Investigation · IN-WRL-002 · OPM code 211
Digital Evidence Analysis
From NICE Framework Components v2.2.0
Description
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0Responsible for identifying, collecting, examining, and preserving digital evidence using controlled and documented analytical and investigative techniques.
Tasks
From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it
Free · NICE Framework Components v2.2.0T0167 Perform file signature analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0168 Perform data comparison against established database
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0172 Perform real-time forensic analysis (e.g., using Helix in conjunction with LiveView)
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0173 Perform timeline analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0179 Perform static media analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0182 Perform tier 1, 2, and 3 malware analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1064 Determine data specifications
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1065 Determine data capacity requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1090 Determine best methods for identifying the perpetrator(s) of a network intrusion
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1102 Identify intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1103 Analyze intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1104 Document what is known about intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1120 Create forensically sound duplicates of evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1121 Decrypt seized data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1159 Create technical summary of findings reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1175 Determine if digital media chain or custody processes meet Federal Rules of Evidence requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1191 Determine relevance of recovered data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1199 Identify digital evidence for analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1207 Collect documentary or physical evidence of cyber intrusion incidents, investigations, and operations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1253 Perform dynamic analysis on drives
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1256 Perform forensically sound image collection
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1282 Prepare digital media for imaging
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1301 Report forensic artifacts indicative of a particular operating system
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1322 Capture network traffic associated with malicious activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1323 Analyze network traffic associated with malicious activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1324 Process digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1325 Document digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1332 Produce incident findings reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1370 Collect intrusion artifacts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1381 Scan digital media for viruses
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1382 Mount a drive image
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1383 Utilize deployable forensics toolkit
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1486 Process forensic images
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1516 Detect concealed data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1542 Document original condition of digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1607 Recover information from forensic data sources
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2012 Check network connections
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2013 Look for indicators of intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2014 Identify devices and networks on scene
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2015 Collect devices containing digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2016 Identify areas of compromise
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2017 Acquire digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2018 Create a digital footprint of raw or physical data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2019 Process data into readable format
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2020 Prepare data for ingestion into application systems
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2021 Recover deleted or overwritten data files
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2022 Create derivative evidence from findings report
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2023 Serve as subject expert in training fact witnesses for testifying
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2024 Present factual causality to support attribution of criminal activity
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2025 Prepare technical materials for legal proceedings
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2026 Serve as liaison to prosecutors
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2027 Manage forensic laboratory accreditation processes
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yet
Knowledge
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- K0674Knowledge of computer networking protocols
- K0675Knowledge of risk management processes
- K0676Knowledge of cybersecurity laws and regulations
- K0677Knowledge of cybersecurity policies and procedures
- K0678Knowledge of privacy laws and regulations
- K0679Knowledge of privacy policies and procedures
- K0680Knowledge of cybersecurity principles and practices
- K0681Knowledge of privacy principles and practices
- K0682Knowledge of cybersecurity threats
- K0683Knowledge of cybersecurity vulnerabilities
- K0684Knowledge of cybersecurity threat characteristics
- K0696Knowledge of digital forensic data principles and practices
- K0697Knowledge of encryption algorithm capabilities and applications
- K0701Knowledge of data backup and recovery policies and procedures
- K0710Knowledge of enterprise cybersecurity architecture principles and practices
- K0724Knowledge of incident response principles and practices
- K0725Knowledge of incident response tools and techniques
- K0726Knowledge of incident handling tools and techniques
- K0744Knowledge of operating system (OS) systems and software
- K0751Knowledge of system threats
- K0752Knowledge of system vulnerabilities
- K0759Knowledge of client and server architecture
- K0760Knowledge of server diagnostic tools and techniques
- K0770Knowledge of system administration principles and practices
- K0778Knowledge of enterprise information technology (IT) architecture principles and practices
- K0786Knowledge of physical computer components
- K0787Knowledge of computer peripherals
- K0791Knowledge of defense-in-depth principles and practices
- K0793Knowledge of file extensions
- K0794Knowledge of file system implementation principles and practices
- K0795Knowledge of digital evidence seizure policies and procedures
- K0796Knowledge of digital evidence preservation policies and procedures
- K0797Knowledge of ethical hacking tools and techniques
- K0800Knowledge of evidence admissibility laws and regulations
- K0802Knowledge of chain of custody policies and procedures
- K0804Knowledge of persistent data principles and practices
- K0806Knowledge of machine virtualization tools and techniques
- K0808Knowledge of system file characteristics
- K0809Knowledge of digital forensics data characteristics
- K0810Knowledge of deployable forensics principles and practices
- K0812Knowledge of digital communication systems and software
- K0837Knowledge of hardening tools and techniques
- K0840Knowledge of hardware reverse engineering tools and techniques
- K0842Knowledge of software reverse engineering tools and techniques
- K0850Knowledge of data carving tools and techniques
- K0851Knowledge of reverse engineering principles and practices
- K0852Knowledge of anti-forensics tools and techniques
- K0853Knowledge of forensics lab design principles and practices
- K0854Knowledge of forensics lab design systems and software
- K0855Knowledge of debugging tools and techniques
- K0856Knowledge of filename extension abuse
- K0857Knowledge of malware analysis tools and techniques
- K0858Knowledge of virtual machine detection tools and techniques
- K0859Knowledge of encryption tools and techniques
- K0870Knowledge of enterprise architecture (EA) reference models and frameworks
- K0871Knowledge of enterprise architecture (EA) principles and practices
- K0892Knowledge of cyber defense laws and regulations
- K0911Knowledge of remote access tools and techniques
- K0914Knowledge of binary analysis tools and techniques
- K0915Knowledge of network architecture principles and practices
- K0916Knowledge of malware analysis principles and practices
- K0923Knowledge of operating system structures and internals
- K0941Knowledge of data concealment tools and techniques
- K0947Knowledge of computer engineering principles and practices
- K0962Knowledge of targeting laws and regulations
- K0963Knowledge of exploitation laws and regulations
- K0979Knowledge of information searching tools and techniques
- K0983Knowledge of computer networking principles and practices
- K1004Knowledge of reporting policies and procedures
- K1014Knowledge of network security principles and practices
- K1016Knowledge of code obfuscation tools and techniques
- K1055Knowledge of digital forensics principles and practices
- K1069Knowledge of virtual machine tools and technologies
- K1079Knowledge of web application security risks
- K1091Knowledge of media forensics
- K1092Knowledge of digital forensics tools and techniques
- K1115Knowledge of Chain of Custody (CoC) processes and procedures
- K1145Knowledge of data encryption practices and principles
- K1147Knowledge of data integrity principles and practices
- K1151Knowledge of digital evidence cataloging tools and techniques
- K1152Knowledge of digital evidence extraction tools and techniques
- K1153Knowledge of digital evidence handling principles and practices
- K1154Knowledge of digital evidence packaging tools and techniques
- K1155Knowledge of digital evidence preservation tools and techniques
- K1163Knowledge of forensic image processing tools and techniques
- K1175Knowledge of network monitoring tools and techniques
- K1220Knowledge of steganography practices and principles
- K1280Knowledge of approved data processing tools and techniques
- K1281Knowledge of data types and characteristics
- K1282Knowledge of predication requirements
- K1283Knowledge of court exhibit processes
- K1284Knowledge of testing and calibration in laboratory environment
Skills
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- S0156Skill in performing packet-level analysis
- S0378Skill in decrypting information
- S0385Skill in communicating complex concepts
- S0431Skill in applying critical thinking
- S0472Skill in developing virtual machines
- S0476Skill in identifying filename extension abuse
- S0499Skill in performing intelligence collection analysis
- S0579Skill in preparing reports
- S0589Skill in preserving digital evidence integrity
- S0599Skill in performing memory dump analysis
- S0605Skill in storing digital evidence
- S0606Skill in manipulating operating system components
- S0607Skill in collecting digital evidence
- S0608Skill in processing digital evidence
- S0612Skill in performing digital forensics analysis
- S0622Skill in implementing one-way hash functions
- S0623Skill in performing source code analysis
- S0624Skill in performing volatile data analysis
- S0625Skill in interpreting debugger results
- S0651Skill in performing malware analysis
- S0854Skill in performing data analysis
- S0856Skill in performing digital evidence analysis
- S0857Skill in performing dynamic analysis
- S0860Skill in performing file system forensic analysis
- S0866Skill in performing log file analysis
- S0884Skill in performing static malware analysis
- S0935Skill in live acquisition
- S0936Skill in deadbox acquisition
- S0937Skill in inspecting data for ingestion
- S0938Skill in interacting with live systems to identify active and historical networks
Workforce Automation analysis, not part of the source
O*NET jobs this role maps to
WFA · Part of the paid plan when accounts openJobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.
- Fraud Examiners, Investigators and Analysts 13-2099.04DWAs covered3 of 21
- Digital Forensics Analysts 15-1299.06DWAs covered1 of 20
- Forensic Science Technicians 19-4092.00DWAs covered0 of 20
- Detectives and Criminal Investigators 33-3021.00DWAs covered0 of 26
Equivalents
O*NET jobs
Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3- Fraud Examiners, Investigators and Analysts 13-2099.04
- Digital Forensics Analysts 15-1299.06
- Forensic Science Technicians 19-4092.00
- Detectives and Criminal Investigators 33-3021.00
DCWF work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code
Free · DoD DCWF Tool v5.3 (2026-09-25)- Forensics Analyst 211 · Cyber Enablers · linked by DCWF Tool NCWF ID