The Job and What's Involved

Digital forensic analysts examine computers and other digital devices, such as mobile phones and cameras, for evidence of crime. They provide support to civil and criminal investigations and intelligence agencies by detecting, preserving, analysing and presenting digital evidence.

Digital forensics is increasingly used in investigating all types of crime including murder, terrorism, fraud, theft, drug dealing and child abuse. This is because any digital device creates its own unique equivalent of DNA or fingerprints. In a murder investigation, for example, a digital forensic analyst may examine computer data such as emails in order to link the victim and the suspect.

The use of technology to assist or commit crime is rapidly expanding. It may be known as computer crime, cybercrime, IT crime or e-crime. Criminals are using digital and computer technology in crimes such as fraud, theft and harassment. They are also generating new criminal offences, such as viruses, data theft, hacking (accessing computer systems and corrupting data or stealing information) and phishing (setting up false website's to get information from individuals and organisations).

Analysts may use digital forensic techniques to:

• Track mobile phone movements and activity.
• Recover and copy deleted data from PC's.
• Trace email and website's.
• Link photographs with cameras and software.
• Test for viruses and hackers.

They may produce digital evidence to:

- Show a crime has been committed
- Identify a suspect
- Defend innocent parties
- Help understand the motives of individuals

Analysts can collect and analyse digital evidence, even if the evidence has been deleted or corrupted. They need to know how to capture data without destroying it. Analysts forensically examine items such as computer hard drives to recover files, photographs and other data, such as emails, that may have been deleted. They carefully document each stage of their investigation and record their findings in a detailed report to use as possible future evidence. They may have to attend court cases to give evidence as technical or expert witnesses. They use hi-tech computer equipment and specialist software programs.

Analysts often work with the police in the investigation of crimes and the work may also involve contact with related professionals, such as lawyers. They usually work in a team that includes IT support.

Analysts usually work 9.00am to 5.00pm, Monday to Friday. They may have to work shifts or be on call during evenings, weekends and public holidays. The work is mainly office based.

They may have to travel to people's homes or workplaces to remove digital equipment. They may have to deal with difficult situations and be involved in confrontation.

A lot of time is spent using computers.

A driving licence would be useful.

Starting salaries may be around £20,000 to £25,000 a year.
With experience, analysts could earn between £30,000 and £60,000.

Getting Started with this Career Choice

Many digital forensic analysts work for the police in specialised crime units. Some are police officers with specialist training in digital forensics. For detailed information on entry to and training in the police, see the separate job guide - Police Officer. There are also opportunities with the e-crime unit of the Serious Organised Crime Agency (SOCA).

Analysts can also find work with specialist forensic science agencies, government agencies and intelligence services, IT security companies, large chartered accountancy firms and banks.

Digital forensics is a fast-developing area and the demand for digital forensic specialists is increasing.

Vacancies may be found on police force website's, in local and national newspapers, in specialist IT magazines such as Computer Weekly, with IT recruitment agencies, and on the specialist recruitment site www.appointments-uk.co.uk

Education and Training

Traditionally entry has been with at least a degree in an IT or computing subject and a strong computing background. However, it has increasingly become a requirement to have a specialist first degree, such as digital forensics, forensic computing and security, or computer forensics.

A number of universities offer specialist degrees, although course titles vary.

Entry to degree courses is usually with at least two A levels and five GCSE's (A*-C) including maths and English or the equivalent. Useful A levels include maths, computing, IT and science subjects. Alternative qualifications may be accepted, including a BTEC National Diploma or the International Baccalaureate. It is important to check entry requirements with individual institutions as they vary.

Those without the usual entry qualifications can take an Access course.

Degree courses are normally three years full time or four years full time as a sandwich programme with a year-long work placement that enables students to gain valuable work experience. Courses combine theory with practical work.

There are also postgraduate qualifications in digital or forensic computing for applicants with a relevant first degree, normally in a related discipline such as computing, computer science, forensic science or criminology.

Some courses have been designed to meet the requirements of relevant professional bodies, such as the British Computer Society (BCS), the Forensic Science Society (FSSoc) or the Institute of Engineering and Technology (IET). Some courses are also accredited under the Skillsmark programme, developed by Skills for Justice and the FSSoc.

Foundation degrees in computer forensics are also available. Entry to a foundation degree is usually with a minimum of one A level and four GCSE's (A*-C) or equivalent qualifications.

The Diploma in information technology may be relevant for this area of work.

Applicants have to undergo a security vetting check.

A Few More Exams You Might Need

Police staff receive specialist training from the National Policing Improvement Agency (NPIA). It offers a range of courses, such as data recovery and analysis and hi-tech crime scene searching. Specialist training is aimed at those who are working in areas such as online fraud.

Police staff may also be able to take a part-time Masters degree in cybercrime forensics offered by Canterbury Christ Church University in conjunction with the NPIA.

Digital forensic analysts need to keep up to date with ever-changing technologies and developments in their field.

Skills and Personal Qualities Needed

A digital forensic analyst should:

• Have excellent computer skills.
• Understand the law in relation to digital forensics.
• Pay careful attention to detail.
• Have a creative approach to solving problems.
• Have the ability to work under pressure and to deadlines.
• Be able to examine evidence objectively and impartially.
• Be able to deal with unpleasant material.
• Be able to write accurate and clear reports.
• Be able to communicate information clearly to non-technical people.
• Be willing to keep up with developments in technology.
• Be able to work independently and as part of a team.

Your Long Term Prospects

Digital forensic analysts may become members of the BCS and the FSSoc, which both have specialist groups for digital forensics.

Analysts may choose to specialise in mobile phones, cell site analysis, CCTV or computer forensics.

They may be promoted to senior or management positions or may move into consultancy work or into a commercial organisation.

Get Further Information

The British Computer Society (BCS), 1st Floor, Block D,
North Star House, North Star Avenue, Swindon SN2 1FA
Tel: 01793 417417
Website: www.bcs.org

Computer Forensics World
Website: www.computerforensicsworld.com

Forensic Focus
Website: www.forensicfocus.com

Skills for Justice, Centre Court,
Atlas Way, Sheffield S4 7QQ
Tel: 0114 261 1499
Websites: www.skillsforjustice.com

Other Related Jobs

• Crime Scene Investigator (CSI)
• Forensic Scientist
• Information Scientist
• Network Manager
• Police Financial Investigator
• Police Officer
• Private Investigator

Additional resources