Guide to Careers in Cyber Investigations and Digital Forensics

Civil and criminal law, forensic investigative procedures, and the need to keep our cyber infrastructures safe and secure come together under the umbrella of cyber investigations and digital forensics. This is a category of work within the larger field of cybersecurity that involves using digital detection software, technical knowledge of cyber infrastructure components, and criminal investigative methodologies to track and identify the source or sources of cyber breaches and other unwanted incursions into networked digital systems.

Professionals working in cyber investigations collect and preserve evidence of potential cybercrimes, collaborate with cyber incident responders, database administrators, and other IT professionals, and participate in judicial and/or counterintelligence efforts to hold cybercriminals accountable for their actions. Cyber investigations and digital forensics is a crucial sub-field of cybersecurity that ensures perpetrators of cybercrimes are held accountable and that cybersecurity professionals are kept abreast of the latest data security threats. Through rigorous examination, documentation, and analyses cyber threats, businesses, organizations, and individuals are able to better prepare for and protect against cyber breaches rather than simply reacting them.

Employment Opportunities in Cyber Investigations and Digital Forensics

Professionals who are trained in cyber investigative procedures and the techniques of digital forensics have a number of common career paths and employment opportunities. These professionals may find work in law enforcement, government, and the military, as well as at large technology companies, financial institutions, and other private sector enterprises that are at elevated risk of targeting by hackers and cybercriminals. There are also cybercrime investigators and digital forensics specialists who play a consultancy role and may be self-employed or work for independent cybersecurity firms that are hired to investigate and report on hacks, network breaches, and other unwanted incursions in the networks and computer systems of businesses, organizations, government agencies, and even private citizens.

Common titles for professionals working in the field of cyber investigations and digital forensic include but are not limited to:

• Computer Forensics Investigator
• Computer Forensics Technician
• Computer Security Consultant
• Cybercrime Investigator
• Cyber Forensics and Malware Analyst
• Cyber Intrusion Analyst
• Digital Crime Specialist
• Digital Forensic Analyst
• Digital Forensics Examiner
• Digital Forensics Systems Engineer
• Forensic Computer Analyst

Knowledge, Skills, and Abilities (KSAs) for Cyber Investigators and Digital Forensics Specialists

A clear knowledge of the major components of digital infrastructures, including common computer hardware, software, operating systems, and wireless and mobile networks, as well as data storage, encryption and security protocols, is fundamental to the practice of digital forensics and cyber investigations. Indeed, this knowledge, and the skills and abilities associated with understanding digital communication and information technology infrastructures, is what distinguishes cyber investigators and computer/digital forensic analysts from traditional crime scene investigators, detectives, and forensic examiners.

However, just like traditional investigations, successful cyber investigations must comply with relevant laws and procedural protocols pertaining to the collection, processing, preservation, and presentation of digital and physical evidence. These investigations may be coordinated with internal risk mitigation efforts and/or external civil and/or criminal judicial processes, requiring those involved in cyber and digital forensics investigations to have additional, non-technical skills. Indeed, while the practice of cyber investigations and digital forensics depends heavily on technical and legal knowledge, skills, and abilities, there are a range of other proficiencies, often referred to as “soft skills,” that are important to these efforts, including interpersonal communication, critical reasoning, and psychological assessment skills.

The National Initiative for Cybersecurity Education (NICE) identifies dozens of knowledge, skills, and abilities (KSAs) commonly associated with cyber investigations and digital forensics in its NICE Workforce Framework for Cybersecurity. For ease of use, the extensive list of KSAs in the NICE Framework has been distilled to the key proficiencies detailed below through an extensive review of real-world job listings for computer, cyber, and digital investigations analysts, forensic specialists, and technicians. The lists that follow draw on actual job descriptions in order to provide a general overview of the types of skills employers are looking for in candidates for cyber investigations and digital forensics positions.

General Technical Knowledge

• Computer applications
• Digital media formats
• Mobile and wireless network operations
• Network security concepts
• Operating systems
• Physical computer components

Cyber Investigations and Digital Forensics Knowledge and Skills

• Application security risk vectors (the Open Web Application Security Projects Top Ten list)
• Chain-of-custody and evidence-preservation protocols
• Database systems and SQL
• Encryption algorithms and decryption techniques
• Federal and state criminal and judicial rules and procedural regulations
• Malware analysis tools (e.g., IDA Pro, Ghidra, WinDbg, HIEW)
• Network-based and host-based intrusion detection software (NIDS, HIDS)
• Object-oriented programming languages (C++, Java, Python)
• TOR network navigation of the dark web
• Unix/Linux, IOS, Android, and Windows operating systems
• Witness and suspect interviewing techniques

Additional Abilities

• Critical thinking and problem-solving skills
• Knowledge of Internet and digital privacy laws and intellectual property laws
• Strong attention to detail
• Strong interpersonal communication skills and the ability to communicate effectively with technical and non-technical team members both verbally and through written communication
• Understanding of criminal psychology

It is important to note that cyber investigations and digital forensics operations commonly involve the deployment of teams comprised of individuals who have KSAs in some but not all of the areas listed above. These teams work together, drawing on complementary proficiencies in order to carry out complex investigations of anomalous incidents, breaches, and failures in computer systems and networks, find evidence of potential cybercrimes, and follow formal protocols and legal procedures in order to identify the source and/or causes of hacks, incursions, attacks, and other illicit and/or malicious cyber activity.

For example, a team may have a legal specialist/lawyer responsible for compliance with federal statutes (HIPAA, the Gramm-Leach-Bliley Act, the Homeland Security Act, and FISMA) and chain-of-custody rules of evidence; a malware specialist with deep technical knowledge of computer viruses and malware analysis and debugging tools such as IDA Pro, Ghidra, WinDbg, and HIEW; and a computer crimes analyst who has studied the methodology and psychology of hackers. In contrast, a smaller company may only require one or two professionals with broad, general knowledge of the technical and legal aspects of cyber investigations. Similarly, entry-level cyber investigators are generally not expected to be proficient in every aspect of digital forensics, while senior-level investigations specialists typically have years of experience to draw on and a deeper well of skills and knowledge in various facets of cyber forensic investigations.

Training and Credentials in Cyber Investigations and Digital Forensics

There are essentially two avenues for gaining formal training in cyber investigations and digital forensics: academic degree and certificate programs, and industry bootcamp and credentialing/certification programs. Depending on where they are in their careers, current and aspiring professionals in cybersecurity, cyber investigations, and digital forensics may find that one option suits their goals and timelines better than the other. For example, individuals with minimal experience in cyber investigations and digital forensics, and who want thorough training in the field, may wish to enroll in a bachelor’s or master’s degree in cybersecurity that offers courses in this specific area.

For individuals who have prior experience in cyber investigations and digital forensics and wish to build upon their existing knowledge, or for those who have a solid foundation in computer science and/or cybersecurity concepts and wish to specialize further in their careers, graduate certificate programs and industry bootcamp/certification programs can provide a more time-efficient means for cultivating digital forensics KSAs.

Bachelor’s, Master’s, and Graduate Certificate Programs in Cyber Investigations and Digital Forensics

Many accredited, non-profit colleges and universities now offer undergraduate majors in cybersecurity either as part of a larger computer science or information technology major or as a stand-alone option. Some schools give students the option of specializing in digital/computer forensics within the cybersecurity major and there are also schools that have a designated computer investigations/digital forensics undergraduate major. These programs provide foundational education in computer science, programming, and information technology as well as some advanced training in cyber investigations, preparing students for entry-level positions in the field.

At the graduate level, many universities offer master’s programs in cybersecurity, information assurance, and/or digital/computer forensics. These programs provide advanced training in the principles and practices of information security and, in the case of programs with a digital/computer forensics focus, the application of cybersecurity knowledge to cyber investigations. A master’s level digital forensics curriculum generally consists of foundational information security courses followed by specialized coursework that covers topics in cyber threats, malware detection, encryption algorithms, incident response, forensic investigations, and legal procedures and compliance issues.

This specialized coursework – usually four, five, or six graduate courses – may also be offered in the form of a graduate certificate in digital forensics. A graduate certificate is a credential conferred by an academic institution indicating that a student has successfully completed a post-baccalaureate program consisting of several courses in a specified area of study. Master’s and graduate certificate programs in digital forensics generally prepare students to advance into intermediate and more senior-level positions in the field of cyber investigations.

Professional Credentials and Certifications in Cyber Investigations and Digital Forensics

In addition to digital forensics academic programs, there are private industry groups offering courses, bootcamps, and professional credentialing programs that provide training in digital forensics and cyber investigations. For example, the SANS Institute offers a course in Digital Forensics Essentials and many other areas of cybersecurity, as well as Global Information Assurance Certification (GIAC) credentials in a number of different specializations, including Digital Forensics & Incident Response. GIAC credentials in this area include:

• GIAC Battlefield Forensics and Acquisition (GBFA)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Advanced Smartphone Forensics (GASF)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Network Forensic Analyst (GNFA)
• GIAC Cyber Threat Intelligence (GCTI)
• GIAC Reverse Engineering Malware (GREM)
• GIAC Certified Incident Handler (GCIH)

The following are among the other industry credentials in computer investigations and digital forensics that are currently available:

• Certified Computer Examiner (CCE), offered by the International Society of Forensic Computer Examiners (ISFCE)
• Certified Computer Forensics Examiner (CCFE), Certified Mobile Forensics Examiner (CMFE), Certified Penetration Tester (CPT), and Certified Reverse Engineering Analyst (CREA), offered by the Information Assurance Certification Review Board (IACRB)
• Certified Forensic Computer Examiner (CFCE), offered by the International Association of Computer Investigative Specialists (IACIS)
• Certified Hacking Forensic Investigator (CHFI), offered by the International Council of Electronic Commerce Consultant (EC-Council)

Examples of Jobs in Cyber Investigations and Digital Forensics

The examples below are meant to provide a representative overview of jobs in digital forensics and computer investigations based on actual postings for open positions. These are only some of the types of jobs that are available in this field.

Cyber & Forensic Consulting Associate

• Primary Responsibilities: Conduct cyber fraud investigations; address anti-kickback and anti-bribery matters; and provide litigation and insurance claims support for public and private multinational clients, nonprofits, and state and local governmental agencies.
• Education: Bachelor’s degree required with a major in accounting, computer science, finance, information science, information technology, or systems engineering preferred.
• Credentials: None listed.
• Prior Experience: No requirement.
• Technical Proficiencies: Strong computer coding and operations skills.
• Other Attributes: Share and collaborate effectively with others; and communicate confidently in verbal and written form.

Digital Forensic Examiner

• Primary Responsibilities: Conduct forensic examinations of computers, networks, and mobile devices in support of civil, criminal, and internal investigations.
• Education: Bachelor’s degree in Digital Forensics or a related field.
• Credentials: None listed.
• Prior Experience: One year in digital forensics or a related field preferred.
• Technical Proficiencies: Computer programming, cloud computing, digital device imaging, troubleshooting IT issues, using digital forensics tools.
• Other Attributes: Ability to communicate effectively with non-technical clients and attorneys, collaborate with team members, and write reports.

Digital Forensic Analyst

• Primary Responsibilities: Analyze digital devices, internal computer logs, and databases; maintain forensic lab and associated tools, hardware, and software; conduct investigative interviews; and review and submit technical investigation reports.
• Education: Bachelor’s degree in Computer Forensics, Computer Science, or a related technical/investigative field.
• Credentials: GCFE credential or similar industry certification.
• Prior Experience: Five years or more in computer/digital forensics preferred.
• Technical Proficiencies: SQL, Python, data analytics software, forensic investigations tools.
• Other Attributes: Critical thinking and interpersonal communication skills.

Cyber Investigations Technical Advisor

• Primary Responsibilities: Train, advise, and mentor cybercrimes investigators; develop lower-level legal cases into larger conspiracy cases; and provide regular reports on operational developments and trends in national and international cybercrime.
• Education: Master’s degree in computer science, information technology, or a related technical field, with coursework in information systems, engineering, law, criminal justice, and political science preferred.
• Credentials: None listed.
• Prior Experience: Ten years or more of relevant technical experience countering cyberthreats.
• Technical Proficiencies: Familiarity with networked computer and mobile systems, cybersecurity protocols, and common cyberthreats.
• Other Attributes: Team leadership and problem-solving skills; and the ability to communicate effectively in written form and verbally.