What is a Computer Forensics Specialist?

A computer forensics specialist is an information technology professional who collects and analyzes data from computers and electronic media to be used as legal evidence in criminal investigations. This individual is an expert in recovering data, such as email, business correspondence, and other files — even deleted files — while making sure that nothing on the computer system is altered or destroyed. They might also investigate computer hacking, distribution of malicious software, or even terrorism. They are often called upon to testify in trials in which computer forensic evidence is presented.

Computer forensics specialists often work in law enforcement. They might work with local police departments or larger regional police agencies. Some work in the military or intelligence. Law firms and large corporations also sometimes hire computer forensics specialists. They might work with private companies that provide digital forensics services on a contract basis. An independent computer forensics specialist might work as a freelancer.

Usually a computer forensics specialist has at least a bachelor's degree in computer science. Many have an advanced degree in a related field, such as criminology, law, or criminal justice. Some have specific degrees in computer forensics; in addition to intensive computer study, those degree programs typically offer coursework in cyber crime and investigative methods. Some computer forensics specialists also participate in internships with law enforcement agencies.

There are many different certifications offered in computer forensics, information security, or digital forensics investigation. Some are very specific, focusing on one particular area of investigation, while others are more general and cover a broad range of topics. These certifications are available through academic institutions, professional organizations, and certification companies. Some certifications can be completed partially or entirely online. Nearly all require a test to prove proficiency.

An extensive knowledge of multiple operating systems and their architecture is essential for a computer forensics specialist. Experience with digital storage media, from CDs and DVDs to hard drives, USB drives, and even cell phones and PDAs, is important. Increasingly, computer forensics specialists must also be experts in networking and routing, in order to investigate Internet-related crime. A good knowledge of computer security methods is important as well. In some jurisdictions, computer forensics specialists are required to be licensed.

The job outlook for someone who wants to be a computer forensics specialist is strong. The sharp increase in computer crimes over recent years has led to a tremendous demand for qualified professionals in the field. This demand is likely to continue.