43
these first responders often help gather evidence during and after
a cyberattack.
A digital forensics investigator’s job begins when a crime involv-
ing digital media is identified. Digital crimes include everything from
electronic fraud, scams, and identity theft to cyberterrorism and
the distribution of illegal pornography. The investigator must gain
access to the computers or other devices that were involved in the
crime. While gathering evidence from these devices, a digital foren-
sics investigator must follow strict standards in order to ensure that
the evidence is correct and complete. For example, investigators
make a digital copy of a computer or mobile phone, then attempt
to recover deleted files from the copy. Creating a copy leaves the
original evidence unaltered. An investigator may also have to repair
or rebuild damaged devices in order to access the evidence.
Digital forensics investigators must write reports of the evi-
dence they recover. “Much of your day will be spent in docu-
mentation,” says John Irvine, vice president at the data recovery
and digital forensics company CyTech Services, in an interview
on the Balance Careers website. “You might be writing a report
of analysis, peer reviewing another examiner’s report, or noting
everything you did when performing an exam.”
If a case goes to court, digital forensics investigators may be
called to testify. Evidence they discover helps put guilty people
behind bars or helps innocent people go free. Mark Johnson
started out as a police officer and eventually established a com-
puter forensics division at his department. Now he is a computer
forensic analyst for the US Department of Justice in Kansas City,
Missouri. In a video by the Parkway Alumni Association, Johnson
says, “If there’s a crime with a computer involved in it, it will come
to us. We can find the deleted information, the hidden informa-
tion, do timeline analysis, all in trying to put a good case together
for the prosecutor.”
Sometimes, the outcome of the work is very positive. “The sin-
gle best result of the work . . . is finding a missing child,” says André
DiMino in an interview on EngineerJobs.com. DiMino is a computer
forensic information security systems engineer who has worked on
investigations. He says, “You are responsible . . . to piece together
