AdvancedAdvanced & Specialised ForensicsAI / Machine Learning ForensicsUse machine learning to sort large evidence sets and investigate AI systemsForensic Researcher
Someone has to work out how the new app stores its chats before an examiner can recover them. The forensic researcher does that work, tests whether tools get it right and publishes what they find.
Career guide8 skills6 courses
What the work is
- Studies new devices, operating system versions, apps and file formats to find where evidence lives and how it changes.
- Tests forensic tools against known data sets to measure what they recover, what they miss and where they are wrong.
- Writes parsers, scripts and sometimes full tools for artefacts that commercial products do not yet cover.
- Designs experiments with controlled test data so that a method can be validated and repeated.
- Publishes findings in papers, blog posts, conference talks or internal method documents so that practitioners can use them.
- Supports examiners on unusual cases and feeds the results back into training material.
- Keeps up with the research community and with what attackers and vendors change.
Skills to build
- Programming, usually Python, with the habit of writing code others can read and test
- Reverse engineering of file formats, databases and protocols
- Operating system and application internals across Windows, Linux, Android and iOS
- Experimental design and statistics at a working level
- Scientific writing and clear documentation
- Tool validation method, including the ideas in ISO/IEC 27041:2015 on assuring investigative methods
- The open-source forensic ecosystem and how to contribute to it
- Scepticism, including of your own results
Tools you will meet
How the role grows
Stages, not promises. Titles differ between employers and the time each stage takes depends on the cases you get to work on.
- 01Research Assistant or Graduate Researcher
Builds test data sets, runs tool comparisons and writes up results under a senior researcher.
- 02Forensic Researcher
Owns a research question, from the artefact study to the published parser or paper.
- 03Senior Researcher or Research Lead
Sets the research agenda, reviews the work of others and represents the group at conferences and with practitioners.
- 04Tool Developer or Methods Specialist
Turns research into tools and validated methods that labs can adopt, and maintains them as platforms change.
- 05Head of Research
Runs the research function of an institute, vendor or agency and decides where its effort goes.
Start at DFRTI
AdvancedAdvanced & Specialised ForensicsAI / Machine Learning ForensicsUse machine learning to sort large evidence sets and investigate AI systems
MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
MalwareIncident Response & Malware AnalysisMalware Reverse EngineeringTake malware apart safely with static and dynamic analysis, Ghidra, x64dbg and YARA.
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.
VideoSurveillance & Image / Video ForensicsDeepfake / AI ForensicsExamine face swaps and AI-made media, check C2PA provenance and know where detectors fail
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsDisciplines to read first
Questions people ask
Do I need a PhD?
For university posts, usually yes or working towards one. For vendor and institute research roles, demonstrated work matters more: published parsers, tool test results, conference talks. The DFRTI researcher role asks for a PhD or equivalent experience.
How do I start publishing?
Pick one artefact nobody has documented well, test it carefully on synthetic data, write it up and release the parser. A blog post with a reproducible method is worth more than a vague paper.
Which DFRTI courses suit a research path?
File System Analysis and Memory Forensics for depth, Malware Reverse Engineering for reversing skill and AI / Machine Learning Forensics for the direction much current research is taking.
Can I do research on real case data?
Only with authorisation and proper handling, and most research does not need it. Synthetic and published test data sets avoid privacy and legal problems and make your results reproducible.
Career guides describe typical work and skills. They do not promise employment, placement or a salary, and roles vary between employers and countries.
Ready to start?
Tell a counsellor where you are today. They will suggest the first course and the track that leads to this role.