Computer Forensics Analyst (CFA)

Role and tasks

Professional who obtains, recovers, manages, analyses and presents digital evidence contained in computer systems and digital technology devices.

This profile applies to all professionals who work -mainly in technical aspects- in the field of computer forensics, and have both the specific, necessary knowledge to carry out these activities and the work experience which allows them to carry out their tasks to the required professional quality.

Competences developed

  • Ability to apply the techniques of computer forensics to the whole life cycle of digital evidence and maintain their legal validity at all times.
  • Ability to propose and evaluate different technological alternatives in order to solve a specific problem in the field of computer forensics.
  • Ability to work in a team.
  • Ability of spoken and written expression using a precise and understandable language when explaining the complex processes of computer forensics.
  • Ability of self-instruction and adaptation to technological novelties.
  • Ability to work with analytical, objective and logical criteria which comply with the code of ethics of the profession.
  • Identify the relevant legal aspects and apply them to each case.

Activities performed

  • Identified and collected digital evidence according to the technical and legal requirements which rule the forensic practice.
  • Obtained and analysed digital evidences of computer systems and digital devices in operation, switched off and in networks.
  • Preserved the integrity of the digital evidences and maintained the chain of custody.
  • Drew up technical and expert reports related to the investigation of the digital evidences obtained using forensic methods.
  • Orally defended the created technical or expert reports in public.
  • Established and implemented the technical, legal and quality requirements which a computer (o ITC) forensic laboratory has to comply with.
  • Drew up / applied standards and guidelines of best practices of national and/or international organisations related to the field of computer forensics.
  • Used specialised hardware and/or software related to the field of computer forensics.
  • Knew how to decide on the suitability of different tools and forensic technologies, which are available on the market, in order to adopt them in special, unusual cases.
  • Designed and/or developed specific hardware/software for forensic analyses which are necessary for a certain case or type of analysis.