BlissPoint Analytics

Occupation AtlasDigital Forensics Analysts

O*NET · 15-1299.06

Digital Forensics Analysts

Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.

Also called Computer Forensics Analyst · Cyber Analyst · Cyber Defense Analyst · Cyber Digital Forensics · Cyber Digital Media Analyst · Cyber Engineer · Cyber Forensics Analyst · Cyber Incident Response Analyst
26 more

Cyber Intelligence Analyst · Cyber Specialist · Cyber Threat Analyst · Cyber Threat Hunter · Cyber Threat Intelligence Analyst · Cybersecurity Analyst (Cyber Analyst) · Cybersecurity Engineer (Cyber Engineer) · Cybersecurity Incident Response Analyst (Cyber Incident Response Analyst) · Cybersecurity Specialist (Cyber Specialist) · Digital Analyst · Digital Computer Analyst · Digital Cyber Analyst · Digital Forensic Analyst · Digital Forensic Examiner · Digital Forensics Examiner · Digital Forensics Specialist · Digital Investigator · Digital Media Analyst · Incident Response Analyst · Insider Threat Analyst · Law Enforcement Counterintelligence Forensics Analyst · Legal Digital Analyst · Malware Analyst · Offensive Security Engineer · Security Analyst · Threat Analyst

Job Zone 4 — Considerable Preparation NeededHolland code ICR35 skills on file

Compare with another occupationCompare with Electrical and Electronics Drafters

Job Zone

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5

Zone 4: Considerable Preparation Needed

Considerable preparation. Usually a bachelor's degree plus several years of work-related experience, knowledge, or training.

Job Zone is O*NET's rating of how much education, experience and training an occupation typically needs — a property of the work, not of anyone doing it.

Occupational interest profile

ICRInvestigative · Conventional · Realistic — the three strongest interests, in order

  • I Investigative6.11
  • C Conventional6.03
  • R Realistic3.20
  • E Enterprising2.71
  • A Artistic1.69
  • S Social1.65

RIASEC (Holland) interests on O*NET's 0–7 scale: what the work draws on, not what any individual prefers. Hover a row for what each dimension means.

Education and experience

The education level respondents say the job requires, and the most common answer for experience and training.

  • Post-Secondary Certificate7%
  • Some College Courses15%
  • Associate's Degree or other 2-year degree22%
  • Bachelor's Degree56%
Related work experience
Over 1 year, up to and including 2 years (44%)
On-site or in-plant training
Over 6 months, up to and including 1 year (26%)
On-the-job training
Over 6 months, up to and including 1 year (33%)

Typically associated skills

All 35 O*NET skills, most important first. Importance (1–5) says how much a skill matters here; level (0–7) says how much of it the work calls for, with O*NET's example of a nearby level. Neither is a proficiency rating of a person.

  • Reading Comprehensionbasic3.83.8Level 4 looks like: Understand an email from management describing new personnel policies
  • Writingbasic3.53.9Level 4 looks like: Write an email to staff outlining new directives
  • Speakingbasic3.53.8Level 4 looks like: Interview applicants to obtain personal and work history
  • Active Listeningbasic3.53.5Level 4 looks like: Answer inquiries regarding credit references
  • Judgment and Decision Making3.53.4Level 4 looks like: Evaluate a loan application for degree of risk
  • Active Learningbasic3.43.3Level 4 looks like: Determine the impact of new menu changes on a restaurant's purchasing requirements
  • Complex Problem Solving3.43.3Level 4 looks like: Redesign a floor layout to take advantage of new manufacturing techniques
  • Monitoringbasic3.33.6Level 4 looks like: Monitor a meeting and revise the agenda to ensure important topics are discussed
  • Critical Thinkingbasic3.33.4Level 4 looks like: Evaluate customer complaints and determine appropriate responses
  • Systems Analysis3.13.1Level 4 looks like: Determine how a new piece of equipment will affect production rates
  • Time Management3.03.1Level 4 looks like: Allocate the time of subordinates to projects for the coming week
  • Social Perceptiveness3.02.9Level 2 looks like: Notice that customers are angry because they have been waiting too long
Show the other 23
  • Systems Evaluation3.02.8Level 2 looks like: Determine why estimates for the time to complete a task are overly optimistic
  • Learning Strategiesbasic2.93.0Level 2 looks like: Learn a different method of completing a task from a coworker
  • Persuasion2.93.0Level 2 looks like: Solicit donations for a charity
  • Coordination2.92.9Level 2 looks like: Schedule appointments for a medical clinic
  • Service Orientation2.82.9Level 2 looks like: Ask customers if they would like a cup of coffee
  • Instructing2.62.8Level 2 looks like: Instruct a new employee in the use of a timekeeping system
  • Negotiation2.62.6Level 2 looks like: Present justification to a manager for altering a work schedule
  • Quality Control Analysis2.62.5Level 2 looks like: Inspect a draft email for errors (e.g., grammar, punctuation)
  • Mathematicsbasic2.52.8Level 2 looks like: Count the amount of change to be given to a customer
  • Management of Personnel Resources2.52.3Level 2 looks like: Encourage a coworker who is having difficulty finishing a project
  • Operations Monitoring2.52.3Level 2 looks like: Monitor completion times while running a computer program
  • Troubleshooting2.42.0Level 2 looks like: Identify the source of a leak by looking under a machine
  • Management of Financial Resources2.11.5Level 2 looks like: Use available funds to buy office supplies and record the amount of the purchase
  • Programming2.11.5Level 2 looks like: Write a program to sort objects in a database
  • Technology Design2.01.3Level 2 looks like: Adjust exercise equipment for use by a customer
  • Management of Material Resources1.91.5Level 2 looks like: Reserve a room for a management meeting
  • Repairing1.81.1Level 2 looks like: Tighten a screw to get a door to close properly
  • Equipment Selection1.61.1Level 2 looks like: Select a tool to adjust a loose part on a bicycle
  • Sciencebasic1.61.1Level 2 looks like: Conduct standard tests to determine soil quality
  • Equipment Maintenance1.60.8
  • Operations Analysis1.50.9
  • Operation and Control1.4—
  • Installation1.0—

Tasks

17 core · 3 supplemental

What people in this occupation do, as O*NET records it, core tasks first by importance (1–5).

  1. Duplicate digital evidence to use for data recovery and analysis procedures.4.9
  2. Preserve and maintain digital forensic evidence for analysis.4.9
  3. Adhere to legal policies and procedures related to handling digital media.4.8
  4. Create system images or capture network settings from information technology environments to preserve as evidence.4.5
  5. Perform forensic investigations of operating or file systems.4.5
  6. Write reports, sign affidavits, or give depositions for legal proceedings.4.5
  7. Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.4.3
  8. Write technical summaries to report findings.4.3
  9. Perform file signature analysis to verify files on storage media or discover potential hidden files.4.1
  10. Recover data or decrypt seized data.4.1
  11. Develop plans for investigating alleged computer crimes, violations, or suspicious activity.3.9
  12. Analyze log files or other digital information to identify the perpetrators of network intrusions.3.7
Show the other 8
  1. Maintain cyber defense software or hardware to support responses to cyber incidents.3.6
  2. Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.3.6
  3. Develop policies or requirements for data collection, processing, or reporting.3.5
  4. Write cyber defense recommendations, reports, or white papers using research or experience.3.2
  5. Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.3.1
  6. Conduct predictive or reactive analyses on security measures to support cyber security initiatives.3.1
  7. Write and execute scripts to automate tasks, such as parsing large data files.3.0
  8. Recommend cyber defense software or hardware to support responses to cyber incidents.2.9

Knowledge

Bodies of knowledge the work draws on.

  • Computers and Electronics4.76.1Level 7 looks like: Create a program to scan a computer for viruses
  • English Language3.74.6Level 4 looks like: Edit an article for a news website
  • Law and Government3.74.3Level 4 looks like: Prepare documents and title papers for the purchase of a new house
  • Engineering and Technology3.23.8Level 4 looks like: Design a custom office chair
  • Customer and Personal Service2.93.8Level 4 looks like: Be responsible for 10 children at daycare
  • Public Safety and Security2.93.0Level 4 looks like: Inspect a building site for safety violations
  • Education and Training2.83.5Level 4 looks like: Lead a quality improvement seminar
  • Telecommunications2.83.5Level 4 looks like: Install a wireless internet router
Show all 33
  • Administrative2.73.7Level 4 looks like: Type 30 words per minute
  • Mathematics2.63.3Level 4 looks like: Analyze data to determine areas with the highest sales
  • Administration and Management2.53.3Level 4 looks like: Monitor progress of a project to ensure timely completion
  • Communications and Media2.43.1Level 4 looks like: Host a music radio show
  • Psychology2.32.2Level 1 looks like: Monitor several children on a playground
  • Production and Processing2.12.1Level 1 looks like: Put a computer back into its packing materials
  • Mechanical1.81.8Level 1 looks like: Replace the filters in a furnace
  • Sales and Marketing1.71.4Level 1 looks like: Sell cakes at a bake sale
  • Design1.61.3Level 1 looks like: Draw a straight line 4 3/16 inches long
  • Foreign Language1.61.4Level 1 looks like: Say "please" and "thank you" in a foreign language
  • Personnel and Human Resources1.61.2Level 1 looks like: Fill out a medical claim form
  • Sociology and Anthropology1.61.3Level 1 looks like: Identify two cultures in a story as being different
  • Economics and Accounting1.51.2Level 1 looks like: Answer billing questions from credit card customers
  • Geography1.40.9Level 1 looks like: Know the capital of the United States
  • Physics1.3—
  • Transportation1.3—
  • Chemistry1.2—
  • Fine Arts1.2—
  • History and Archeology1.2—
  • Medicine and Dentistry1.2—
  • Therapy and Counseling1.2—
  • Biology1.1—
  • Building and Construction1.1—
  • Philosophy and Theology1.1—
  • Food Production1.0—

Abilities

Enduring capacities the work calls for.

  • Deductive Reasoning4.04.0Level 5 looks like: Decide what factors to consider in selecting stocks
  • Written Comprehension4.04.3Level 4 looks like: Understand an apartment lease
  • Inductive Reasoning3.94.0Level 4 looks like: Determine the prime suspect based on crime scene evidence
  • Oral Comprehension3.94.0Level 4 looks like: Understand a coach's oral instructions for a sport
  • Written Expression3.94.1Level 4 looks like: Write a job recommendation for a subordinate
  • Information Ordering3.63.8Level 2 looks like: Follow the correct steps to make change
  • Oral Expression3.63.9Level 4 looks like: Give instructions to a lost motorist
  • Problem Sensitivity3.63.9Level 4 looks like: Notice from a subtle difference in a client's mood that something is bothering them
Show all 52
  • Flexibility of Closure3.53.8Level 4 looks like: Look for a golf ball in tall grass
  • Selective Attention3.53.3Level 4 looks like: Watch security monitors for intruders throughout the night shift
  • Near Vision3.43.5Level 2 looks like: Read indicators on the dashboard of a car
  • Category Flexibility3.33.4Level 3 looks like: Classify flowers according to size, color, and smell
  • Fluency of Ideas3.33.5Level 4 looks like: Think of as many ideas as possible for the name of a new company
  • Originality3.33.5Level 4 looks like: Redesign job tasks to be interesting for employees
  • Speech Clarity3.33.1Level 4 looks like: Make stadium-wide announcements during a sporting event
  • Speech Recognition3.33.4Level 4 looks like: Identify a former customer's voice over the phone
  • Perceptual Speed3.03.0Level 2 looks like: Sort mail according to ZIP codes with no time pressure
  • Far Vision2.62.8Level 2 looks like: Read a roadside billboard
  • Speed of Closure2.62.5Level 3 looks like: Recognize a song after hearing only the first few notes
  • Memorization2.52.5Level 1 looks like: Remember the number on your bus to be sure you get back on the right one
  • Time Sharing2.52.5Level 2 looks like: Listen to music while entering numbers into a spreadsheet
  • Visual Color Discrimination2.52.5Level 1 looks like: Separate laundry into colors and whites
  • Mathematical Reasoning2.42.5Level 1 looks like: Determine how much 20 oranges will cost when they are priced at 5 for 4 dollars
  • Number Facility2.42.3Level 3 looks like: Calculate a discounted price
  • Visualization2.42.8Level 2 looks like: Imagine how to place paper in a printer so that the letterhead comes out on top
  • Hearing Sensitivity2.11.9Level 2 looks like: Notice a doorbell ringing
  • Arm-Hand Steadiness2.01.5Level 2 looks like: Light a candle
  • Auditory Attention2.01.6Level 2 looks like: Listen to a lecture while people nearby are talking
  • Finger Dexterity2.01.5Level 2 looks like: Put coins in a parking meter
  • Manual Dexterity2.01.6Level 1 looks like: Screw a light bulb into a light socket
  • Trunk Strength2.01.3Level 2 looks like: Sit up in an office chair
  • Depth Perception1.91.3Level 2 looks like: Merge a car into traffic on a city street
  • Control Precision1.81.1Level 2 looks like: Adjust a room light with a dimmer switch
  • Wrist-Finger Speed1.81.0Level 2 looks like: Use a screwdriver to twist in a screw
  • Extent Flexibility1.60.8
  • Sound Localization1.3—
  • Spatial Orientation1.3—
  • Glare Sensitivity1.1—
  • Multilimb Coordination1.1—
  • Night Vision1.1—
  • Peripheral Vision1.1—
  • Response Orientation1.1—
  • Dynamic Flexibility1.0—
  • Dynamic Strength1.0—
  • Explosive Strength1.0—
  • Gross Body Coordination1.0—
  • Gross Body Equilibrium1.0—
  • Rate Control1.0—
  • Reaction Time1.0—
  • Speed of Limb Movement1.0—
  • Stamina1.0—
  • Static Strength1.0—

Work activities

Kinds of activity the work is made of.

  • Working with Computers4.96.0Level 7 looks like: Set up a new computer system for a large multinational company
  • Updating and Using Relevant Knowledge4.76.2Level 7 looks like: Learn information related to a complex and rapidly changing technology
  • Analyzing Data or Information4.55.9
  • Documenting/Recording Information4.45.7
  • Getting Information4.45.1Level 4 looks like: Review a budget
  • Interpreting the Meaning of Information for Others4.35.4Level 4 looks like: Interpret how foreign tax laws apply to U.S. exports
  • Processing Information4.35.7
  • Identifying Objects, Actions, and Events4.15.4Level 4 looks like: Judge the suitability of food products for an event
Show all 41
  • Making Decisions and Solving Problems4.05.3Level 4 looks like: Select the location for a major retail store
  • Organizing, Planning, and Prioritizing Work4.05.0Level 4 looks like: Plan and adjust a personal to-do list according to changing demands
  • Communicating with People Outside the Organization3.95.4Level 4 looks like: Present information to potential clients about available services
  • Communicating with Supervisors, Peers, or Subordinates3.95.0Level 4 looks like: Report the results of a sales meeting to a supervisor
  • Monitoring Processes, Materials, or Surroundings3.74.6Level 4 looks like: Test electrical circuits
  • Thinking Creatively3.75.1Level 4 looks like: Adapt popular music for a high school marching band
  • Providing Consultation and Advice to Others3.64.8Level 4 looks like: Recommend a new software package to increase operational efficiency
  • Establishing and Maintaining Interpersonal Relationships3.54.6Level 4 looks like: Maintain good working relationships with almost all coworkers and clients
  • Evaluating Information to Determine Compliance with Standards3.54.7Level 4 looks like: Evaluate a complicated insurance claim for compliance with policy terms
  • Developing Objectives and Strategies3.33.8Level 4 looks like: Develop the plan to complete the merger of two organizations over a 3-year period
  • Performing Administrative Activities3.34.2Level 4 looks like: Complete tax forms for a small business
  • Repairing and Maintaining Electronic Equipment3.34.6Level 4 looks like: Make repairs by removing and replacing circuit boards
  • Scheduling Work and Activities3.33.9Level 4 looks like: Prepare the work schedule for salesclerks in a large retail store
  • Training and Teaching Others3.24.3Level 4 looks like: Teach a social sciences course to high school students
  • Inspecting Equipment, Structures, or Materials2.93.3Level 4 looks like: Inspect equipment in a chemical processing plant
  • Coaching and Developing Others2.73.6Level 4 looks like: Provide on-the-job training for administrative workers
  • Coordinating the Work and Activities of Others2.63.3Level 4 looks like: Organize the cleanup crew after a major sporting event
  • Estimating the Quantifiable Characteristics of Products, Events, or Information2.62.7
  • Guiding, Directing, and Motivating Subordinates2.63.1Level 4 looks like: Manage a small team of employees in a dynamic workplace
  • Judging the Qualities of Objects, Services, or People2.63.0Level 4 looks like: Determine the value of property lost in a fire
  • Developing and Building Teams2.42.6
  • Handling and Moving Objects2.42.7
  • Monitoring and Controlling Resources2.42.9
  • Controlling Machines and Processes2.32.4Level 1 looks like: Operate a cash register
  • Performing for or Working Directly with the Public2.32.4Level 1 looks like: Check tickets at a concert
  • Resolving Conflicts and Negotiating with Others2.32.5Level 1 looks like: Apologize to a customer who complains about waiting too long
  • Assisting and Caring for Others2.01.9Level 1 looks like: Help a coworker complete an assignment
  • Drafting, Laying Out, and Specifying Technical Devices, Parts, and Equipment2.02.0Level 1 looks like: Specify the lighting for a work area
  • Selling or Influencing Others1.81.8Level 1 looks like: Convince a coworker to assist with an assignment
  • Staffing Organizational Units1.81.8Level 1 looks like: Work in a position that has minimal staffing requirements
  • Performing General Physical Activities1.61.6Level 1 looks like: Walk between workstations in a small office
  • Repairing and Maintaining Mechanical Equipment1.61.6Level 1 looks like: Make simple, external adjustments to a door hinge with ordinary hand tools
  • Operating Vehicles, Mechanized Devices, or Equipment1.40.7Level 1 looks like: Drive a car

Work context

The conditions most characteristic of the work, on O*NET's 1–5 context scale.

  • E-Mail4.9
  • Importance of Being Exact or Accurate4.7
  • Indoors, Environmentally Controlled4.7
  • Telephone Conversations4.5
  • Impact of Decisions on Co-workers or Company Results4.4
  • Face-to-Face Discussions with Individuals and Within Teams4.3
  • Frequency of Decision Making4.1
  • Spend Time Sitting4.1
  • Freedom to Make Decisions4.0
  • Determine Tasks, Priorities and Goals3.9

Technology

64 tools

Software used in this work. In demand: among the tools job postings for this occupation name most. Hot: often named in job postings across the economy.

In demand (8)

  • Amazon Web Services AWS softwarehot
  • Linuxhot
  • Microsoft PowerShellhot
  • Pythonhot
  • Splunk Enterprisehot
  • Structured query language SQLhot
  • Firewall software
  • MITRE ATT&CK software

Hot (31; 6 more marked hot above)

  • Ansible software
  • Apple iOS
  • Apple macOS
  • Bash
  • Border Gateway Protocol BGP
  • C
  • C#
  • C++
  • Extensible markup language XML
  • Go
  • Google Workspace software
  • Hypertext markup language HTML
  • IBM Terraform
  • JavaScript
  • Kubernetes
  • Microsoft Access
  • Microsoft Active Directory
  • Microsoft Azure software
  • Microsoft Excel
  • Microsoft Office software
  • Microsoft PowerPoint
  • Microsoft Windows
  • Microsoft Windows Server
  • Oracle Java
Show the other 7
  • Perl
  • PHP
  • R
  • Ruby
  • ServiceNow
  • Slack
  • UNIX
Other tools (25)
  • AccessData FTK
  • Amazon Simple Storage Service S3
  • Cisco Systems Cisco NetFlow Collection Engine
  • Computer forensic software
  • Enterprise application integration EAI software
  • Geographic information system GIS systems
  • Graphical user interface GUI design software
  • Guidance Software EnCase Enterprise
  • IBM QRadar SIEM
  • Intrusion detection system IDS
  • Kali Linux
  • Management information systems MIS
  • Metasploit
  • Microsoft Defender Antivirus
  • Network directory services software
  • OpenVAS
  • Platform as a service PaaS
  • Portswigger BurP Suite
  • Security assertion markup language SAML
  • Single sign-on SSO
  • Snort
  • System testing software
  • Tenable Nessus
  • Web server software
  • Wireshark

Related occupations

O*NET's own list of the occupations most related to this one, closest first.

  1. Information Security Analysts
  2. Information Security Engineers
  3. Intelligence Analysts
  4. Penetration Testers
  5. Security Management Specialists
  6. Security Managers
  7. Computer Systems Analysts
  8. Forensic Science Technicians
  9. Business Intelligence Analysts
  10. Document Management Specialists

ESCO equivalents

From the official ESCO–O*NET crosswalk, strongest match first. A broader occupation takes in this one; a narrower one is a part of it.

Closest occupations

Compare any occupation →

Other O*NET occupations whose importance ratings on the 35 skills both rate are nearest to this one's, with the biggest differences named. A plain rule, not a hidden score.

Use this in your own job architecture

BlissPoint Organization Viewer can link a role directly to this occupation and suggest these skills as that role's starting requirements.

Try it free →

This page includes information from the O*NET 31.0 Database by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA), used under the CC BY 4.0 license; O*NET® is a trademark of USDOL/ETA. ESCO occupations and skills are from the European Commission's ESCO classification, and the occupation crosswalk is the official ESCO–O*NET mapping by the ESCO Secretariat with USDOL/ETA. This service uses the ESCO classification of the European Commission. BlissPoint Analytics has modified all or some of this information: skill, task and descriptor ratings are rounded to one decimal, and ESCO occupations show Job Zone and interests copied from a crosswalked O*NET occupation. USDOL/ETA has not approved, endorsed, or tested these modifications.