Mobile phones in a UK evidence bag
Credit: Errant/Public Domain (found on Wikimedia Commons)

Looking for a career opportunity, but unsure of what direction to take? If you have a knack for technology and an interest in law enforcement, a career in computer forensics might be for you.

Computer forensics is a relatively new field in the scheme of things, but it is an occupation that is extremely fast growing - a potentially hot career opportunity. Many excellent jobs are likely to be found in this type of work. It is a field expected to continue a rapid expansion in the near future. California State University notes the need for skilled people working in this field will continue to grow in both law enforcement and the business community. 1

What is Computer Forensics?

Forensics is a specialized field that collects and gathers evidence that can be used as evidence to be presented in court. Computer forensics is not much different in theory from other forensics positions in this respect. The primary difference is that individuals employed in the field extract, collect and document information from computers and other digital gadgets rather than carpet fibers, fingerprints, DNA or other types of evidence.

Integrity of data is at the center of computer forensics. It is vital for experts in this position to be able to collect data without making any alterations or changes that could damage potential evidence. For instance, any time a computer file is opened, the file is altered. These changes include the vital time and date stamps. It is important absolutely nothing is compromised when presenting evidence in court. A computer forensic can do this while retaining the integrity of digital data.

Why is Computer Forensics a Fast-Growing field?

Hacking, phishing, data breaches, malware and cybercrimes are on the rise, and this has resulted in the need for skilled individuals to identify clues and recover information on computers. Digital technology is often used in crimes. Or evidence for "traditional" crimes may be found on computers that investigators need information from in order to put the pieces together to solve cases. In order to accomplish these goals, a person conducting computer forensics requires levels of specialization.

Crimes, such as identity theft, are the highest complaint received by the U.S. Federal Trade Commission for the last several years. Data breaches and malware have also become a huge issue. As a result, cybercrime is growing at a rapid rate and people with applicable skills are needed to help prevent and/or solve these crimes. Currently there is a skills gap in many cybersecurity and related fields. According to the U.S. Bureau of Labor Statistics, the computer forensics field is expected to grow 25 percent from 2012 to 2022; this rate is much higher than average when compared to all occupations. 3

Big Data
Credit: Defense Advanced Research Projects Agency (DARPA)/Public Domain (found on Wikimedia Commons)

Skills Needed to Work in Computer Forensics

Forensics is a specialized field and computer forensics is much like other forensics positions in this aspect. If you want to enter this field, you'll need to possess a certain subset of skills and attributes, such as the ability to be meticulous, organized, have strong communication skills and be very detail-oriented.

The person working in computer forensics must be able to search for and identify evidence. He or she is expected to carefully collect and preserve the data found and the chain of events associated with it. A computer forensic will also have to follow a predetermined set of guidelines to collect evidence and submit it to the proper authorities. There are many steps to follow when gathering evidence with each incidence of a potential crime and, by following a developed methodology, this eliminates room for error or tainted evidence.

A day would go something like this:

  • Get the call a potential crime was committed
  • Obtain proper authorization to seize the computer(s) in order to have access to its' components (hardware, software, server, storage media, files et al.)
  • Prepare for collection of evidence. Sterilize all media and equipment to be used in the examination process. Have the right software licenses.
  • Enter the scene, carefully document and take note of the crime scene. Photograph everything. Write down all serial numbers, note down network connections and other physical configurations of the computer(s).
  • Label all evidence and document everything along the way. Videotape entering and exiting the scene.
  • Transport everything to the lab for examination. Document everything along the journey.
  • Forensics experts need to know how to back up and mirror evidence without altering it.

After the examination is complete, the expert provides analysis of this evidence and offers an expert opinion. A specialist in this field is often called into court to testify. A critical part of being in this capacity is to have the ability to remain impartial; it is not up to the computer forensic to judge or act as jury, his or her responsibility will be to carefully extract, collect and document evidence.

 A portable Tableau forensic write-blocker attached to a hard disk drive
Credit: ErrantX/Public Domain (found on Wikimedia Commons)

Digital forensics entails using a variety of equipment to help preserve the data during examination.


Jobs in the field of computer forensics start with a good rate of pay. There are opportunities in both the public and private sectors.  According to the InfoSec Institute, a learning facility in Illinois, analysts working for state or federal law enforcement departments can earn a starting salary of US $50,000 to US $75,000 per year. 4 If the job applicant has experience, an advanced degree or a security clearance issued by the government, salaries can start even higher. In the private sector, starting salaries, on average, range from US $50,000 to US $60,000 per year. These salaries may differ slightly depending upon individual skills and geographic location, however other websites and industry forecasts seem to support these averages.

Educational Requirements

Computer forensics is a good match for people who enjoy and/or are skilled at technology and have an interest in law. Most entry-level positions need a bachelor's degree. Applicable majors to pursue include forensics, cybersecurity and criminal justice. Many colleges these days are investing in cyber-related degree programs in order to fill the high demand of experts that are anticipated as the future arrives. Additionally, several industry-related certifications (there are a number of them) that can also help boost career opportunities and land the higher-paying salaries.

While still a relatively new field, growing mostly in the past decade, computer forensics is likely to not only grow, but evolve. As mobile phones and other devices continue to replace desktop and laptop computers, it will be vital for investigators to be able to extract evidence from various kinds of mobile devices as well. People interested in computer forensics are likely to find a variety of opportunities along this career path in both the near and distant future.