Learn about the field of computer forensics, including the types of training and education it requires.
We all know that forensics is the branch of science used in criminal and legal investigations, but few of us can answer the question, "What is computer forensics?" Well, in some ways it is exactly what you would expect. Computer forensics involves the retrieval and subsequent analysis of information from computer systems, networks, wireless communications and storage devices for use as evidence in court proceedings. Digital evidence frequently serves as a key component to solving various crimes, such as:
Computer forensics skills may also be used to identify offenders who use viruses, worms and other harmful programs to bring down an organization's computer network.
For those seeking computer forensic training for employment in law enforcement, the military or the private sector, there are various options available throughout the United States.
Computer forensics professionals retrieve information from various digital media products, including computers, laptops, PDAs, cell phones, Blackberries, secure flash drives with automatic encryption, portable hard drives and media cards. Professionals perform a variety of tasks such as the recovery of e-mails and deleted passwords or the recovery of data from files that have been encrypted or erased.
Once data has been retrieved, the computer forensics professional must create detailed reports consisting of specific technical information that can be used in a court of law. Eventually, most computer forensics professionals find themselves in an actual courtroom serving as expert witnesses.
People employed in the field of computer forensics have a variety of job titles, including information systems auditor, computer forensics technician, computer forensics analyst, computer forensics examiner and computer forensics consultant. Typical salaries vary depending on whether the professional is employed in the public or private sector. Public sector employees typically work in the military, police departments or other government agencies. Salaries for police officers or military personnel are dependent on union rules or military scales. Civilians working for the government in the field of computer forensics can expect to make between $50,000 and $75,000 yearly. Computer forensics professionals starting in the private sector make $50,000 to $60,000 yearly; however, seasoned professionals make $100,000 to $200,000.
There are various ways to become trained in computer forensics. First and foremost, computer forensics professionals must have a basic understanding about computers and how they operate. This type of training can be obtained through a two or four-year degree in computer science or computer engineering. Devry University, for example, offers an online associate's degree in electronics and computer technology.
New Technologies Incorporated offers a five-day certificate program in computer forensics, which requires attendees to have a comprehensive background in computers. During the course, students study subjects such as computer incident responses, security risk assessments, computer evidence issues, expert witness testimony, computer evidence preservation, cross validation of forensic tools and documentation of findings.
The University of Washington Extension Professional and Continuing Education offers a certificate program in digital forensics. This hands-on program, which is offered in the evening, is deigned for information technology specialists, systems analysts and network administrators. Some of the courses offered include evidentiary issues, discovery, chains of evidence, records management, forensic software, crime scene evaluation, spoliation, conducting interviews and dealing with attorneys.
The University of Alabama offers a certificate program in computer forensics, which is cosponsored by the Department of Computer and Information Sciences and the Department of Justice Sciences. This graduate program requires 21 hours of coursework in order to obtain a certificate. Some of the courses offered include elements of forensic science, network security, internetworking, and computer and distribution networks.
The United States Military also provides extensive training in computer forensics . The Defense Cyber Investigations Training Academy (DCITA) is the main training source for computer forensics in the government and military. The school is accredited through the Council of Occupational Education and recognized by the U.S. Department of Education. All registrants must be assigned to an official U.S. government agency or be an official representative of the government with a Memorandum of Understanding (MOU), which is like a contract that allows individuals to work in government settings. Furthermore, registrants must be assigned to one of the following positions or units: federal law enforcement, counterintelligence, inspector general or computer forensics examiner. The DCITA offers a wide variety of courses ranging from introductory computer courses to forensics track courses. Sample courses offered include Windows forensic examinations, Macintosh examinations, data recovery, forensics and intrusions in a Linux environment, live network investigations, online undercover techniques and advanced log analysis.
While some training occurs on the job, in some cases, the Army, Navy and Air Force offer tuition reimbursement for approved training courses such as Key Computer Service's Computer Forensic Training Center Online (CFTCO). This company offers an online training program that can be taken from anywhere in the world with a functional Internet connection.