Digital Forensics Analysts
Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.
- US jobs
- 435,370 (SOC 15-1299 group, "Computer Occupations, All Other")
- Median wage
- $116,580 a year
- Job family
- Security
Can agents do the work of digital forensics analysts?
We read the evidence for the whole job family, Security: Nearly all tasks (up from Not yet 12 months earlier)
Agents complete 90% or more of the tasks (or projects) on two direct benchmarks from independent institutions.
Evidence: Cybench, 100% of tasks completed; CyberGym, 99.2% of tasks completed.
7% of this occupation's work, by O*NET work activities, is measured by a direct benchmark (figures for the SOC 15-1299 group).
- 8%Develop operational or technical procedures or standardsNot measured
- 6%Advise others on the design or use of technologiesNot measured
- 5%Direct scientific or technical activitiesNot measured
- 4%Present research or technical informationNot measured
- 4%Test performance of computer or information systemsMeasured
- 4%Analyze performance of systems or equipmentNot measured
- 4%Evaluate the characteristics, usefulness, or performance of products or technologiesNot measured
- 4%Design computer or information systems or applicationsNot measured
Benchmarks for the job family
These cover work in security, not always this occupation's tasks.
Direct evidence
Work benchmarks mapped primary to this family. They set the step when they report how many tasks agents complete.
- 22Claude Mythos Preview (early checkpoint) · 13 Apr 2026Strong
- ARTEMIS live penetration test (agents vs. professionals)by Stanford University, Carnegie Mellon University and Gray Swan AI95.2ARTEMIS A2 (ensemble supervisor, Claude Sonnet 4 sub-agents) · 10 Dec 2025Strong
Also relevant
These benchmarks cover part of this family's work, or have no result yet. They do not set its step.
- 64.8%Claude Code + Opus 5.5 (max) · 6 Oct 2026Strong
Context only
These benchmarks span many occupations, or they test how agents behave. They give context but do not set the step.
Typical tasks
From O*NET 31.0. Core tasks first. Few of these tasks have a benchmark today.
- Duplicate digital evidence to use for data recovery and analysis procedures.
- Preserve and maintain digital forensic evidence for analysis.
- Adhere to legal policies and procedures related to handling digital media.
- Write reports, sign affidavits, or give depositions for legal proceedings.
- Perform forensic investigations of operating or file systems.
- Create system images or capture network settings from information technology environments to preserve as evidence.
- Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.
- Write technical summaries to report findings.
- Perform file signature analysis to verify files on storage media or discover potential hidden files.
- Recover data or decrypt seized data.
- Develop plans for investigating alleged computer crimes, violations, or suspicious activity.
- Analyze log files or other digital information to identify the perpetrators of network intrusions.
Other job titles for this occupation (30)
Computer Forensics Analyst · Digital Forensic Examiner · Digital Forensics Examiner · Digital Forensics Specialist · Cyber Defense Analyst · Cyber Digital Forensics · Cyber Digital Media Analyst · Cyber Forensics Analyst · Cyber Intelligence Analyst · Cyber Threat Analyst · Cyber Threat Hunter · Cyber Threat Intelligence Analyst · Cybersecurity Analyst (Cyber Analyst) · Cybersecurity Engineer (Cyber Engineer) · Cybersecurity Incident Response Analyst (Cyber Incident Response Analyst) · Cybersecurity Specialist (Cyber Specialist) · Digital Analyst · Digital Computer Analyst · Digital Cyber Analyst · Digital Forensic Analyst · Digital Investigator · Digital Media Analyst · Incident Response Analyst · Insider Threat Analyst · Law Enforcement Counterintelligence Forensics Analyst · Legal Digital Analyst · Malware Analyst · Offensive Security Engineer · Security Analyst · Threat Analyst