Skip to content

O*NET-SOC 15-1299.06

Digital Forensics Analysts

Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.

From O*NET 30.3

Tasks

From O*NET 30.3, by importance, as O*NET OnLine lists them

Free · O*NET 30.3
  1. Adhere to legal policies and procedures related to handling digital media.21786
  2. Analyze log files or other digital information to identify the perpetrators of network intrusions.21787
  3. Conduct predictive or reactive analyses on security measures to support cyber security initiatives.21788
  4. Create system images or capture network settings from information technology environments to preserve as evidence.21789
  5. Develop plans for investigating alleged computer crimes, violations, or suspicious activity.21790
  6. Develop policies or requirements for data collection, processing, or reporting.21791
  7. Duplicate digital evidence to use for data recovery and analysis procedures.21792
  8. Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.21793
  9. Maintain cyber defense software or hardware to support responses to cyber incidents.21794
  10. Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.21795
  11. Perform file signature analysis to verify files on storage media or discover potential hidden files.21796
  12. Perform forensic investigations of operating or file systems.21797
  13. Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.21798
  14. Preserve and maintain digital forensic evidence for analysis.21799
  15. Recommend cyber defense software or hardware to support responses to cyber incidents.21800
  16. Recover data or decrypt seized data.21801
  17. Write and execute scripts to automate tasks, such as parsing large data files.21802
  18. Write cyber defense recommendations, reports, or white papers using research or experience.21803
  19. Write reports, sign affidavits, or give depositions for legal proceedings.21804
  20. Write technical summaries to report findings.21805

Technology Skills

From O*NET 30.3, 64 examples in 29 categories, 37 Hot Technology

Free · O*NET 30.3

Network monitoring software

  • AccessData FTK
  • Cisco Systems Cisco NetFlow Collection Engine
  • IBM QRadar SIEM
  • Snort
  • Wireshark

Storage networking software

  • Amazon Simple Storage Service S3

Data base user interface and query software

  • Amazon Web Services AWS softwareHot TechnologyIn Demand
  • Microsoft AccessHot Technology
  • ServiceNowHot Technology
  • Structured query language SQLHot TechnologyIn Demand

Expert system software

  • Ansible softwareHot Technology

Operating system software

  • Apple iOSHot Technology
  • Apple macOSHot Technology
  • BashHot Technology
  • LinuxHot TechnologyIn Demand
  • Microsoft WindowsHot Technology
  • Microsoft Windows ServerHot Technology
  • UNIXHot Technology

Switch or router software

  • Border Gateway Protocol BGPHot Technology

Development environment software

  • CHot Technology
  • GoHot Technology
  • Microsoft Azure softwareHot Technology
  • Microsoft PowerShellHot TechnologyIn Demand
  • RubyHot Technology

Object or component oriented development software

  • C#Hot Technology
  • C++Hot Technology
  • Oracle JavaHot Technology
  • PerlHot Technology
  • PythonHot TechnologyIn Demand
  • RHot Technology

Filesystem software

  • Computer forensic software

Enterprise application integration software

  • Enterprise application integration EAI software
  • Extensible markup language XMLHot Technology

Network security and virtual private network VPN equipment software

  • Firewall softwareIn Demand

Geographic information system

  • Geographic information system GIS systems

Office suite software

  • Google Workspace softwareHot Technology
  • Microsoft Office softwareHot Technology

Graphical user interface development software

  • Graphical user interface GUI design software

Analytical or scientific software

  • Guidance Software EnCase Enterprise

Web platform development software

  • Hypertext markup language HTMLHot Technology
  • JavaScriptHot Technology
  • PHPHot Technology
  • Security assertion markup language SAML

Configuration management software

  • IBM TerraformHot Technology

Network security or virtual private network VPN management software

  • Intrusion detection system IDS

Program testing software

  • Kali Linux
  • MITRE ATT&CK softwareIn Demand
  • System testing software

Application server software

  • KubernetesHot Technology

Enterprise resource planning ERP software

  • Management information systems MIS

Transaction security and virus protection software

  • Metasploit
  • Microsoft Defender Antivirus
  • OpenVAS
  • Portswigger BurP Suite
  • Tenable Nessus

Internet directory services software

  • Microsoft Active DirectoryHot Technology
  • Network directory services software

Spreadsheet software

  • Microsoft ExcelHot Technology

Presentation software

  • Microsoft PowerPointHot Technology

Cloud-based data access and sharing software

  • Platform as a service PaaS
  • SlackHot Technology

Authentication server software

  • Single sign-on SSO

Enterprise system management software

  • Splunk EnterpriseHot TechnologyIn Demand

Transaction server software

  • Web server software

Detailed Work Activities

From O*NET 30.3, under their work activities; open one for the AI skills Workforce Automation maps to it

Free · O*NET 30.3

Getting Information

  • Examine records or other types of data to investigate criminal activities.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Monitoring Processes, Materials, or Surroundings

  • Monitor the security of digital information.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 5 of 7 AI skills mapped to this activity, by automation level

    • Replaces 1
    • Augments 2
    • Informs 4

Processing Information

  • Compile technical information or documentation.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Analyzing Data or Information

  • Analyze traffic data.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet
  • Analyze security of systems, network, or data.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Making Decisions and Solving Problems

  • Identify information technology project resource requirements.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Thinking Creatively

  • Establish operational policies.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Updating and Using Relevant Knowledge

  • Maintain knowledge of laws or regulations.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Organizing, Planning, and Prioritizing Work

  • Plan production or operational procedures or sequences.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Working with Computers

  • Write computer programming code.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet
  • Enter codes or other information into computers.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Drafting, Laying Out, and Specifying Technical Devices, Parts, and Equipment

  • Develop technical methods or processes.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Repairing and Maintaining Electronic Equipment

  • Maintain computer equipment or software.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Documenting/Recording Information

  • Write reports or evaluations.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet
  • Record images needed to address work issues.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet
  • Maintain records, documents, or other files.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Interpreting the Meaning of Information for Others

  • Translate information for others.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Communicating with People Outside the Organization

  • Testify at legal or legislative proceedings.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Providing Consultation and Advice to Others

  • Provide recommendations to others about computer hardware.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet
  • Recommend changes to improve computer or information systems.
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: 0 of 0 AI skills mapped to this activity, by automation level

    • No tools yet
    • Not mapped yet

Job Zone

From O*NET 30.3

Free · O*NET 30.3

Job Zone Four: Considerable Preparation Needed

Workforce Automation analysis, not part of the source

WFA coverage: AI skills for this job

WFA · Part of the paid plan when accounts open

Pilot mapping: these skill links come from our seed list and haven’t been reviewed yet. Expect them to change as each one is checked.

DWAs covered by an AI skill1 of 20
Distinct tools7
Level mix
  • Replaces 1
  • Augments 2
  • Informs 4

Equivalents

NICE work roles, with their DCWF equivalents

Mapped to this job by the ETO-CSET NICE/O*NET crosswalk (2024); roles from NICE Framework Components v2.2.0, DCWF equivalents from DoD DCWF Tool v5.3 (2026-09-25)

Free · NICE Framework Components v2.2.0 and DoD DCWF Tool v5.3 (2026-09-25)