What is Computer Forensics?

Classes Start Every 8 Weeks

Whether you know exactly where you're heading, or you're still planning your next steps, it all starts with a simple conversation. Let’s talk.

Request Info

Computer forensics is a field of technology that uses investigative techniques to identify and store evidence from a computer device. Often, computer forensics is used to uncover evidence that could be used in a court of law.

Computer forensics also encompasses areas outside of investigations. Sometimes professionals in this field might be called upon to recover lost data from drives that have failed, servers that have crashed or operating systems that have been reformatted.

In this article, you'll learn about the tasks that these professionals perform, the skills they need, and how the field differs from cyber security as we explore the following sections:

When and How is Computer Forensics Used?

Computer forensics is primarily used for two separate purposes, investigation and data recovery. Here's a brief summary of how each is handled by professionals within the field.

Investigations

Computer forensics can be an essential facet of modern investigations. When a crime is committed and an investigation is started, one of the more common places to look for clues is the computer or cell phone of a suspect. This is where a computer forensics professional enters the picture.

When a suspect has been identified and their personal computer or cell phone taken into evidence, a computer forensics professional goes searching for data that is relevant to the investigation. When searching for information, they need to be careful to follow detailed procedures that allow their findings to be used as evidence. The information they uncover, whether it be documents, browsing information or even metadata, may then be used by prosecution to create a compelling case against the suspect.

Data Recovery

Aside from working to collect evidence, computer forensics professionals can also work in data recovery. When it comes to data recovery, forensics professionals can take broken hard drives, crashed servers and other compromised devices and retrieve the data that was previously lost. This is valuable for anyone who has lost important data outside of uncovering criminal evidence, such as businesses who have experienced a system crash.

Computer Forensics vs. Cyber Security

To those outside the profession, computer forensics and cyber security can seem rather similar. Both deal with criminals and computers, but despite this initial similarity, the function of each practice differs greatly.

To recap, computer forensics is focused largely on data recovery. The data recovered is often used as evidence in criminal trials, but sometimes is recovered for companies after a data loss incident. Additionally, the criminals that computer forensics professionals investigate are not always cybercriminals. Because almost everyone uses a computer, there is often valuable information on their personal device that can contribute to an investigation.

Cyber security, on the other hand, is more concerned with defense. Cyber security professionals work under a variety of job titles, but nearly all of them work to build networks and systems that are secure from potential attackers. Sometimes they use hacking to test their own networks or the networks of a client to find areas of weakness and bolster them.

Why Study Computer Forensics?

There are several great reasons to study computer forensics. First, there is the projected rate of growth within the field. The Bureau of Labor Statistics¹ estimates that the field will grow on a national level by 33% between 2020 and 2030. In addition to being a fast-growing field, the practice of computer forensics can be deeply rewarding.

Computer forensics may be a great fit for the technologically inclined and analytically minded. If you're interested in technology, analyzing data and taking part in investigations, then computer forensics might be for you.

DeVry University offers a degree specialization in Computer Forensics as one of seven specializations available within Bachelor’s Degree in Computer Information Systems program. Students pursuing the Computer Forensics specialization have the opportunity to learn more about the procedures involved in investigating crimes, understanding of leading computer forensic software applications and the laws and ethics that affect digital evidence.

What Jobs are Available in Computer Forensics?

People who have appropriate educational credentials and experience* may qualify for several different positions within the field of computer forensics. Jobs in this industry may include but are not limited to:

Computer Digital Forensic Investigator ^2,3

Computer digital forensic investigators search the personal devices of suspects in order to identify information that could be relevant to a criminal case.
Computer Programmer

Computer programmers write and evaluate code that computers use to function. Because computer forensics experts have an understanding of programming languages, they may also be qualified for computer programmer positions.
Cyber Forensics Analyst

Cyber forensics analysts help investigators and detectives during the investigation of crimes. They recover deleted or encrypted data using processes that allow it to be admitted into court.
Computer Forensics Technician

A computer forensics technician searches for information that may be relevant to an ongoing case. They search through personal devices and storage devices to uncover and submit evidence.

What Skills Do I Need for Computer Forensics?

When training to work in computer forensics, there are several skills you'll want to acquire before you pursue a position in the field. Some of these skills may include:

Programming

An understanding of programming languages is essential for digging into devices to recover difficult to find, lost or encrypted data.
ISO standards

ISO standards are a set of rules and protocols dictating the best way to perform a task. Computer forensics uses these standards, making them vital to understand.
Operating systems

Operating systems are what enable devices to perform their core set of functions. Because computer forensics professionals often work with broken or compromised devices, they need to understand operating systems in order to recover lost data.
Computer hardware and software

Computer forensics experts need to know how the software and hardware elements of a computer work in order to find the best places to look for data. It's also useful in case a repair needs to be performed in order to recover data.
Organization

Having a strong sense of organization is critical for those in the computer forensics profession. People in this field comb through data and need organizational skills in place that can help them separate irrelevant data from important information.
Cyber security standards

A computer forensics expert should have a strong grasp of the standards used in the cyber security industry.
Analytical capabilities

Finally, a computer forensics expert needs to be able to analyze the data that they uncover. Doing so can help them identify data that is of value for an investigation.

Want to Pursue a Career in Computer Forensics?

Get to know our Bachelor’s Degree Specialization in Computer Forensics and see how DeVry can help you get started on your way toward pursuing a career in computer forensics.

Request Info

¹Bureau of Labor Statistics - Information Security Analysts Growth projected on a national level. Local growth will vary by location.
²Applicants for jobs in the justice administration field may be subject to pre-employment screenings such as, but not limited to, criminal background checks, drug and/or alcohol testing, physical and/or psychological examinations and credit checks. Unsatisfactory screening results may disqualify an applicant for a position in the justice administration field. Additional government-required training programs may be necessary to obtain employment in this field.
³Employment in this occupation may require years of relevant experience.