Digital forensics experts retrieve and analyse information from computers and other types of data storage devices. They examine digital media that may have been hidden, encrypted or damaged, in a forensic manner with the aim to identify, preserve, recover, analyse and present facts and opinions about the digital information.
ISCO skill level is defined as a function of the complexity and range of tasks and duties to be performed in an occupation. It is measured on a scale from 1 to 4, with 1 the lowest level and 4 the highest, by considering:
the nature of the work performed in an occupation in relation to the characteristic tasks and duties
the level of formal education required for competent performance of the tasks and duties involved and
the amount of informal on-the-job training and/or previous experience in a related occupation required for competent performance of these tasks and duties.
Digital forensics expert is a Skill level 4 occupation.
These occupations require some skills and knowledge of digital forensics expert. They also require other skills and knowledge, but at a higher ISCO skill level, meaning these occupations are accessible from a position of digital forensics expert with a significant experience and/or extensive training.
This knowledge should be acquired through learning to fulfill the role of digital forensics expert.
Computer forensics: The process of examining and recovering digital data from sources for legal evidence and crime investigation. Ict network security risks: The security risk factors, such as hardware and software components, devices, interfaces and policies in ICT networks, risk assessment techniques that can be applied to assess the severity and the consequences of security threats and contingency plans for each security risk factor. Ict security standards: The standards regarding ICT security such as ISO and the techniques required to ensure compliance of the organisation with them. Resource description framework query language: The query languages such as SPARQL which are used to retrieve and manipulate data stored in Resource Description Framework format (RDF). Query languages: The field of standardised computer languages for retrieval of information from a database and of documents containing the needed information. Information confidentiality: The mechanisms and regulations which allow for selective access control and guarantee that only authorised parties (people, processes, systems and devices) have access to data, the way to comply with confidential information and the risks of non-compliance. Penetration testing tool: The specialised ICT tools which test security weaknesses of the system for potentially unauthorised access to system information such as Metasploit, Burp suite and Webinspect.
These skills are necessary for the role of digital forensics expert.
Manage it security compliances: Guide application and fulfilment of relevant industry standards, best practices and legal requirements for information security. Gather data for forensic purposes: Collect protected, fragmented or corrupted data and other online communication. Document and present findings from this process. Provide ict consulting advice: Advise on appropriate solutions in the field of ICT by selecting alternatives and optimising decisions while taking into account potential risks, benefits and overall impact to professional customers. Perform forensic preservations of digital devices: Preserve integrity of ICT devices, such as laptops, desktops and other digital media, by storing them physically and using software such as PTK Forensics and EnCase to retrieve, store and trace digital information in a legal manner so that they can be used as evidence at an appropriate time. Develop information security strategy: Create company strategy related to the safety and security of information in order to maximise information integrity, availability and data privacy. Use software for data preservation: Utilise specialised applications and software to collect and preserve digital information. Use scripting programming: Utilise specialised ICT tools to create computer code that is interpreted by the corresponding run-time environments in order to extend applications and automate common computer operations. Use programming languages which support this method such as Unix Shell scripts, JavaScript, Python and Ruby. Educate on data confidentiality: Share information with and instruct users in the risks involved with data, especially risks to the confidentiality, integrity, or availability of data. Educate them on how to ensure data protection. Manage data for legal matters: Collect, organise and prepare data for analysis and review during investigation, regulatory filings and other legal processes. Implement ict network diagnostic tools: Use software tools or components that monitor ICT network parameters, such as performance and throughput, provide data and statistics, diagnose errors, failures or bottlenecks and support decision making. Secure sensitive customer’s information: Select and apply security measures and regulations related to sensitive customer information with the aim of protecting their privacy. Perform security vulnerability assessments: Execute types of security testing, such as network penetration testing, wireless testing, code reviews, wireless and/or firewall assessments in accordance with industry-accepted methods and protocols to identify and analyse potential vulnerabilities. Identify ict security risks: Apply methods and techniques to identify potential security threats, security breaches and risk factors using ICT tools for surveying ICT systems, analysing risks, vulnerabilities and threats and evaluating contingency plans.
This knowledge is sometimes, but not always, required for the role of digital forensics expert. However, mastering this knowledge allows you to have more opportunities for career development.
Hardware platforms: The characteristics of the hardware configuration required to process the applications software product. Information security strategy: The plan defined by a company which sets the information security objectives and measures to mitigate risks, define control objectives, establish metrics and benchmarks while complying with legal, internal and contractual requirements. Mdx: The computer language MDX is a query language for retrieval of information from a database and of documents containing the needed information. It is developed by the software company Microsoft. Information architecture: The methods through which information is generated, structured, stored, maintained, linked, exchanged and used. Nessus: The computer program Nessus is a specialised ICT tool which tests security weaknesses of the system for potentially unauthorised access to system information, developed by the software company Tenable Network Security. Xquery: The computer language XQuery is a query language for retrieval of information from a database and of documents containing the needed information. It is developed by the international standards organisation World Wide Web Consortium. Sparql: The computer language SPARQL is a query language for retrieval of information from a database and of documents containing the needed information. It is developed by the international standards organisation World Wide Web Consortium. Ict security legislation: The set of legislative rules that safeguards information technology, ICT networks and computer systems and legal consequences which result from their misuse. Regulated measures include firewalls, intrusion detection, anti-virus software and encryption. Ldap: The computer language LDAP is a query language for retrieval of information from a database and of documents containing the needed information. Data storage: The physical and technical concepts of how digital data storage is organised in specific schemes both locally, such as hard-drives and random-access memories (RAM) and remotely, via network, internet or cloud. Legal requirements of ict products: The international regulations related to the development and use of ICT products. Cloud technologies: The technologies which enable access to hardware, software, data and services through remote servers and software networks irrespective of their location and architecture. Linq: The computer language LINQ is a query language for retrieval of information from a database and of documents containing the needed information. It is developed by the software company Microsoft. Ict encryption: The conversion of electronic data into a format which is readable only by authorized parties which use key encryption techniques, such as Public Key Infrastructure (PKI) and Secure Socket Layer (SSL). Hardware architectures: The designs laying out the physical hardware components and their interconnections. Whitehat sentinel: The computer program WhiteHat Sentinel is a specialised ICT tool which tests security weaknesses of the system for potentially unauthorised access to system information, developed by the software company WhiteHat Security. Nexpose: The computer program Nexpose is a specialised ICT tool which tests security weaknesses of the system for potentially unauthorised access to system information, developed by the software company Rapid7. N1ql: The computer language N1QL is a query language for retrieval of information from a database and of documents containing the needed information. It is developed by the software company Couchbase.
These skills and competences are sometimes, but not always, required for the role of digital forensics expert. However, mastering these skills and competences allows you to have more opportunities for career development.
Design computer network: Develop and plan ICT networks, such as wide area network and local area network, that connect computers using cable or wireless connections and allow them to exchange data and assess their capacity requirements. Use different communication channels: Make use of various types of communication channels such as verbal, handwritten, digital and telephonic communication with the purpose of constructing and sharing ideas or information. Perform data mining: Explore large datasets to reveal patterns using statistics, database systems or artificial intelligence and present the information in a comprehensible way.
