Digital Forensics Analysts

What the job really is

Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.

At a glance

• Sector: Computer & Mathematical
• O*NET-SOC code: 15-1299
• O*NET job zone: 4 — considerable preparation
• Work sample tasks on file: 12
• Tools and technologies listed: 12

What you actually do

Work sample tasks recorded for this occupation:

• Perform forensic investigations of operating or file systems.
• Adhere to legal policies and procedures related to handling digital media.
• Analyze log files or other digital information to identify the perpetrators of network intrusions.
• Conduct predictive or reactive analyses on security measures to support cyber security initiatives.
• Create system images or capture network settings from information technology environments to preserve as evidence.
• Develop plans for investigating alleged computer crimes, violations, or suspicious activity.
• Develop policies or requirements for data collection, processing, or reporting.
• Duplicate digital evidence to use for data recovery and analysis procedures.
• Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.
• Maintain cyber defense software or hardware to support responses to cyber incidents.
• Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.
• Perform file signature analysis to verify files on storage media or discover potential hidden files.

Tools and technology

Amazon Web Services AWS software, Ansible software, Apple iOS, Apple macOS, Bash, Border Gateway Protocol BGP, C, C#, C++, Extensible markup language XML, Firewall software, Go

What employers expect you to already be comfortable with.

Where this job leads

Related occupations — the usual moves up and sideways:

• Information Security Analysts
• Information Security Engineers
• Intelligence Analysts
• Penetration Testers
• Security Management Specialists
• Security Managers
• Computer Systems Analysts
• Forensic Science Technicians

Getting in

O*NET assigns this occupation job zone 4 (considerable preparation). The related occupations above are the realistic routes in and out.

Find openings

Browse the verified job sources directory, or explore more occupations.

Check this against the source

O*NET OnLine: Digital Forensics Analysts — the authoritative public-domain profile this page is derived from, including the full task list, reported skills and the wage estimates for your region.

Derived and rewritten from the public-domain O*NET database (U.S. Department of Labor / Employment and Training Administration). Figures are observations, not promises — always confirm salary, licensing and visa requirements with the employer and the relevant authority.