Digital forensics is the evaluation of digital material for legal purposes. A technician who specializes in digital forensics can assist with criminal and civil investigations and may offer testimony in court about the kind of evidence uncovered and its implications. Technicians may evaluate the contents of hard drives and other storage devices and can also engage in activities like tracing the steps of a hacker, testing security measures, or recovering damaged digital data like photographs on a memory card.
To work in this field, technicians need training in proper forensic procedure as well as technical skills. There are very strict rules about evidence control and preservation put in place to protect the integrity of court cases. The technician needs to be familiar with chain of evidence procedures, nondestructive testing techniques, evidence logging, and other matters so her evidence will be accepted in court. She also needs to learn about how to extract digital evidence and how to evaluate systems that may be password protected, corrupted, or otherwise difficult to access.
Sources of material for digital forensics technicians to look at can be quite varied. Officers may collect digital evidence at a scene that needs to be processed, and it is also possible to subpoena evidence. The technician may travel to the scene to personally collect the evidence. He will check to confirm that the all the material is present and can reduce the risks of damage or sabotage. Skilled technicians also know what to look for on site and may identify an issue that a regular law enforcement officer does not have the training to spot.
In digital forensics, technicians look for any and all evidence relevant to a case at hand. This includes any material that a suspect has attempted to destroy or hide. There are techniques available to extract information that users tried to delete or destroy. The technician can also recover information that is inadvertently lost or damaged. If a hard drive is discovered in a home after a flood, for example, the technician may be able to access the data and put it in a safe format for further evaluation.
The work of digital forensics is a constantly evolving field. Technicians need to keep up with the latest developments so they can offer the highest quality work to their employers. This may require joining professional organizations, attending conferences, and reading through research journals and other materials. Many employers will help cover the costs of professional development and will sponsor technicians who need to travel to develop more skills.