Computer forensics is continuing to gain importance as an effective way for investigators to collect evidence in criminal cases especially those regarding hacking, identity theft, scams, stalking, harassment, fraud, and more. As computers permeate every aspect of our lives today, they are also the go-to place for investigators to find evidence and gain much-needed information to resolve many types of offline crime cases. Forensic investigation efforts are, in fact, an important part of almost all post-incident responses to cyber-attacks, other computer-related wrong-doings, and general criminal cases. Digital data are collected to determine suspect’s movements, communications, Internet searches and anything that can connect them to victims and criminal activities. In fact, computer forensics has been a determining factor in the conviction of many offenders, including murderers and terrorists, as well as in the prevention of attacks.

This interesting profession is always welcoming new talents, so those interested in a career in Cyber Forensics will find there is a growing need in the field. First, it is important to understand what forensics scientists really do, their constraints, how they can collect data in a way that doesn’t damage, alter, or affect the material gathered while ensuring the evidence is safely kept until it will be presented in court. Besides the glamorous aspects of these positions as seen in serials and movies, a career as a computer forensics expert can be exciting as it combines the thrill of participating in investigations to the deep understanding of latest technologies, tools of the trade and investigative methods. This explains why “computer forensics is one of the fastest growing careers in security,” as mentioned by InfoSec Institute.

So, are YOU ready to take your career to the next level in a growing field with high job demand?

How to Become a Computer Forensic Expert? Training, Certifications, and Common Requirements

As mentioned by Hall Dillon in a career outlook post for the U.S. Bureau of Labor Statistics, the job of a computer forensic expert is basically to help identify criminals and analyze evidence against them, when computers and crime are intrinsically linked. A forensic analyst is often the professional that will need to determine the who, what, why, when, where, and how in a criminal investigation. Cyber forensic experts can work for the government and law enforcement agencies, but they can also be employed in the private sector. Duties will vary according to the role, however, in general, a Computer Forensics Investigator or analyst retrieves and analyzes data from computers by utilizing forensic tools and technology to extract any recoverable information whether it has been deleted, hidden or even if the storage media has been damaged or destroyed. Computer forensics experts also commonly work with Malware Analysts and Incident Responders, “in the event of an intrusion and/or suspicious computer behavior to help identify malicious programs that may have infiltrated an organization’s computer systems,” notes David Bisson, in a Tripwire’s “The State of Security” post. They might be required to take apart hardware, analyze software and network traffic as well as follow precise protocols to be able to allow investigators to use their findings in a court of law. Cyber forensics professionals also need to be ready to explain their findings and procedures during a trial if asked to do so.

It is clear, then, that digital forensics experts are professionals who couple tech-savviness with deep analytical skills. Common requirements of any pros in the field include advanced knowledge of security measures and networking, reverse software engineering, encryption, cryptology, investigation techniques and, of course, use of various forensic tools. The abilities need to include proficiency in extracting data from a variety of storage units as well as knowledge in online data tracking.

Technical skills can be acquired in a variety of ways beginning with formal university degrees. Which degree to choose is a variable as it really depends on what the professional would like to specialize on and the career path he or she would like to follow. An interesting path toward such a career would be to pursue a degree or certificate program in forensics science and crime scene investigation followed by formal education or training in the field of computer forensics. If a professional or student is unsure about whether or not this line of work is for him/her, a free course like the one offered by The American College of Forensic Examiners to its members (FEWI0107: Digital Forensics in the Twenty-First Century) is a good option to get a glimpse of what this career entails and offers.

To acquire practical skills, it is also important that professionals supplement their theoretical knowledge with specific training including traditional or online computer forensics training lectures that include real-world scenarios to learn the most effective methods and tools in the trade. The best way to become a forensics expert, in fact, is never to stop training and continue working on personal development. Keeping abreast with the latest methods is the only way to refine techniques and being successful in retrieving or reconstructing data that has been deleted or encrypted from computers or networks more effectively and efficiently. Practical, real-world experience can also be acquired through purposeful internships like the program offered by NCFTA, the National Cyber-Forensics & Training Alliance.

Another viable option is studying for and acquiring certifications in the field. A professional certification can have several benefits: it can make a pro more marketable when an employer seeks specific knowledge and expertise; it can help secure an interview by making a curriculum stand out among others; it can demonstrate the will to continue learning; it can prove that the professional has current knowledge in the field and; it can help the forensic practitioner be guided towards studying all topics that are essential to be well-rounded.

A Certified Forensic Computer Examiner (CFCE) certification offered by IACIS (the International Association of Computer Investigative Specialists) is one of many computer forensics certifications available. Other options include the vendor-neutral ISFCE Certified Computer Examiner certification, the Digital Forensics Investigation Professional (DFIP) and the EC-Council’s Computer Hacking Forensic Investigator (CHFI) certification.

The (ISC)2 Certified Cyber Forensics Professional (CCFP) credential focuses on some aspects important for any digital forensic expert. In fact, it not only focuses on forensic tools and skills, e-discovery, new technologies, malware analysis and extracting cloud data stored or transmitted, but it also covers legal requirements and ethical principles. The IACRB Certified Computer Forensics Examiner (CCFE) covers technical examination, analysis, and reporting of computer-based evidence. It focuses on information retrieving and data extracting from call logs, contacts, SMSs as well as on examination of operating systems and user applications from cell phones, smartphones, tablets, and other portable devices. It tests on conducting an in-depth analysis utilizing forensic tools, technologies, and methods and looks at dealings with forensic evidence in a way that it makes it admissible in a court of law by not altering or compromising probative content produced through the use of any forensic models.

Several training vendors can help professionals to get certified or otherwise gain valuable knowledge for their profession. InfoSec Institute’s computer forensics courses, for example, prepare students for the CCFE, CMFE, and CCFP cert examinations by teaching the necessary skills to become a Computer Forensics Investigator or Forensic Analyst. InfoSec Institute’s Computer Forensics Online training is also a means to help students gain all-important hands-on skills to use in an investigation. They will also learn the responsibilities to acquire and examine evidence from digital systems after security incidents that could be used in a civil/criminal court case, which is an essential skill in this field but that it is not a normal requirement for many other IT professionals. What’s more, students can gain knowledge from the skillsets that will ensure they obtain the knowledge, skills, and abilities needed to do the job properly in a much faster and practical way.

Job Outlook: The Positions Available to People Who Have a Background in Computer Forensics

A variety of organizations are hiring people with a background in computer forensics; law enforcement, legal firms, and all levels of government (FBI, CIA, IRS, or the Department of Homeland Security) are the most common employers. Alternatively, one can work for a forensics/IR consulting firm to do detective work using some of the best computer forensic tools. Many specialties can be found in this line of work, so it is important these professionals explore and find the forensic career that’s right for them, their interests and background. Many position titles are strongly related and require subtly different skill sets; often their investigative practices and the roles and processes overlap. Positions available in the profession include:

  • Digital forensics specialists: They are professionals that can collect, preserve, catalog and present data evidence after examination. They can specialize further in data analysis, mobile devices, or networks forensics. During a criminal investigation, they are involved specifically in the acquisition of data, investigation, and in the reporting process. Also, they are tasked with performing a variety of highly technical analyses as well as the interpretation of data found in devices for use in a court of law.
  • Computer forensics analysts: They are pros who combine a strong IT Computer Science background with forensic skills. They are often part of law enforcement groups and, as mentioned in Study.com, “work on cases involving offenses committed on the Internet (‘cyber-crime’) and examine computers that may have been involved in other types of crime in order to find evidence of illegal activity […] The role of the analyst is to recover data like documents, photos and e-mails from computer hard drives and other data storage devices, such as zip and flash drives, that have been deleted, damaged or otherwise manipulated.” They too are responsible for data interpretation and presentation of evidence in a court of law.
  • Computer forensics examiners: They are crime scene investigators who specialize in gathering IT evidence. These pros are often asked to work on cases involving digital scams or identity theft. They analyze data found on various systems and provide digital forensics reporting, feedback, and even testimony when required.
  • Computer forensics investigators or computer crime investigators: They work with law enforcement or private investigators as experts in the retrieval of information from digital devices or are tasked to test the security of information systems. These versatile professionals can retrieve info from networks, damaged drives, and encrypted media, as well as write reports and give testimony in court. They might be even required to train security personnel in the proper handling of IT evidence.

Computer Forensics Training

What’s the State of the Market and the Salary for Someone in Digital or Computer Forensics?

“The major driving factors of the global digital forensics market are increasing threats from crime and terrorist attacks,” according to Transparency Market Research (TMR) that notes how “digital forensics is witnessing substantial growth currently.” In fact, “the global digital forensics market stood at a valuation of US$2.87 bn in 2016 and is estimated to be worth US$6.65 bn by 2025, rising at a CAGR of 9.7% from 2017 and 2025.” TMR mentions how the rising use of mobile devices, cloud-based solutions, and Internet of Things technology has increased evidence-based investigations; this is driving the digital forensics market. So, when CNNMoney, in partnership with data from PayScale.com, set out to find the Best Jobs in America, Forensic PC Analyst was found amongst the ‘top 100 careers with big growth, great pay and satisfying work’.

According to PayScale.com, “A Forensic Computer Analyst earns an average salary of $68,967 per year.” Computer Forensics Experts can earn a median salary of $77,270. Of course, the salary will vary based on their position working in the private or public sector as well as according to geographical location, industry, and experience. PayScale.com also mentions, “an entry-level Forensic Computer Analyst with less than 5 years of experience can expect to earn an average total compensation of $58,000 […]. A Forensic Computer Analyst with mid-career experience which includes employees with 5 to 10 years of experience can expect to earn an average total compensation of $89,000 […]. An experienced Forensic Computer Analyst which includes employees with 10 to 20 years of experience can expect to earn an average total compensation of $99,000 […]. A Forensic Computer Analyst with late-career experience which includes employees with greater than 20 years of experience can expect to earn an average total compensation of $110,000.” For Indeed.com, a Computer Forensics Investigator earns $88,000 while a Lead Digital Forensics Examiner can earn $115,000.

Of course, a higher starting salary is possible depending on the person’s advanced degrees and job specific certifications and, obviously, location.

Conclusion

There is no denying that a career as a computer forensic analyst, or a similar role, can be incredibly exciting, and this is particularly true for those who have a passion for science and analytical work. Whether the professional’s time is spent in the lab or in the field, his or her role is to help investigators solve crimes using specific methods and many types of sophisticated equipment (eDiscovery tools and forensic software) to examine data that is collected and/or provide links between crimes, victims, and potential suspects in aim to bring offenders to justice. However, to be successful in this career, it is important to earn the right type of degree in Forensic Science and to find ways to continue fostering skills and abilities. Some type of on-the-job training as a forensic analyst is essential before they are expected to take on independent cases. “In most cases, new hires are called upon to shadow (watch) and assist experienced forensic analysts so that they can work under direct supervision,” says Forensicanalyst.org. It tells how training, as well as internships of building up your work experience, licensure, or certification for specialties within the field, are essential to enter and thrive in this growing job market.

References

Bisson, D. (2015, May 11). The Top 10 Highest Paying Jobs in Information Security – Part 2. Retrieved from https://www.tripwire.com/state-of-security/security-awareness/the-top-10-highest-paying-jobs-in-information-security-part-2/

CNNMoney. (2013). Best Jobs in America: CNNMoney/PayScale’s top 100 careers… 36. Forensic PC Analyst. Retrieved from http://money.cnn.com/pf/best-jobs/2013/snapshots/36.html

Criminology-degree.com. (n.d.). Computer Forensics Degree. Retrieved from http://www.criminology-degree.com/computer-forensics-degree.html

Dillon, H. (1999). Forensic: A Career In. Retrieved from https://www.bls.gov/careeroutlook/1999/Fall/art01.pdf

Educationnews.org. (n.d.). Computer Forensics Schools. Retrieved from http://www.educationnews.org/career-index/computer-forensics-schools/

Forensicanalyst.org. (n.d.). Computer Forensic Analyst. Retrieved from http://www.forensicanalyst.org/Computer-Forensic-Analyst.html

Forensicscolleges.com. (n.d.). Computer Forensics Examiner Job Outlook & Salary Info. Retrieved from http://www.forensicscolleges.com/careers/computer-forensics-examiner

GetEducated.com. (n.d.). Computer Forensics and Crime Investigators. Retrieved from https://www.geteducated.com/career-center/detail/computer-forensics-and-crime-investigators

InfoSec Institute. (n.d.). How to become a Computer Forensics Investigator. Retrieved from http://resources.infosecinstitute.com/job-titles/computer-forensics-investigator/

ITCareerFinder. (n.d.). InfoSec Institute: Computer Forensics Training. Retrieved from http://www.itcareerfinder.com/featured-training-providers/infosec-institute.html

Learn.org. (n.d.). What Is the Salary for Someone in Digital Forensics? Retrieved from http://learn.org/articles/What_is_the_Salary_for_Someone_in_Digital_Forensics.html

Market Research Store. (2016, April). Digital Forensics – Global Market Outlook (2015-2022). Retrieved from http://www.marketresearchstore.com/report/digital-forensics-global-market-outlook-56217

National Cyber-Forensics & Training Alliance. (n.d.). NCFTA Career Opportunities: Cyber Intelligence Analyst-Technical Background. Retrieved from http://www.ncfta.net/Home/Careers

PayScale, Inc. (n.d.). Forensic Computer Analyst Salary. Retrieved from http://www.payscale.com/research/US/Job=Forensic_Computer_Analyst/Salary

Reggiani, M. (2016, August 3). A brief introduction to Forensic Readiness. Retrieved from http://resources.infosecinstitute.com/a-brief-introduction-to-forensic-readiness/

Rouse, M. (2013, May). Definition: computer forensics (cyber forensics). Retrieved from http://searchsecurity.techtarget.com/definition/computer-forensics

Study.com. (n.d.). Computer Forensics Analyst: Job Description, Duties and Requirements. Retrieved from http://study.com/articles/Computer_Forensics_Analyst_Job_Description_Duties_and_Requirements.html

Tittel, E. & Lindros, K. (2016, December 13). Best Computer Forensics Certifications For 2017. Retrieved from http://www.tomsitpro.com/articles/computer-forensics-certifications,2-650.html

Transparency Market Research. (2015, July 30). Digital Forensics Market – Global Industry Analysis, Size, Share, Growth, Trends and Forecast 2016 – 2026. Retrieved from http://www.transparencymarketresearch.com/digital-forensics-market.html

Todd, K. J. (2013, March 13). Computer Forensics v. E-Discovery: What Every Expert Should Know. Retrieved from http://www.forensicstrategic.com/computer-forensics-v-e-discovery-what-every-expert-should-know/

Transparency Market Research. (2017, June 26). Digital Forensics Market. Retrieved from http://www.transparencymarketresearch.com/digital-forensics-market.html

U.S. Bureau of Labor Statistics. (n.d.). Forensic Science Technicians. Retrieved from https://www.bls.gov/ooh/life-physical-and-social-science/forensic-science-technicians.htm

Be Safe

Section Guide

Daniel
Brecht

View more articles from Daniel

You'll leave InfoSec Institute's Computer Forensics course with 3 industry certifications!

Section Guide

Daniel
Brecht

View more articles from Daniel