Digital Forensics Analysts
Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.
Also called: Computer Forensics Analyst, Cyber Defense Analyst, Cyber Digital Forensics, Cyber Digital Media Analyst, Cyber Forensics Analyst, Cyber Intelligence Analyst
Median pay
$116,580
Pay for the broader BLS group “Computer Occupations, All Other”
Pay range (10th–90th)
$55,940 – $188,470
People employed
435,370
Whole BLS group
Holland code
ICR
Investigative · Conventional · Realistic
Updated October 2026 · Data: O*NET 31.0 and BLS OEWS May 2025 · How we match careers
Is this career right for you?
These are the things that stand out in this job compared with other U.S. jobs (O*NET 31.0 work context). Answer honestly.
- 1.Are you happy working mostly on your own, with little contact with others?
- 2.Do you prefer doing your own work rather than directing others?
- 3.Are you comfortable sitting at a desk most of the day?
The hard parts
- Tight deadlines are common
- Mistakes can have serious consequences
Digital Forensics Analysts pay by state
Highest-paying states
Annual median pay by state (50 states and DC with published data). Source: BLS OEWS May 2025, for the broader group “Computer Occupations, All Other”.
What digital forensics analysts do
- 01Duplicate digital evidence to use for data recovery and analysis procedures.
- 02Preserve and maintain digital forensic evidence for analysis.
- 03Adhere to legal policies and procedures related to handling digital media.
- 04Write reports, sign affidavits, or give depositions for legal proceedings.
- 05Perform forensic investigations of operating or file systems.
- 06Create system images or capture network settings from information technology environments to preserve as evidence.
Skills that matter most
- Reading Comprehension
- Speaking
- Active Listening
- Writing
- Active Learning
- Monitoring
Knowledge
- Computers and Electronics
- Law and Government
- English Language
- Engineering and Technology
- Customer and Personal Service
Work styles that stand out
- Dependability
- Attention to Detail
- Integrity
- Cautiousness
- Intellectual Curiosity
Education and first steps
O*NET has no education survey data for this job.
How people get started
- Usually needs a bachelor's degree (O*NET Job Zone 4).
- Related work experience: over 1 year, up to and including 2 years.
- On-the-job training: over 6 months, up to and including 1 year.
- A professional certification is often expected.
Most common answers from O*NET 31.0 Education, Training and Experience.
Interest fit (Holland code)
O*NET occupational interest scores, scale 1–7. Take the Free Career Test to compare with your own.
Career changes
Change from digital forensics analysts
- Intelligence Analysts86% · group pay
- Security Management Specialists84% · group pay
- Business Intelligence Analysts81% · group pay
- Statistical Assistants76% · —
- Bioinformatics Technicians76% · group pay
Change into digital forensics analysts
Jobs whose skills carry over best (skill match, their median pay).
- Intelligence Analysts86% · $93,790
- Security Management Specialists84% · $83,050
- Forensic Science Technicians75% · $72,060
- Fraud Examiners, Investigators and Analysts75% · $81,100
- Social Science Research Assistants75% · $61,990
Majors that lead here
- Computer and Information Sciences, General
- Data Processing and Data Processing Technology/Technician
- Information Science/Studies
- Computer Science
- Information Technology Project Management
- Bioinformatics
- Computational Biology
- Mathematics and Computer Science
- Accounting and Computer Science
- Computational Science
- Human Computer Interaction
- Cheminformatics/Chemistry Informatics
From the NCES CIP 2020 to SOC 2018 crosswalk.