From financial records that don’t match those submitted to the IRS, to child pornography, computers can be the source of much incriminating evidence. Even if a person thinks they have erased their hard drive of all such material, often a skilled computer forensics analyst (or cyber forensics analyst or technical analyst) can retrieve it.
In the case of cyber crimes, not only is the computer of a suspect a potential source of relevant information, but so is the computer of the victim. So a computer forensics analyst will also often be assigned to seek clues by examining the computer of someone who has been attacked by a hacker, identity thief, etc.
Background Needed to Be a Computer Forensics Analyst
Computer forensics is a fairly new field. Many people working as computer forensic analysts have more relevant work experience than education, but in recent years more education programs have been developed that provide an appropriate background.
Someone interested in being a computer forensics analyst should get a degree in computers, including specifically study of cyber crimes, UNIX and NT, networking and routing, computer security intrusion and detection, and advanced file system recovery. In terms of job opportunities and earning potential, a bachelor’s degree is better than an associate’s degree, and a master’s degree or Ph.D. is in turn better than a bachelor’s degree.
An internship with a law enforcement agency is often the next step in acquiring qualifications after one’s classroom education.
What Does a Computer Forensics Analyst Do?
A computer forensics analyst assists a criminal investigation by examining the suspect and/or victim’s computer (or other electronic data storage and transfer devices) for relevant evidence.
At times a computer forensics analyst will be present at a crime scene to assist in identifying what devices need to be taken, and in labeling, transporting, and securing these devices. But the bulk of the job is done 9 to 5 in an office environment.
The computer forensics analyst seeks to extract all data from the computer, including active files, invisible files, deleted yet remaining files, password-protected files, and encrypted files. At times this will require forensic software applications, and at times it may be necessary to physically disassemble a device.
The job of computer forensics also involves such tasks as preparing written reports about the data recovered, assisting law enforcement in the preparation of search warrants, testifying in court as an expert witness, and researching legal issues and case law as they relate to computer forensics.
Career Prospects for a Computer Forensics Analyst
Computer forensics is a growing field, so jobs should be more plentiful moving forward. Pay varies a great deal, but generally starts in the $40,000-$50,000 range, and then increases based on education and experience.
In addition to working with law enforcement, a computer forensics analyst can take the same skills and make a living in the private sector. For example, a corporation might need a computer forensics analyst to examine its computers to see if employees have been using them for prohibited purposes. A computer forensics analyst in the private sector can either work in-house for a large corporation, work for a firm that contracts with corporations for such cyber services, or be self-employed and work on a freelance basis. The pay is sometimes more lucrative in the private sector than when working directly in law enforcement.
Dale Nute, “Advice About a Career in Forensic Science.” The Florida State University College of Criminology & Criminal Justice.
“Computer Forensics.” Legal Criminal Justice Schools.
“Computer Forensics Analyst.” Arizona Department of Public Safety.
“Computer Forensics FAQ.” The Conley Group, Inc.
“So You Want to Be a Forensic Scientist!” American Academy of Forensic Scientists.