Guide to College Majors in Computer Forensics
 |
What Is Computer Forensics?
Computer forensics is a new and fast growing form of investigative technique in which a forensic specialist gathers data that has been electronically stored or encrypted on digital media. Typically, this digital media resides in a personal or work computer, but it could also include flash memory cards or portable media players. The data retrieved often is used as evidence in a court case or as information to help law enforcement further an investigation." |
Computer forensics has a wide range of applications. Law enforcement agencies, both local and federal, use computer forensics to gather evidence and obtain more information about a suspect or known criminal. Large corporations may employ a computer forensics professional to monitor employees' computer activities. Computer forensics specialists can help prevent rogue employees or contractors from leaking critical information, such as company plans or sensitive customer data.
Computer forensics professionals are referred to by many titles, including computer forensics investigators, digital media analysts, and digital forensics detectives. Though the names are different, they each describe the same career. Each of these positions is concerned with the investigation of digital media.
Education and Computer Forensics
Currently, educational requirements for obtaining a career in computer forensics are minimal. Many computer forensics professionals learn their skills while on the job in law enforcement or computer security positions. However, certificate programs, online degree programs, and formal education are becoming more common requirements for obtaining a job in this field.
The most common career path for a computer forensics professional begins with experience in law enforcement or computer security. Many computer forensic specialists start their careers as security guards or law enforcement officers that want to put their skills to use is slightly less risky positions. Computer forensics certificate programs expand on career knowledge and provide information on computer forensics techniques and tools.
Computer forensics programs are also available for those with no law enforcement or computer security background. These programs typically result in associate's degrees or bachelor's degrees, and instruct the students on pertinent legal issues, computer skills, and forensics tools that they will need to enter the workforce as a computer forensics professional.
Computer forensics professionals who possess a bachelor's degree and seek continued education in their field often obtain a master's degree in computer forensics. Graduate degrees in computer forensics can help advance your career, making you eligible for positions as forensic team leaders or bureau supervisors. With an advanced degree, you also gain the credibility to attract large corporate clients as a freelance computer forensics specialist.
No matter which path they choose, computer forensics professionals must possess a solid comprehension of the law. They understand how to properly and legally handle evidence. They also employ a variety of methods for evidence discovery and retrieval. Computer forensics specialists have extensive knowledge of computer systems and programs, and the ability to retrieve information from them.
Degree programs in computer forensics often stress the importance of this legal and computer knowledge. Courses in business and criminal law are common, in addition to courses on computer systems and programs. Those programs that require general education courses usually stress technical writing, algebra, and public speaking. Each of these courses can help the computer forensics professional in his or her daily work, especially since part of the job involves testifying in criminal investigations.
Most computer forensics degree programs require students to complete internships with local professionals, bureaus, or agencies. These internships provide the students with hands-on experience in real world situations. This personal training can be invaluable to computer forensics majors when seeking an entry-level position after graduation. Interns also enjoy the benefits of making connections in their industry sooner than other students. Internships range from several weeks in length to over a year. Requirements vary with the degree programs.
Computer forensics is expected to continue to expand rapidly. As the number of computers in homes and businesses grows, so will the need for computer forensics professionals. Eventually, the FBI expects nearly fifty percent of its cases to require a computer forensics professional. Law enforcement agencies, prosecutor's offices, and large corporations are expected to hire more computer forensics professionals in coming years to handle their increasing investigative needs.
Degree Programs in Computer Forensics
Bachelor's, Master's Degrees, and Certificates in Computer Forensics
In the past, computer forensics programs were largely certificate programs designed for law enforcement and computer security professionals. In the last five years, degree programs in computer forensics have expanded to include associate's degrees, bachelor's, and master's degrees for both the working professional and the traditional undergraduate student. Students can choose which of these programs best suits their needs and lifestyle.
For students seeking their education online, computer forensics offers some terrific opportunities. Today, many colleges and universities offer online degree and certification programs in computer. Since most of the work involves mastering computer-based tools, instructors can review student work using innovating screen capture tools. Other programs offer students the chance to review new technology up close during short residency programs.
Associate's Degrees in Computer Forensics
The associate's degree in computer forensics is a two-year course of study that typically requires the completion of general education courses and courses specific to a career in computer forensics. Courses in cybercrime, intrusion detection systems, and legal basics are common. General education requirements typically include technical writing, algebra, and public speaking.
Associate's degrees in computer forensics frequently require the completion of an internship for graduation. This internship provides the student with real-world training that is valuable for obtaining a career in computer forensics. Completion of an internship may also meet the experience requirements set forth by many computer forensics associations.
An associate's degree can be excellent preparation for a bachelor's degree and often is sufficient for obtaining an entry-level career in computer forensics. Even students with no law enforcement or computer securities background can benefit from an associate's degree in computer forensics. Law enforcement professionals and computer professionals interested in expanding their knowledge of computer forensics may find an associate's degree in computer forensics useful as well.
Bachelor's Degrees in Computer Forensics
Bachelor's degree programs in computer forensics are rare, but many colleges and universities have announced plans to launch or expand their programs within the next few years. Bachelor's degree programs in computer forensics are four-year programs that focus on general education courses and skills specific to computer forensics. These programs often require courses in criminal law, computer operating systems, and intrusion detection systems. Technical writing, statistics, and economics courses usually are recommended as well.
Students obtaining a bachelor's degree in computer forensics often are required to complete an internship before graduation. This internship provides the student with work experience that will help in obtaining a job after graduation.
Master's Degrees in Computer Forensics
Master's degree programs in computer forensics typically are obtained by professionals in law enforcement or computer security that seek advancement in their field, or to expand their education into computer forensics. A bachelor's degree is traditionally required to enter a master's degree program. Bachelor's degrees in computer science, criminal justice, or related fields are preferred but seldom required.
Courses commonly required when pursuing a master's degree in computer science include fraud analysis and computer security. A master's degree typically takes two years to complete.
Professional Certificates in Computer Forensics
Professional certificates are a common method of earning education in computer forensics. Law enforcement or computer securities professionals typically undertake certificate programs. These students have an existing computer or legal background, but require additional education to become skilled computer forensics professionals. The curriculum in a computer forensics certificate program is created to expand on this existing knowledge base, and provide the student with the additional education required.
Certificate programs typically are short courses of study requiring less than ten courses. Requirements for entering a certificate program in computer forensics vary, but many require some professional experience in a related field. Courses common to a certificate program in computer forensics include introduction to technology, analysis of digital median, and telecommunications.
Many computer forensics associations are working on developing higher education programs for computer forensics professionals. Currently, doctoral degrees in computer forensics are uncommon, but likely to become more prevalent in the future.
What Can You Do with a College Degree in Computer Forensics?
Career Options for Aspiring Computer Forensics Investigators
Computer Forensics Investigator
A computer forensics investigator is responsible for collecting and evaluating data encrypted or stored on digital media. Often, they are called to recover data that has been deleted from the device. Most computer users, especially criminals, do not realize that most data can still be recovered from a hard drive long after a file has been dragged to the "recycle bin." The computer forensics investigator uses a variety of methods to retrieve this data.
Computer forensics investigators typically are called to retrieve information from a computer to be used as evidence in a trial. For example, if a computer is used in the commission of fraud, computer forensics techniques may be used to extract encrypted or deleted files from the computer. Investigators can also examine local network connections to gather evidence about data transmissions or uploads of illicit files. The information gathered may be used in the case against the suspect.
In other cases, computer forensics may be used to obtain information from the personal computer of a suspect in a crime. A computer forensics specialist may be able to find a personal address book, e-mail, or other information that can be used to advance the case against the suspect. By sifting through e-mail records on a user's local machine and on an ISP's servers, investigators can often make the link between a suspect and a crime victim. Investigators can also identify accomplices and motives, even when criminals believe they have covered their tracks.
A computer forensics investigator has other duties in addition to the retrieval of evidence. He or she typically is responsible for securing the computer and ensuring that it is not accidentally damaged during an investigation. Copies are made of all information, including the entire hard drive. Once the examination of the unit is complete, the computer forensics investigator writes detailed reports documenting the work that was done and the information located.
Because the computer forensics investigator usually works with evidence involved in a criminal or civil case, he or she must be diligent about documenting all work done to the computer and any information found. This information may be used in a court case, so it must be clearly written and explained. An investigator that uses faulty procedure may invalidate all the evidence produced by a piece of equipment.
Computer forensics investigators work in a variety of locations. Most investigators work with law enforcement agencies. Many are employed with prosecutor's offices, large corporations, or consulting firms.
Small companies may not have the budget to retain a computer forensics professional full-time. They can hire consultants or freelancers for unusual data recover situations. These consultants are paid by the hour, and they provide the same services as an in-house computer forensics specialist does. Because the consultant works on a case-to-case basis, there is much variety in their work.
Computer forensics investigators often begin their career in law enforcement or computer security. They learn computer forensics techniques either on-the-job or through training and certification programs. As computer forensics investigators become more sought after, educational requirements are expected to increase. An associate's degree or bachelor's degree in computer forensics is expected to become the more common minimum educational requirement.
Computer forensics is a fast growing field, and ever changing. It is important that computer forensics keep their forensics skills sharp and current. There are many methods for doing so, including certification and continuing education programs. Many computer forensics professionals are part of forensic associations and organizations. Participation in these organizations can help in staying current on trends in the field.
Certifications are available to computer forensics investigators through a variety of organizations. The two most common certifications are the Certified Information Systems Security Professional (CISSP) and the Certified Computer Examiner (CCE). These voluntary credentials may help in obtaining a career or advancement in computer forensics.
Computer forensics investigators are inquisitive and meticulous. They know a variety of methods for retrieving information from digital media, and work tirelessly towards this end. Computer forensics professionals have a solid knowledge of legal issues and the handling of evidence.
Computer Forensics Director
A computer forensics director typically is a skilled computer forensics investigator. He or she is responsible for directing a team of computer forensics investigators. A computer forensics director may work for law enforcement, a large corporation, or may work for a computer forensics consulting firm.
Computer forensics directors have good management skills. They often are responsible for the hiring, firing, and training of staff. They complete reports on the team's activities, and may be involved in budget making decisions. The computer forensics director often assigns cases to the team members, monitors their progress, and assists if needed. He or she ensures all legal procedures and company policies are followed carefully.
Directors in computer forensics departments and organizations typically hold a bachelor's degree, though not always in computer forensics. Degrees in management, computer security, and criminal justice are common.
Many have obtained their computer forensics education on-the-job and through certification programs. In the future, directors and other high-level computer forensics professionals will likely be required to hold a bachelor's degree in computer forensics. Computer forensics directors often advance to become heads of departments and consulting firm owners.
Salary Information for Careers in Computer Forensics
According to the Bureau of Labor Statistics (BLS), the median salary for computer forensic professionals was $37,640. Computer forensics professionals working for a private company typically earn a greater salary than those working for law enforcement. Law enforcement workers, however, typically receive excellent benefits.
Consulting can be a lucrative field for computer forensics professionals. Rather than working with a company or government agency, these individuals are "free agents." They take cases at will, and often charge a high dollar for their time. Consultants typically earn their income through billable hours, or billing the client per hour. This method typically is very lucrative, with large consulting firms billing between $375 and $600 per hour.
Certification and Licensure
Computer forensics is a new, growing field. Formal education in this field is becoming more common, but is still rare. No licensure requirements exist currently, but voluntary credentials are important to employers. These credentials ensure that computer forensics professionals have a solid knowledge base despite the lack of formal educational requirements.
The most widely recognized voluntary credentials available to a computer forensics professional are the Certified Information Systems Security Professional (CISSP) and the Certified Computer Examiner (CCE).
The CISSP is offered by the International Information Systems Security Certification Consortium, Inc., or ISC. One of the goals of the ISC is to set an international standard in the computer forensics industry with its CISSP examination.
The ISC requires that candidates for the CISSP examination have at least four years of professional experience in information security or a college degree and three years of experience. Candidates must adhere to the ISC code of ethics and allow criminal background inquiries.
Six hours is given to complete the 250-question CISSP examination. The Certified Information Systems Security Professional credential is awarded upon successful completion of the CISSP examination. In addition, all CISSP's are granted membership in the ISC.
To maintain the CISSP certification, computer forensics professionals must Continuing Professional Education credits every three years. These credits can be earned in a number of ways, including participating in computer forensics associations and completing training courses.
As with the CISSP, the Certified Computer Examiner (CCE) credential demonstrates competency in computer forensics. The CCE is offered by the International Society for Computer Examiners (ISFCE), an organization that hopes to create and maintain high standards for computer examiners worldwide.
Candidates for the CCE have no criminal record and adhere to the ISFCE code of ethics. He or she should have at least 18 months of professional experience or documented training, and pass an online examination. Aside from the online examination, the candidate must perform a forensic examination on at least three "test media."
Once the candidate has successfully completed the requirements the ISFCE requirements, he or she is considered a Certified Computer Examiner and member of the ISFCE. This credential is widely recognized and can help for computer examiners seeking career advancement, a new position, or increased responsibility.
To maintain the credential of Certified Computer Examiner, fifty hours of education or training must be completed every two years. In addition, the candidate must work on at least three media during that period. An online examination is also required every two years for recertification.
Other Associations and Certification Bodies
- American Academy of Forensic Sciences (AAFS)
- American Board of Criminalistics (ABC)
- American College of Forensic Examiners
- American Society of Crime Lab Directors (ASCLD)
- ASIS International
- Association of Certified Fraud Examiners
- Association for Crime Scene Reconstruction
- Canadian Society of Forensic Sciences
- The Forensic Science Society UK
- High Technology Crime Investigation Association
- International Association of Computer Investigative Specialists
- International Association for Identification (IAI)
- International Information Systems Forensics Association
- National Academy of Forensic Engineers (NAFE)
- Society of Forensic Engineers and Scientists
Collapse 
