By Noelle Hartt | 02/20/2025
Digital technology has infiltrated nearly every aspect of modern society, and forensic investigations are no exception. Electronic devices have become integral to our jobs, communications, and even leisure activities.
As a result, we have collectively created a wealth of digital data. This data, also known as our digital footprints, serves as a record of everything we do on our tablets, desktop computers, smartphones, and other digital devices. It is generated from various activities such as conducting online searches and completing business transactions.
Naturally, a digital footprint also contains evidence of an individual or organization’s involvement in criminal activity. This digital evidence helps forensic investigators piece together clues surrounding both computer and non-computer crimes.
Due to the sheer volume of electronic evidence investigators must comb through, however, law enforcement agencies employ entire teams dedicated to the field of digital forensics.
The U.S. Department of Homeland Security defines digital forensics as “the process of recovering and preserving material found on digital devices during the course of criminal investigations.” Digital forensics is also known as computer forensics or cyber forensics.
Just as traditional forensic investigators collect physical evidence from crime scenes, digital forensic investigators collect and analyze data from computers and other electronic devices.
What Is Digital Evidence?
If computer forensics is the process of collecting and analyzing digital forensic evidence, then what is this type of evidence? The National Institute of Standards and Technology (NIST) notes that “Digital evidence includes any information in binary form that can be useful in criminal or other legal investigations and proceedings. By its nature, digital evidence resides on physical media, but it is the content and related information, rather than the media, that are most often important.”
Based on this definition, electronics such as computers, tablets, and mobile devices are not technically electronic evidence. Rather, digital forensic evidence consists of the data contained within these electronic devices, such as cache data, cookies, and even deleted information.
Where Does Digital Forensic Evidence Come From?
Digital investigations involve various forms of electronic data, which come from a broad range of sources. The NIST groups these sources into four categories:
- Physical media –Any tangible piece of technology that can store digital data – such as computers, tablets, smartphones, and flash drives – falls under this category.
- Digital images and files – This category consists of digital copies of the data investigators collect from physical media and cloud-based systems.
- Other digital objects – This category refers to online accounts and other digital content “that does not exist as an image or file,” according to the NIST.
- Law enforcement-generated evidence – Electronic records, including but not limited to in-car videos and footage from body-worn cameras, comprise this category.
What Does a Digital Forensics Analyst Do?
Sometimes referred to as digital forensics investigators or computer forensic analysts, digital forensics analysts play a key role in our justice system. They “preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations,” as O*Net explains.
Unsurprisingly, these professionals have a long list of duties. In addition to scouring files and data for useful evidence, digital forensic analysts must preserve and duplicate any electronic evidence they find.
Their role also requires them to create reports summarizing their findings. In certain cases, a digital forensic analyst may even need to give a deposition.
According to O*Net, additional responsibilities for a digital forensic investigator may include:
- Conducting predictive or reactive analyses on cyber security measures
- Developing plans for investigating alleged digital crimes or other suspicious activities
- Developing policies for data collection, processing, or reporting
- Maintaining cyber defense software and hardware
- Understanding the laws, regulations, policies, and other concerns regarding computer forensics and information privacy
- Analyzing file signatures to verify files on storage media and discover potential hidden data
- Writing and executing scripts to automate tasks, such as assessing large data files
The role of a digital forensics analyst is unique because it combines both computer science and law enforcement.
What Are the Different Specialty Areas in the Digital Forensics World?
Performing forensic data analysis means working with information technology in its many forms. Digital forensic science, accordingly, applies to several specialty areas:
- Mobile device forensics – According to the NIST, classic computer forensics processes are insufficient for cases that require investigators to extract data from mobile phones. There are also specific digital forensic tools investigators use for collecting and analyzing digital data from mobile devices.
- Network forensics – Forensic investigators identify cyber threats and investigate security breaches using network forensic techniques. NIST says, “Network forensics is the science that deals with the capture, recording and analysis of network events and traffic for detecting intrusions and investigating them, which involves post-mortem investigation of the attack and is initiated after the attack has happened.”
- Database forensics – According to scholar Paul Reedy in a Forensic Science International: Synergy article, database forensics is a specialty area that “focuses on the detailed analysis of a database including its contents, log files, metadata, and data files.”
Notable Organizations in the Computer Forensics Field
The world of digital forensics is a vast one. It includes a wide spectrum of professionals, from police detectives to forensic accountants, and spans both the public and private sectors.
Consequently, there are several organizations that specialize in digital forensics and use digital forensic tools. In this type of organization, an investigator can track down suspected digital assets and recover deleted files from devices.
The National Cyber Investigative Joint Task Force
According to the FBI, the National Cyber Investigative Joint Task Force (NCIJTF) actively protects our country from cyber threats. It includes over 30 agencies with roots in law enforcement, the Intelligence Community, and the Department of Defense (DoD).
“The NCIJTF also synchronizes joint efforts that focus on identifying, pursuing, and defeating the actual terrorists, spies, and criminals who seek to exploit our nation’s systems,” notes the FBI.
The Internet Crime Complaint Center
Previously called the Internet Fraud Complaint Center (IFCC), the Internet Crime Complaint Center (IC3) is a resource that connects to the public to the FBI. Through the IC3 website, users can report information to the FBI regarding cybercrimes. These reports not only aid FBI investigations, but they also allow the FBI to track trends and potential threats that could result in computer viruses and deleted files.
The Cybersecurity and Infrastructure Security Agency
The Cybersecurity and Infrastructure Security Agency (CISA) is an agency within the U.S. Department of Homeland Security. It partners with public- and private-sector organizations “and serves as the national hub for cybersecurity and communications information.”
As a multifunctional agency, CISA prioritizes cybersecurity risk management and leads cyber incident responses to protect national security.
The US Department of Homeland Security’s Cyber Crimes Center
The Cyber Crimes Center (C3) is part of the Homeland Security Investigations (HSI) federal agency. It focuses on cybercrime activity within the HSI’s jurisdiction. C3’s mission has several components, as its website notes:
- Maintaining awareness of advancements in computer technology and cyber processes
- Employing new technologies to combat illicit activities and defend against potential threats
- Divulging the latest trends, risks, procedures, investigative leads, and other findings with law enforcement organizations worldwide, other field offices, and intelligence agencies
- Using the leading digital forensic techniques and investigative procedures to thwart cyber-related crime
The Department of Defense Cyber Crime Center
The DoD's Cyber Crime Center (DC3) partners with police, cybersecurity, and national security organizations. Its areas of expertise include cybersecurity and computer forensics, and the organization also operates its own Cyber Forensics Laboratory (CFL).
The Advantages and Disadvantages That Electronic Evidence Offers to an Active Criminal Investigation
For investigators and analysts, digital evidence offers multiple advantages and disadvantages. These advantages can make – or break – the prosecution of a case.
Advantages
Digital evidence has become instrumental in solving myriad crimes. For example, investigators rely on electronic evidence in cyber-specific cases, such as those cases surrounding data breaches, hacks, and ransomware. Nonetheless, computer forensics plays an important role in solving non-computer crimes as well.
“Digital evidence can relate to many different types of crime, ranging from fraud to corporate crime and organized crime,” says Dr. Jarrod Sadulski, a criminal justice professor at AMU’s School of Security and Global Studies. “If preserved properly, digital evidence can help to strengthen a case, which can lead to a successful criminal prosecution.”
Disadvantages
“A disadvantage of digital evidence is that it can be easily lost,” observes Dr. Sadulski. “Forensic investigators must take proper precautions when collecting digital files to avoid losing or compromising important data.”
However, computer forensics teams are only one part of the equation. Hackers and other cyber criminals also pose a threat. “Certain technologies can be accessed remotely, and evidence can be purposely erased,” Sadulski notes.
“To prevent this destruction of evidence, criminal investigators and crime scene personnel should use digital protective devices such as Faraday bags. These bags are designed to ensure that digital evidence cannot be accessed remotely,” he adds.
Given this insight, it makes perfect sense for investigators to duplicate the files they work with.
Myths People Believe about Digital Forensics
As Dr. Sadulski explains, one of the biggest misconceptions about digital evidence is that it can cut down the time needed to solve a crime. “Utilizing digital evidence takes time and is likely not going to solve crime quicker than other forms of evidence,” he says.
People also tend to mistakenly believe that police organizations can solve any crime that involves collecting and analyzing digital evidence. Unfortunately, this line of thinking fails to account for both encrypted data and the legal protections surrounding the search and seizure phase of an investigation.
“The problem is that encryption involving electronic devices can be an obstacle for digital forensic experts. If an encryption key is needed, investigators may not be able to access a device or recover deleted files,” notes Sadulski. “It is also important to point out that our electronic devices have Fourth Amendment protection.”
The Future of Digital Forensic Investigations
“Digital forensics will likely remain at the forefront of criminal cases,” Sadulski predicts. “Digital evidence is commonly located on cell phones, computers, cloud technology, smart home technologies, and vehicle computer systems. As technology evolves, it is important that investigators continue to examine ways that evidence can be obtained from these technological advancements.”
Digital forensics tools will also continue to evolve out of necessity as technology continues advancing and the Internet of Things (IoT) expands. Moreover, digital forensics investigators will further solidify their roles within our criminal justice system as digital clues help close more cases.
Criminal Justice Degrees at American Military University
“Digital forensics is a growing field that requires analytical skills. It involves processing data that is stored electronically and requires specialized training,” says Sadulski.
To suit students’ educational needs in criminal justice, American Military University (AMU) offers several degree programs:
- An online Associate of Arts in Criminal Justice
- An online Bachelor of Arts in Criminal Justice
- An online Bachelor of Science in Criminal Justice with a digital forensics concentration
- An online Master of Arts in Criminal Justice
Taught by expert instructors, courses in these degree programs include evidence and procedures, intercultural communications, criminology, and criminal investigation. Other courses include criminal law, crime analysis, criminalistics, and police administration.
For more information about these degrees, visit AMU’s criminal justice degrees program page.
