Career profile · 15-1299
Digital Forensics Analysts
Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.
What the work can involve
- Duplicate digital evidence to use for data recovery and analysis procedures.
- Preserve and maintain digital forensic evidence for analysis.
- Adhere to legal policies and procedures related to handling digital media.
- Write reports, sign affidavits, or give depositions for legal proceedings.
- Perform forensic investigations of operating or file systems.
- Create system images or capture network settings from information technology environments to preserve as evidence.
Selected core tasks from O*NET 31.0. Responsibilities vary by employer, specialization and experience.
Preparation and entry routes
This O*NET group commonly calls for substantial preparation, often including a bachelor’s degree or considerable relevant experience. An introductory vocational course alone may not provide an entry route.
Check the route for the specific occupation where you plan to work. Education, employer experience requirements, occupational licensing and industry certification can be separate steps.
Understand the different credentials →Skills used in this occupation
- Reading Comprehension
- Active Listening
- Speaking
- Writing
- Active Learning
Selected from the highest importance ratings available in O*NET 31.0. These describe the occupation, not a particular school's curriculum.
Knowledge to build
- Computers and Electronics
- Law and Government
- English Language
- Engineering and Technology
- Customer and Personal Service
Selected from the highest importance ratings available in O*NET 31.0. These describe the occupation, not a particular school's curriculum.
Common work activities
- Working with Computers
- Updating and Using Relevant Knowledge
- Analyzing Data or Information
- Documenting/Recording Information
- Getting Information
Selected from the highest importance ratings available in O*NET 31.0. These describe the occupation, not a particular school's curriculum.
Training subjects to investigate
The federal education-to-occupation crosswalk connects this role to the subjects below. These links do not endorse a school or guarantee that any particular award qualifies a graduate for the job.
Working conditions to consider
These are the most common published responses to selected O*NET work-setting questions. They describe occupation-level survey findings, not every employer or a particular job.
| Work-setting question | Most common response | Share giving that response |
|---|---|---|
| Contact With Others | Constant contact with others | 33.3%08/2026 · sample 27 |
| Exposed to Contaminants | Never | 53.9%08/2026 · sample 26 |
| Exposed to Disease or Infections | Never | 80.0%08/2026 · sample 25 |
| Exposed to Hazardous Conditions | Never | 73.1%08/2026 · sample 26 |
| Spend Time Sitting | Continually or almost continually | 57.7%08/2026 · sample 26 |
| Spend Time Standing | Less than half the time | 69.2%08/2026 · sample 26 |
| Spend Time Using Your Hands to Handle, Control, or Feel Objects, Tools, or Controls | Never | 29.6%08/2026 · sample 27 |
| Time Pressure | Once a week or more but not every day | 48.1%08/2026 · sample 27 |
| Wear Common Protective or Safety Equipment such as Safety Shoes, Glasses, Gloves, Hearing Protection, Hard Hats, or Life Jackets | Never | 68.0%08/2026 · sample 25 |
| Work Schedules | Regular (established routine, set schedule) | 66.7%08/2026 · sample 27 |
O*NET 31.0 Work Context, selected topics. Only unsuppressed source responses with sample size at least 10 are shown. A most-common response need not be a majority. Sampling uncertainty applies; source dates vary. Ask employers about actual schedules, accessibility, protective equipment and working conditions.
Software used in the workplace
Use these O*NET examples to ask how a course builds practical digital skills. They are workplace examples, not a required shopping list or confirmation of a school’s curriculum.
- Analytical or scientific software: Guidance Software EnCase Enterprise
- Application server software: Kubernetes
- Authentication server software: Single sign-on SSO
- Cloud-based data access and sharing software: Platform as a service PaaS, Slack
- Configuration management software: IBM Terraform
- Data base user interface and query software: Amazon Web Services AWS software, Microsoft Access, ServiceNow, Structured query language SQL
- Development environment software: C, Go, Microsoft Azure software, Microsoft PowerShell
- Enterprise application integration software: Enterprise application integration EAI software, Extensible markup language XML
- Enterprise resource planning ERP software: Management information systems MIS
- Enterprise system management software: Splunk Enterprise
- Expert system software: Ansible software
- Filesystem software: Computer forensic software
Selected categories and examples from O*NET 31.0 Software Skills. Products and employer requirements change. These examples are not endorsements; check the complete official occupation profile.
Pay & employment outlook
Salary estimates for digital forensics analysts
This O*NET specialty shares the BLS 15-1299 occupation series. Pay is measured for Computer Occupations, All Other, not separately for this specialty.
The median divides workers into two equally sized groups by pay. It is not a starting salary, a school’s graduate outcome or a promise of employment. Lower percentiles are not automatically new graduates.
National outlook: 2025–2035
- Typical education for entry
- Bachelor's degree
- Related work experience
- None
- Typical on-the-job training
- None
BLS national employment projections, 2025–2035. Openings include people leaving occupations or the labor force; these are not advertised vacancies. Education categories describe typical entry, not legal eligibility or a guarantee that any specific program is sufficient.
Compare wages across 51 state/DC estimates
| State | Annual median | Hourly median | Employment |
|---|---|---|---|
| Alabama | $106,330 | $51.12 | 2,630 |
| Alaska | $105,960 | $50.94 | 710 |
| Arizona | $105,240 | $50.60 | 5,510 |
| Arkansas | $86,940 | $41.80 | 1,120 |
| California | $134,440 | $64.63 | 80,150 |
| Colorado | $139,580 | $67.10 | 11,800 |
| Connecticut | $127,720 | $61.40 | 3,100 |
| Delaware | $137,470 | $66.09 | 860 |
| District of Columbia | $156,590 | $75.29 | 17,200 |
| Florida | $105,370 | $50.66 | 13,710 |
| Georgia | $104,610 | $50.29 | 20,630 |
| Hawaii | $120,100 | $57.74 | 2,080 |
| Idaho | $98,700 | $47.45 | 1,040 |
| Illinois | $99,360 | $47.77 | 11,160 |
| Indiana | $93,540 | $44.97 | 3,340 |
| Iowa | $107,340 | $51.61 | 3,850 |
| Kansas | $103,380 | $49.70 | 1,340 |
| Kentucky | $89,420 | $42.99 | 1,850 |
| Louisiana | $77,000 | $37.02 | 5,020 |
| Maine | $107,990 | $51.92 | 900 |
| Maryland | $144,680 | $69.56 | 19,060 |
| Massachusetts | $109,590 | $52.69 | 6,170 |
| Michigan | $105,680 | $50.81 | 7,440 |
| Minnesota | $91,750 | $44.11 | 4,180 |
| Mississippi | $86,940 | $41.80 | 1,450 |
| Missouri | $101,040 | $48.58 | 14,340 |
| Montana | $81,970 | $39.41 | 540 |
| Nebraska | $92,480 | $44.46 | 2,280 |
| Nevada | $100,220 | $48.18 | 2,610 |
| New Hampshire | $91,720 | $44.10 | 970 |
| New Jersey | $108,310 | $52.07 | 12,010 |
| New Mexico | $127,090 | $61.10 | 1,650 |
| New York | $116,990 | $56.25 | 11,460 |
| North Carolina | $104,850 | $50.41 | 15,090 |
| North Dakota | $78,330 | $37.66 | 730 |
| Ohio | $109,780 | $52.78 | 6,150 |
| Oklahoma | $102,520 | $49.29 | 3,320 |
| Oregon | $97,350 | $46.80 | 2,450 |
| Pennsylvania | $107,230 | $51.55 | 14,580 |
| Rhode Island | $102,210 | $49.14 | 830 |
| South Carolina | $112,260 | $53.97 | 4,300 |
| South Dakota | $105,370 | $50.66 | 240 |
| Tennessee | $76,470 | $36.77 | 10,930 |
| Texas | $111,530 | $53.62 | 57,020 |
| Utah | $97,470 | $46.86 | 6,680 |
| Vermont | $111,530 | $53.62 | 1,320 |
| Virginia | $139,030 | $66.84 | 17,000 |
| Washington | $128,940 | $61.99 | 14,360 |
| West Virginia | $107,140 | $51.51 | 3,380 |
| Wisconsin | $88,130 | $42.37 | 4,680 |
| Wyoming | $94,520 | $45.44 | 170 |
Metropolitan and nonmetropolitan wages
Search the 472 published local-area estimates for this occupation. Metropolitan areas can cross state lines; a city’s postal name is not necessarily the statistical area’s name.
Sources: BLS May 2025 OEWS public downloads and 2025–2035 employment projections, retrieved September 9, 2026. Unpublished estimates stay unavailable. “+” means BLS’s upper reporting threshold ($239,200 annually or $115 hourly). Wages exclude self-employment and nonwage benefits. How to interpret these figures.
Compare the route and prepare for work
Questions to test the fit
- What does an entry-level working day look like, and how does it differ from the experienced role described here?
- Which tasks, work environments and schedules would I enjoy or find difficult?
- What education, supervised practice and credentials do local employers actually request?
- Can I speak with someone in the occupation or arrange a suitable workplace visit?
- How does the complete training cost compare with my realistic budget and available routes?
Related occupations to compare
- Blockchain Engineers→
- Brownfield Redevelopment Specialists and Site Managers→
- Business Intelligence Analysts→
- Clinical Data Managers→
- Compliance Managers→
- Computer and Information Research Scientists→
- Computer and Information Systems Managers→
- Computer Network Architects→
Related through shared training-subject mappings. Entry requirements can differ substantially.
Sources and attribution
This page includes information from the O*NET 31.0 Database by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA), used under CC BY 4.0. Trade School Guides selects and organizes the material and adds explanatory guidance. USDOL/ETA has not approved, endorsed or tested these modifications. Occupation code: 15-1299.06.
Training connections: CIP 2020–SOC 2018 crosswalk. Snapshot: September 8, 2026. See the methodology.