A person in the role of a digital forensic analyst works to discover how a cybercrime was committed, what data was lost due to the cyber-attack, and to determine who the offender is. This can include investigating a company’s data breach where customer data was stolen. Analysts use cyber security techniques to retrieve data from devices. In this case, the analyst would work to recover any data that was stolen, destroyed, tampered with in some way. This information is later reviewed to get an understanding of how it relates to the crime and the offender. Another important aspect of this role is ensuring that the collected evidence is secured and available if needed for a court case.  

To properly analyze the data and information collected, digital forensic analysts must be able to use ethical neutrality to understand how the offender was able to commit cybercrime. Attempting to answer several questions such as where did attack happen, who was affected, what kind of tactics were used to pull off this attack, what was taken, and what was the goal of the offender. Ethical Neutrality is used to understand an attacker’s motives and tactics. Ensuring that the analyst considers each perspective to understand the cyber-attack as a whole. Digital forensic analysts use determinism as well. This allows them to be able to build a profile of the cybercriminal. Determinism bases the attack on preceding events; the analyst will need to understand what happened that led to the cyber-attack. Using both ethical neutrality and determinism, an analyst can construct a full story of when, how, and why a cybercrime was committed.  

For marginalized groups, the use of digital forensics and the role of an analyst in the field work to support them as they are often victims of cyber-attacks. Groups that are easy targets for cyber criminals will need digital evidence for their court case. A major challenge faced is trust in the evidence derived from the forensic investigation. The source and authenticity of digital evidence come into question within the courts. In law, evidence must apply to three rules; the rule of best evidence, authentication, and hearsay. However, it is difficult to apply those rules to digital artifacts. The aim of those rules is to verify that evidence used in court is original, has not been manipulated, and can be confirmed by cross-examination. It’s important that a method is developed to create a basis of trust in regard to digital forensic data for court evidence to promote reliability.  

As technology continues to advance, it becomes increasingly difficult to avoid in everyday life. Cybercrimes are on the rise and will continue to become more sophisticated. A digital forensic analyst is able to use social sciences to build a profile of cybercrime tactics and archive for later research or evidence. Being able to use digital forensic evidence in court can help mitigate cybercrimes and influence cybersecurity countermeasures that can be put in place. Digital forensic analysts are important to society as they work to help build the necessary evidence base for cybercrime. 

Institute, S. (2023, March 30). Digital Forensics salary, skills, and career path. SANS Institute. https://www.sans.org/blog/digital-forensics-salary-skills-and-career-path 

Duranti , L., & Rogers, C. (2012). Trust in digital records: An increasingly cloudy legal area. Computer Law & Security Review, 28(5), 522–531. https://doi.org/https://doi.org/10.1016/j.clsr.2012.07.009 

Carroll, O. L., Brannon, S. K., & Song, T. (2017, September 12). Computer Forensics: Digital Forensic Analysis Methodology. Crime Scene Investigator Network. https://www.crime-scene-investigator.net/computer-forensics-digital-forensic-analysis-methodology.html