Computer Forensics Investigator

Computer forensics is an emerging field of criminal, data and security science concerned with uncovering digital evidence related to crimes or illicit acts. Computer forensics professionals, sometimes called “Computer Forensics Investigators,” “Computer Forensics Analysts” or other professional titles, are computing systems experts who attempt to locate such evidence.

As more and more systems like health records move online and the potential for cybercrimes increases, private companies and public agencies encounter a greater need for computer forensics experts. Innovations in technology will be tracked with parallel developments in security and forensic recovery as both fields pioneer new futures for humankind.

What Does a Computer Forensics Investigator Do?

A computer forensics analyst’s duties will vary based on the case in question. Frequently, a suspected data breach or illicit network activity will occur, and others will come to the analyst so that they can find evidence of the alleged event. Since most cybercrimes and related illegal activities are performed in attempted secrecy, a computer forensics expert will often be looking for evidence trails amidst encrypted or obscured information. They must frequently recover deleted data in order to provide evidence for both the original crime and the subsequent cover-up. A computer forensics investigator may be tasked with discovering evidence on a computer workstation, network servers or on digital media like hard drives and smartphones.

Cybercrime, Data Breaches & Information Theft

In an age where banking information, health records and corporate secrets are all regularly transferred over networks, computer forensic experts must deal with data breaches and information theft as a common case type. Other typical cybercrime cases handled by computer forensics analysts involve hacking, activities like illegal money transfers or the propagation of banned digital content such as child pornography. Counter-terrorism is an increasing duty of computer forensics analysts as entities like ISIS move their operations online and leave digital trails.

Other times, computer forensics is just one component of a physical crime case with evidence that will cross digital and real-life barriers. For instance, serial murderer Joseph E. Duncan III was able to be charged and convicted with first degree murder after the recovery of spreadsheets showing his planning of his crimes and details of his victims’ routines. The late pop singer Michael Jackson’s physician Dr. Conrad Murray was similarly able to be charged based on evidence recovered from his computer, which showed he had given Michael Jackson unsupervised access to lethal amounts of the sedative propofol.

While searching for and compiling evidence, computer forensics analysts must be able to create an audit trail detailing their process and discoveries as a contingency of due process. Methods available to private hackers are thus off-the-table since they may not allow the data to be admitted into evidence. Finally, computer forensics investigators are frequently called upon to testify and present evidence to grand juries or in court as expert witnesses.