digital-forensics-expert/references/tasks.md

Tasks & work activities — digital forensics expert

Source: O*NET 30.3, occupation 15-1299.06 (Digital Forensics Analysts).

Task statements

• [nan] Adhere to legal policies and procedures related to handling digital media.
• [nan] Analyze log files or other digital information to identify the perpetrators of network intrusions.
• [nan] Conduct predictive or reactive analyses on security measures to support cyber security initiatives.
• [nan] Create system images or capture network settings from information technology environments to preserve as evidence.
• [nan] Develop plans for investigating alleged computer crimes, violations, or suspicious activity.
• [nan] Develop policies or requirements for data collection, processing, or reporting.
• [nan] Duplicate digital evidence to use for data recovery and analysis procedures.
• [nan] Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.
• [nan] Maintain cyber defense software or hardware to support responses to cyber incidents.
• [nan] Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.
• [nan] Perform file signature analysis to verify files on storage media or discover potential hidden files.
• [nan] Perform forensic investigations of operating or file systems.
• [nan] Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.
• [nan] Preserve and maintain digital forensic evidence for analysis.
• [nan] Recommend cyber defense software or hardware to support responses to cyber incidents.
• [nan] Recover data or decrypt seized data.
• [nan] Write and execute scripts to automate tasks, such as parsing large data files.
• [nan] Write cyber defense recommendations, reports, or white papers using research or experience.
• [nan] Write reports, sign affidavits, or give depositions for legal proceedings.
• [nan] Write technical summaries to report findings.

Detailed work activities

• Analyze security of systems, network, or data.
• Analyze traffic data.
• Compile technical information or documentation.
• Develop technical methods or processes.
• Enter codes or other information into computers.
• Establish operational policies.
• Examine records or other types of data to investigate criminal activities.
• Identify information technology project resource requirements.
• Maintain computer equipment or software.
• Maintain knowledge of laws or regulations.
• Maintain records, documents, or other files.
• Monitor the security of digital information.
• Plan production or operational procedures or sequences.
• Provide recommendations to others about computer hardware.
• Recommend changes to improve computer or information systems.
• Record images needed to address work issues.
• Testify at legal or legislative proceedings.
• Translate information for others.
• Write computer programming code.
• Write reports or evaluations.