StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.Computer Forensic Analyst
A computer forensic analyst works on what people did on their computers. The job is reading disks and operating system records closely enough to say who did what, when, and how sure we can be.
Career guide8 skills6 courses
What the work is
- Images desktops, laptops and servers, or works from images made at the scene, and verifies them before touching anything else.
- Examines operating system artefacts: Windows registry and event logs, prefetch, shellbags, LNK files, browser history and their Linux and macOS equivalents.
- Recovers deleted files and carves data from unallocated space and slack space, then checks whether the recovered file is complete and genuine.
- Builds timelines that put file activity, logins, USB connections and program execution in order.
- Looks for anti-forensic steps such as wiping tools, timestamp changes and encrypted containers, and reports what they prevent.
- Writes the findings with the evidence trail for each conclusion and supports counsel or management when they need it explained further.
Skills to build
- NTFS in depth: the MFT, the USN journal, alternate data streams and timestamps
- Windows artefact analysis with the Eric Zimmerman tool set
- Linux and macOS basics: ext4, APFS, system logs and user accounts
- File carving and recovery from unallocated space
- Timeline building with Plaso and Timesketch
- Encryption awareness: BitLocker, FileVault and VeraCrypt, and what can lawfully be done when they are met
- Scripting in Python or PowerShell for repeated tasks
- Report writing that holds up to review by a second examiner
Tools you will meet
How the role grows
Stages, not promises. Titles differ between employers and the time each stage takes depends on the cases you get to work on.
- 01Junior Forensic Technician
Acquires and verifies images, runs standard processing and learns the artefacts one at a time under review.
- 02Computer Forensic Analyst
Examines systems independently, builds the timeline and writes the report. Begins to specialise in Windows, Linux or macOS.
- 03Senior Analyst or Case Lead
Leads multi-device cases, reviews the findings of other analysts and takes the questions in court or from the board.
- 04Artefact and Tool Validation Specialist
Tests how tools behave on new operating system versions, documents new artefacts and keeps the methods of the lab current.
- 05Forensic Operations Lead
Runs the computer forensics function, sets quality standards and decides how casework is allocated and reviewed.
Start at DFRTI
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.
StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.
StorageDigital Storage ForensicsSSD / NVMe ForensicsHow TRIM, garbage collection and wear levelling change evidence on SSD and NVMe drives.
StorageDigital Storage ForensicsUSB / Pen Drive ForensicsExamine pen drives and memory sticks and prove which USB device touched which computer.
StorageDigital Storage ForensicsRAID / NAS ForensicsImage RAID members, rebuild arrays virtually and examine NAS boxes after ransomware.
LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.Disciplines to read first
Questions people ask
How is this different from a digital forensic examiner?
In many labs it is the same post. Where the roles are split, the computer forensic analyst goes deeper into disks and operating systems while the examiner covers more device types. The skills in this guide are the heart of either job.
Which course first?
File System Analysis. Almost everything in computer forensics comes back to how the file system stores, deletes and timestamps data. HDD Forensics and SSD / NVMe Forensics follow naturally.
Do SSDs make the job harder?
In some ways, yes. TRIM and wear levelling mean deleted data disappears faster and recovery from unallocated space is less reliable than on a hard disk. Knowing this and saying it in the report is part of the skill.
Is a computer science degree needed?
Useful, not compulsory. Government posts often require one. Private employers test what you know about file systems and artefacts, and that can be learnt through focused training and practice.
Career guides describe typical work and skills. They do not promise employment, placement or a salary, and roles vary between employers and countries.
Ready to start?
Tell a counsellor where you are today. They will suggest the first course and the track that leads to this role.