← Occupation guides

15-1299.06 · Task explorer

Digital Forensics Analysts: reported tasks and exploration worksheet

Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.

Use the skill profile to plan your next practice →

Read the task inventory

This source lists 20 tasks, including 17 marked Core and 3 marked Supplemental. Labels and dates are retained below. Employers can combine or divide these responsibilities differently; explore the task itself before assuming it belongs in every version of the role.

Task source dates: 08/2026.

20 tasks shown

Core · Task 21792 · 08/2026 · Occupational Expert

Duplicate digital evidence to use for data recovery and analysis procedures.

Core · Task 21799 · 08/2026 · Occupational Expert

Preserve and maintain digital forensic evidence for analysis.

Core · Task 21786 · 08/2026 · Occupational Expert

Adhere to legal policies and procedures related to handling digital media.

Core · Task 21804 · 08/2026 · Occupational Expert

Write reports, sign affidavits, or give depositions for legal proceedings.

Core · Task 21797 · 08/2026 · Occupational Expert

Perform forensic investigations of operating or file systems.

Core · Task 21789 · 08/2026 · Occupational Expert

Create system images or capture network settings from information technology environments to preserve as evidence.

Core · Task 21795 · 08/2026 · Occupational Expert

Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.

Core · Task 21805 · 08/2026 · Occupational Expert

Write technical summaries to report findings.

Core · Task 21796 · 08/2026 · Occupational Expert

Perform file signature analysis to verify files on storage media or discover potential hidden files.

Core · Task 21801 · 08/2026 · Occupational Expert

Recover data or decrypt seized data.

Core · Task 21790 · 08/2026 · Occupational Expert

Develop plans for investigating alleged computer crimes, violations, or suspicious activity.

Core · Task 21787 · 08/2026 · Occupational Expert

Analyze log files or other digital information to identify the perpetrators of network intrusions.

Core · Task 21794 · 08/2026 · Occupational Expert

Maintain cyber defense software or hardware to support responses to cyber incidents.

Core · Task 21798 · 08/2026 · Occupational Expert

Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.

Core · Task 21791 · 08/2026 · Occupational Expert

Develop policies or requirements for data collection, processing, or reporting.

Core · Task 21803 · 08/2026 · Occupational Expert

Write cyber defense recommendations, reports, or white papers using research or experience.

Core · Task 21793 · 08/2026 · Occupational Expert

Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.

Supplemental · Task 21788 · 08/2026 · Occupational Expert

Conduct predictive or reactive analyses on security measures to support cyber security initiatives.

Supplemental · Task 21802 · 08/2026 · Occupational Expert

Write and execute scripts to automate tasks, such as parsing large data files.

Supplemental · Task 21800 · 08/2026 · Occupational Expert

Recommend cyber defense software or hardware to support responses to cyber incidents.

Make the shortlist useful

  1. Choose one to three activities that tell you something different about the work. Avoid selecting several ways of describing the same interest.
  2. For each, write an example you can discuss or a question that would change your understanding of the role.
  3. Keep source task IDs with your notes so you can return to the same description. Do not include private employer or customer information.

The exported worksheet distinguishes the reported task from your own notes. It supports exploration, not a hiring decision or a validated assessment.

Keep your worksheet

Download before leaving this page. Unsaved writing remains only in the page and is cleared on refresh. Notes and learning actions are not sent to a server. This guide describes an occupation and supports study planning; it does not provide clinical, legal or equipment-operating procedures.

Source and practice material

Occupational context uses the O*NET® 31.0 Database from the U.S. Department of Labor, Employment and Training Administration, under CC BY 4.0. View the occupation.

Skill Workbench selected and adapted the occupational information and added its own fictional cases, calculations, guidance and worksheets. USDOL/ETA has not approved, endorsed or tested these additions. O*NET® is a trademark of USDOL/ETA.