outcomes.

• Facebook
• X (Twitter)
• LinkedIn
• Mail