Digital Forensics Analysts
Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.
- US jobs
- 435,370 (SOC 15-1299 group, "Computer Occupations, All Other")
- Median wage
- $116,580 a year
- Job family
- Security
Can agents do the work of digital forensics analysts?
We read the evidence at the level of the job family, Security:
- Task levelPartialMixed. Capture-the-flag and vulnerability-reproduction tasks are near their ceiling: Anthropic reports 100% on its 35-task Cybench subset, and the top CyberGym entry reproduces 98.5% of vulnerabilities (Level 1). Exploitation of real web applications is not shown: the last published CVE-Bench result is 12.5% (GPT-4o, 2025), and we found no newer frontier result.
- Project levelUnexploredNo benchmark in our collection tests security work at project scale, such as a full penetration test, a security review of a whole system, or a compliance audit.
Benchmarks for the job family
These cover work in security, not always this occupation's tasks.
Typical tasks
From O*NET 31.0. Core tasks first. Few of these tasks have a benchmark today.
- Duplicate digital evidence to use for data recovery and analysis procedures.
- Preserve and maintain digital forensic evidence for analysis.
- Adhere to legal policies and procedures related to handling digital media.
- Write reports, sign affidavits, or give depositions for legal proceedings.
- Perform forensic investigations of operating or file systems.
- Create system images or capture network settings from information technology environments to preserve as evidence.
- Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.
- Write technical summaries to report findings.
- Perform file signature analysis to verify files on storage media or discover potential hidden files.
- Recover data or decrypt seized data.
- Develop plans for investigating alleged computer crimes, violations, or suspicious activity.
- Analyze log files or other digital information to identify the perpetrators of network intrusions.
Other job titles for this occupation (30)
Computer Forensics Analyst · Digital Forensic Examiner · Digital Forensics Examiner · Digital Forensics Specialist · Cyber Defense Analyst · Cyber Digital Forensics · Cyber Digital Media Analyst · Cyber Forensics Analyst · Cyber Intelligence Analyst · Cyber Threat Analyst · Cyber Threat Hunter · Cyber Threat Intelligence Analyst · Cybersecurity Analyst (Cyber Analyst) · Cybersecurity Engineer (Cyber Engineer) · Cybersecurity Incident Response Analyst (Cyber Incident Response Analyst) · Cybersecurity Specialist (Cyber Specialist) · Digital Analyst · Digital Computer Analyst · Digital Cyber Analyst · Digital Forensic Analyst · Digital Investigator · Digital Media Analyst · Incident Response Analyst · Insider Threat Analyst · Law Enforcement Counterintelligence Forensics Analyst · Legal Digital Analyst · Malware Analyst · Offensive Security Engineer · Security Analyst · Threat Analyst