Digital Forensics Analysts
Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.
$116,580 a year (for the broader BLS group this job sits in).
of the working time. Estimate.
- 98%
- 0%
- 2%
Measured, from Anthropic's usage data (2025). Counts help on part of a task.
On the chosen pace and reliability. Estimate.
Share of the working time within reach, now to 2030
What each choice means: , , , , . Every pace starts from .
At this date and pace, models finish tasks up to 4.4 h long four times in five.
How far this has come
With GPT-4, measured in March 2023, 0% of this job's working time was within reach at . With Claude 3.7 Sonnet, measured in February 2025, 0%. With Claude Mythos Preview (early), measured in April 2026, 17%. Today's estimate: 24%.
A backcast: today's task data with the best model METR had measured by each date. It shows how fast the models have moved, not what anyone forecast at the time.
The tasks
Sorted by . 20 tasks from .
| Task | Kind | |||
|---|---|---|---|---|
| Perform forensic investigations of operating or file systems.Done daily by most who do it. | 22% | 1.7 work days3.3 h to 4.2 work days | 2%Half by Feb 2028 | |
| Recover data or decrypt seized data.Done more than weekly by most who do it. | 13% | 6.7 h1.7 h to 2.1 work days | 9%Half by Aug 2027 | |
| Perform file signature analysis to verify files on storage media or discover potential hidden files.Done more than monthly by most who do it. | 10% | 3.3 h50 min to 6.7 h | 32%Half by Jan 2027 | |
| Write reports, sign affidavits, or give depositions for legal proceedings.Done more than yearly by most who do it. | 8% | 5 h1.7 h to 2.1 work days | 15%Half by Jun 2027 | |
| Develop plans for investigating alleged computer crimes, violations, or suspicious activity.Done more than weekly by most who do it. | 6% | 5 h1.7 h to 1.3 work days | 19%Half by Mar 2027 | |
| Analyze log files or other digital information to identify the perpetrators of network intrusions.Done more than yearly by most who do it. | 6% | 1 work day2.5 h to 2.5 work days | 6%Half by Sep 2027 | |
| Write technical summaries to report findings.Done more than weekly by most who do it. | 5% | 2.5 h50 min to 6.7 h | 46%Half by Oct 2026 | |
| Preserve and maintain digital forensic evidence for analysis.Done daily by most who do it. | 4% | 50 min17 min to 2.5 h | 87%Half by now | |
| Adhere to legal policies and procedures related to handling digital media.Done daily by most who do it. | 3% | 38 min13 min to 1.7 h | 95%Half by now | |
| Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.Done more than yearly by most who do it. | 3% | 5 h1.7 h to 1.3 work days | 19%Half by Mar 2027 | |
| Create system images or capture network settings from information technology environments to preserve as evidence.Done more than monthly by most who do it. | 3% | 1.7 h38 min to 5 h | 66%Half by now | |
| Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.Done yearly or less by most who do it. | 3% | 1.7 work days3.3 h to 4.2 work days | 2%Half by Feb 2028 |
Within reach, per task: the share of the task's time whose instances are short enough for a model to finish at the chosen date, pace and reliability. Half by: the date half of that time comes within reach.
Jobs that share skills with this one
From O*NET's related occupations. Within reach now and by the end of 2028, long-run pace, four in five.
Where this job works
The industry groups that employ the most of it (BLS, May 2025). Counts are for the broader BLS group this job sits in.
- Federal Executive Branch86,390 people
- Computer Systems Design and Related Services76,660 people
- Management of Companies and Enterprises25,080 people
- Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services16,520 people
- Management, Scientific, and Technical Consulting Services15,100 people
Where the most of these jobs are
The metro areas with the most people in it (BLS, May 2025). Counts are for the broader BLS group this job sits in.