爱污传媒

Skip to Main Content Skip to bottom Skip to Chat, Email, Text

What is computer forensics?

Michael Feder

Written by Michael Feder

Kathryn Uhles

Reviewed by听Kathryn Uhles, MIS, MSP,听Dean, College of Business and IT

Forensic nurse

At a glance

  • Computer forensics听blends both law enforcement and computer science, referring to the practice of searching for and preserving of digital forensics evidence.
  • Forensics can be applied to a wide variety of law enforcement and cyber cases, from traffic accidents to murder.
  • Learn more about technology and cyber degree progams!听

At times during an investigation, law enforcement and examiners might need to access and analyze data, media or other information stored on a computer. Investigators will often turn to experts in听computer forensics听鈥斕齛n investigative field of law and computer science听in which researchers search for, find and preserve forensic evidence.

Sometimes known as computer forensic science, it often starts with data recovery. Investigators who need help securing digital evidence from a laptop, tablet, phone or other connected device may turn to these professionals for forensic support.

What is computer forensics used for?

Computer forensics is useful in a wide variety of applications and can be used for both criminal and civil cases.

For example, it may be used in the following circumstances:

  • Corporate espionage cases. Forensics experts can prove corporate espionage when locating traded documents containing secrets, formulas, recipes, work processes or business plans.
  • NDA disclosure cases. An accidental or intentional breach of a nondisclosure agreement can be proved if the information was disclosed to the public through a traceable piece of technology.
  • Traffic accident testimony.听Vehicles collect digital evidence on when drivers accelerate and brake. This information can prove valuable in determining fault for a traffic violation.
  • Sexual harassment investigations.听Messages traced to phones or email addresses can support or refute sexual assault claims.
  • Fraud investigations.听Advance-fee schemes, Ponzi schemes and other fraudulent strategies often leave behind transaction records, which investigators can use to prove fraud.
  • Murder investigations.听A killer鈥檚 search history is often used to prove intention during murder investigations.

In some cases, investigators spend more time examining the file鈥檚 data than they do its contents. For example, many images contain information about when, how and where a particular photo was taken. This digital forensics information is often valuable to investigators as supporting evidence during a trial.

Computer forensics vs. cybersecurity

Computer forensics and cybersecurity are two closely related fields. Experts in both of these fields can assist investigators during active investigations, helping to analyze cyber data and providing valuable evidence that helps determine a defendant鈥檚 guilt or innocence.

They focus on a similar goal: protecting digital assets. Cybersecurity and computer forensics methodologies can be used as effective strategies in virtually any field to ensure forensic data is used only for a particular purpose.

Both fields also include data recovery strategies to help recover forensic data that might have been lost during a security breach, device damage or another issue.

Though similar, these career fields are characterized by a few key differences. While cybersecurity focuses on the prevention of theft, fraud and other kinds of forensic data loss, computer forensics is primarily concerned with data that has already been misused.

Cybersecurity teams work diligently to prevent threats from materializing. For example, they might segment networks, integrate two-factor authentication and require regular password changes to minimize risks. However, sometimes bad actors access protected data without permission.

When data is misused, computer forensics experts go to work. Using a variety of different data access and recovery strategies, these professionals work to recover forensic data without further harming it. Their findings are useful as evidence in criminal or civil trials, in addition to the value that any recovered data provides.

Jobs in computer forensics

Careers in computer forensics are among the highest-paying computer science jobs in the market today. With the right combination of education and experience, you may be able to pursue a computer forensics career across a variety of industries.

Computer forensics jobs include:

Computer forensics investigator

Overview: Retrieves sensitive information from devices like computers and phones and helps to preserve evidence. Although the U.S. Bureau of Labor Statistics (BLS) doesn鈥檛 provide salary and related data for this particular profession, the work and salary range of a computer forensics investigator are similar to that of a forensic science technician.

爱污传媒 offers a听Cybersecurity Digital Forensics Certificate, which equips you with the skills to plan, implement and monitor security measures. Click听here听to learn more.

Computer systems analyst

Overview: Analyzes an organization鈥檚 current computer network and determines more effective methods for security and device use.

Education requirements: A听, usually but not always in computer or information science.

National salary range: As of May 2023, computer systems analsts , with a median wage听$103,800, according to BLS.

Job outlook: Jobs in this field are projected to grow听, according to BLS.

Information security analyst

Overview: Proactively assesses and protects an organization鈥檚 software and hardware systems and works to mitigate threats that do arise.

Education requirements: A听听or related field is typical, and work experience is desirable.

National salary range: As of May 2023, information secuirty analysts , with a median wage of听$120,360, according to BLS.

Job outlook: The听听from 2022 to 2032, according to BLS.

The salary ranges are not specific to students or graduates of 爱污传媒. Actual outcomes vary based on multiple factors, including prior work experience, geographic location and other factors specific to the individual. 爱污传媒 does not guarantee employment, salary level or career advancement. BLS data is geographically based. Information for a specific state/city can be researched on the BLS website.

In addition to the above career choices, you might find employment in a role that integrates computer forensics into your regular tasks. For example, security consultants regularly depend on computer forensics best practices when searching devices for data.

Alternatively, you might find employment as a forensic computer analyst, working alongside other analysts on larger investigative projects.

Skills for a career in computer forensics

Whether you鈥檙e at a physical crime scene or accessing forensics through files in the device of a person of interest, your skill set can help investigators close cases and deliver accurate verdicts.

You may need the following skills for a career in computer forensics:

  • Technical proficiency: As a computer forensics professional, you鈥檒l need a deep knowledge of operating systems, hardware and software functionality, and security protocols when searching devices for evidence.
  • Investigative law: An understanding of investigative law is critical for helping you determine which types of evidence are permissible in court.
  • Interpersonal communication: The capacity to communicate with investigators, computer experts and fellow computer forensic analysts will be important for meeting project deadlines.
  • Programming: HTML, C++, Python and other coding languages are often useful when accessing data stored on secure hardware.
  • Cybersecurity: Despite the differences between cybersecurity and computer forensics, you鈥檒l likely need to understand basic cybersecurity and听IT terminology听when accessing files and bypassing firewalls.
  • Data analysis: After accessing data files, you鈥檒l need to determine which are most useful in assisting investigators.
  • Data sensitivity: You鈥檒l need to be able to comfortably work with sensitive, sometimes disturbing, data.

Even if you don鈥檛 immediately possess all of the above skills, your education and relevant industry experience should establish a solid foundation for a computer forensics career.

Education and experience for a career in computer forensics

Before you can begin a career in computer forensics, you鈥檒l need to complete your education.

Several different听technology degrees听could contribute to a successful computer forensics career. These include:

In addition to your education, you may also need to obtain one or more of the following certificates:

These brief certificate courses can complement your education and demonstrate your commitment and aptitude to a potential employer. From there, the field of computer forensics awaits both discovery and success.

Headshot of Michael Feder

ABOUT THE AUTHOR

A graduate of Johns Hopkins University and its Writing Seminars program and winner of the Stephen A. Dixon Literary Prize, Michael Feder brings an eye for detail and a passion for research to every article he writes. His academic and professional background includes experience in marketing, content development, script writing and SEO. Today, he works as a multimedia specialist at 爱污传媒 where he covers a variety of topics ranging from healthcare to IT.

Headshot of Kathryn Uhles

ABOUT THE REVIEWER

Currently Dean of the College of Business and Information Technology,听Kathryn Uhles has served 爱污传媒 in a variety of roles since 2006. Prior to joining 爱污传媒, Kathryn taught fifth grade to underprivileged youth in 爱污传媒.

checkmark

This article has been vetted by 爱污传媒's editorial advisory committee.听
Read more about our editorial process.