A computer forensic analyst is called many different things. A computer forensic analyst can be referred to as a digital forensic examiner, a forensic computer examiner, a forensic computer analyst or a computer forensic detective. No matter what the title is though the job is the same. The National Career Service says that a computer forensic analyst’s job is to investigate computer based crime, also known as cyber crime.
There are a variety of places that they can work. A computer forensic analyst can work with the police or other security services, in a bank, or with an IT company that specializes in computer security. No matter where a computer forensic analyst works there will be a job to do. There are a range of instances that a computer forensic analyst can be asked to investigate. The National Career Service names a few:
• Hacking, online scams and fraud
• Political, industrial and commercial espionage
• Terrorist communications
• Possession of illegal pornography
• Theft of sensitive company information by employees.
When investigating their first step is to secure the initial evidence (IT system or hardware) so that nothing can be tampered with. After the system or hardware is secured they start searching to find evidence of a crime. To do that they use special computer programs to assist in the use of different forensic methods to complete the jobs duties. Listed below are the duties as described by The National Career Service:
• Find, recover, and copy data from disks that may have been hidden, encrypted, or damaged
• Reveal digital images that have been altered to mask the identity of a place or person
• Analyze mobile phone records to trace devices to a particular location. This can also be used to rule the phone or mobile device out.
• Follow electronic data trails to uncover links between individuals or groups
As well as these duties they must document the investigation at every stage. This must be done carefully. It’s important to document carefully because they need to present their findings to others, whether its law enforcement, clients, or managers, and the information needs to be accurate. Accurate information is important because a computer forensic analyst may be asked to testify in court as a witness.
For this job it is extremely important that one can maintain confidentiality as well as work well under pressure and maintain a professional image. Other requirements include being able to manage day to day aspects of client relationships, as well as forensic cases and corporate incidents. It is recommended and desirable that one has experience in a professional services firm.