What is a Computer Forensics Investigator?

A Computer Forensics Investigator is a vital component of any law enforcement facility that prioritizes its digital capabilities. Both private firms and public law agencies alike employ computer forensics investigators who are adept at maintaining important data storage and bookkeeping applications, according to InfoSec Institute.


A computer forensics investigator is required to have and maintain a complete and practical understanding of all major components of sensitive information containment. The forensics investigator will need to be comfortable using a wide variety of applications made for the purpose of streamlined data management and encryption. The forensics investigator will also need to have a level of competence with virus resolution, as devices containing information vital to the case may need to be cleaned before they can be mined for incriminating or vindicating evidence.

Educational Requirement

In most cases, organizations will require that their computer forensics investigator has a degree in computer science and extensive collegiate credits earned in law-centric fields such as criminology. In addition to the bachelor’s degree, the investigator will also need to possess a forensic computer examiner certification, formally validating them as a Certified Forensic Computer Examiner (CFCE), according to the IACIS.


A computer forensics investigator will typically be stationed directly within a local law enforcement facility, though in some cases, they might be called upon to provide insight into another organization’s digital security or vital records. In all settings, the computer forensics investigator will be primarily concerned with assuring that there aren’t any holes in the organization’s storage and firewall capabilities. Forensics investigators also have an equally vital responsibility of retrieving the data needed to investigate ongoing criminal cases.

The computer forensics examiner will be counted on to retrieve images, documents and messages from devices that a perpetrator may have tried to delete them from. Using their knowledge of the interface of various computer devices, the forensics investigator can ideally unlock and unravel any files that have been broken or corrupted by either human or viral interference. In addition to ensuring that important case data can be retrieved from devices that are central to ongoing cases, a computer forensics investigator will also need to be capable of retrieving important information from suspects’ internet usage history records.

When the computer forensics investigator can retrieve the missing data that they were looking for, their task will also include the conversion of said data into the necessary format for transmission. They might also be called upon to provide testimony in court of their findings throughout the investigation.

Computer forensics investigators essentially fulfill a role that is equal parts offense and defense. They are tasked with breaking through any attempts that perpetrators have made to obscure virtual evidence of their crimes, and at the same time, they work to ensure that organizations are always properly defended from the most troublesome cyberthreats in corporate workplaces.

Related Resource: What is a Bailiff?

Job Outlook and Salary

The Bureau of Labor Statistics reports that the job outlook for computer forensics examiners is relatively fast, calculated to be at about 21 percent. In 2015, the average salary reported for computer forensics examiners was approximately $85,000.