Digital Forensics Analysts
Computer and Mathematical Occupations- O*NET-SOC code
- 15-1299.06
Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.
- Data source: BLSPublished: 2026-08
Very high· relative
LowFour relative bandsVery highGroup-level value
Scale, basis and source
Four relative bands (Low / Moderate / High / Very high)
831 detailed occupations in the BLS Employment Projections table. Assigned per National Employment Matrix (NEM) code, so occupations sharing a NEM code carry the same band
- Data source: AnthropicPublished: 2026-03
0.311
0.000Range of values carried here0.745Group-level value
Scale, basis and source
Observed exposure index, 0–1 as published
Mapped onto O*NET tasks
Published per SOC 2018 occupation; every O*NET occupation with the same SOC 2018 code carries this value
- Data source: ILOPublished: 2025
0.43–0.55· 3 ISCO-08 groups
Scale, basis and source
Generative AI exposure index, 0–1 as published
Published per ISCO-08 unit group. Linked to this occupation, wholly or in part, by applying U.S. Bureau of Labor Statistics crosswalks (ISCO-08 to 2010 SOC, 2010 SOC to 2018 SOC) as published
What kind of figure this source publishes
The BLS category is a relative rank, not an absolute level, and it is not a first-hand measurement: it groups an occupation's percentile ranks across several published studies into four bands. It is not an employment or wage forecast, not a probability of adoption, and it does not separate automation from augmentation.
ILO value for each linked ISCO-08 group
- ISCO-08 2519Software and Applications Developers and Analysts Not Elsewhere Classified0.55
- ISCO-08 2529Database and Network Professionals Not Elsewhere Classified0.49
- ISCO-08 3511Information and Communications Technology Operations Technicians0.43
Task-level exposure
20 rated tasks · 20 tasks with β ≥ 0.5 (100.0%)
β = direct exposure (E1) + 0.5 × exposure when tools are available (E2), per the source repository's definition.
- Source unit: O*NET 27.2 tasks → O*NET 31.0 occupation code
- All rated tasks are in the O*NET 31.0 task list.
- Source
- OpenAI "GPTs are GPTs" exposure rubric
- Release
- gh-main-0471612
- License
- MIT License, Copyright (c) 2024 OpenAI
Values in this tab are predicted labels, not observations. Eloundou et al. (2023) published two rating regimes — human raters and GPT-4 — and the β shown here is derived from the GPT-4 rater basis alone; the same task can take a different value under the other regime. The unit and the meaning differ from the observed shares (%) in the other tabs, so do not place them on the same axis.
| Task (O*NET 27.2) | βE1 + 0.5 × E2 |
|---|---|
Adhere to legal policies and procedures related to handling digital media.O*NET Task ID 21786 | 1.0 |
Duplicate digital evidence to use for data recovery and analysis procedures.O*NET Task ID 21792 | 1.0 |
Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.O*NET Task ID 21793 | 1.0 |
Maintain cyber defense software or hardware to support responses to cyber incidents.O*NET Task ID 21794 | 1.0 |
Recover data or decrypt seized data.O*NET Task ID 21801 | 1.0 |
Write and execute scripts to automate tasks, such as parsing large data files.O*NET Task ID 21802 | 1.0 |
Write cyber defense recommendations, reports, or white papers using research or experience.O*NET Task ID 21803 | 1.0 |
Write reports, sign affidavits, or give depositions for legal proceedings.O*NET Task ID 21804 | 1.0 |
Write technical summaries to report findings.O*NET Task ID 21805 | 1.0 |
Analyze log files or other digital information to identify the perpetrators of network intrusions.O*NET Task ID 21787 | 0.5 |
Conduct predictive or reactive analyses on security measures to support cyber security initiatives.O*NET Task ID 21788 | 0.5 |
Create system images or capture network settings from information technology environments to preserve as evidence.O*NET Task ID 21789 | 0.5 |
Develop plans for investigating alleged computer crimes, violations, or suspicious activity.O*NET Task ID 21790 | 0.5 |
Develop policies or requirements for data collection, processing, or reporting.O*NET Task ID 21791 | 0.5 |
Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.O*NET Task ID 21795 | 0.5 |
Perform file signature analysis to verify files on storage media or discover potential hidden files.O*NET Task ID 21796 | 0.5 |
Perform forensic investigations of operating or file systems.O*NET Task ID 21797 | 0.5 |
Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.O*NET Task ID 21798 | 0.5 |
Preserve and maintain digital forensic evidence for analysis.O*NET Task ID 21799 | 0.5 |
Recommend cyber defense software or hardware to support responses to cyber incidents.O*NET Task ID 21800 | 0.5 |
β = E1 + 0.5 × E2 · E1 = tasks where direct LLM access alone cuts time by at least 50%, E2 = tasks where software built on top of an LLM cuts time by at least 50%. Values take only 0 / 0.5 / 1.0.
Data sources & licenses — O*NET®, Eloundou et al. (2023): see full notices on the Credits page
All O*NET 31.0 task statements (20)
All O*NET 31.0 task statements for this occupation (English, as published; task type core or supplemental). Exposure values are not listed here; they are in the table above, next to each task statement as worded in the O*NET version each source used.
| Task (O*NET 31.0) | Type |
|---|---|
| Adhere to legal policies and procedures related to handling digital media. | Core |
| Analyze log files or other digital information to identify the perpetrators of network intrusions. | Core |
| Create system images or capture network settings from information technology environments to preserve as evidence. | Core |
| Develop plans for investigating alleged computer crimes, violations, or suspicious activity. | Core |
| Develop policies or requirements for data collection, processing, or reporting. | Core |
| Duplicate digital evidence to use for data recovery and analysis procedures. | Core |
| Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities. | Core |
| Maintain cyber defense software or hardware to support responses to cyber incidents. | Core |
| Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy. | Core |
| Perform file signature analysis to verify files on storage media or discover potential hidden files. | Core |
| Perform forensic investigations of operating or file systems. | Core |
| Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends. | Core |
| Preserve and maintain digital forensic evidence for analysis. | Core |
| Recover data or decrypt seized data. | Core |
| Write cyber defense recommendations, reports, or white papers using research or experience. | Core |
| Write reports, sign affidavits, or give depositions for legal proceedings. | Core |
| Write technical summaries to report findings. | Core |
| Conduct predictive or reactive analyses on security measures to support cyber security initiatives. | Supplemental |
| Recommend cyber defense software or hardware to support responses to cyber incidents. | Supplemental |
| Write and execute scripts to automate tasks, such as parsing large data files. | Supplemental |
0.09/ 3· Robot exposure index
Scale, basis and source
Each physical task is graded 0–3 by the setting in which robots that have been deployed, sold or demonstrated could do it (0 none · 1 purpose-built robot settings such as a fenced machine cell or a bottling line · 2 structured facilities such as a hospital pharmacy or a container port · 3 unstructured settings such as a private home or a construction site), and the grades are averaged by share of working time
Physical tasks among this occupation's O*NET 29.3 tasks
Anthropic estimated the grades and time shares with Claude Opus 5 using web search, as of 2026.
The robot exposure index is a different measure from the AI exposure figures on this site and cannot be added to or compared with them. It does not measure actual adoption or cost, and 0 also covers occupations with no physical tasks.
Tier of each physical task
Robot environment tiers (E0–E3)
E0 noneDetails
Rated not doable by robots that have been deployed, sold or demonstrated, even in a purpose-built setting
E1 purpose-built robot settingsDetails
Rated doable in a setting built around the machine, such as a fenced machine cell or a bottling line
E2 structured facilitiesDetails
Rated doable in a human work facility that an institution keeps to a working standard, such as a hospital pharmacy or a container port
E3 unstructured settingsDetails
Rated doable in a setting that no institution keeps to a working standard, such as a private home or a construction site
Only tasks classified as physical are listed; other tasks have no tier in the source.
| Task (O*NET 29.3) | Robot environment tier |
|---|---|
| Duplicate digital evidence to use for data recovery and analysis procedures. | E1 purpose-built robot settings |
| Preserve and maintain digital forensic evidence for analysis. | E1 purpose-built robot settings |
Occupation information
Employment outlook (BLS)
Values for the whole SOC 15-1299 group (Computer occupations, all other), not for this O*NET occupation alone.
- Employment, 2025
- 471K
- Projected employment, 2035
- 495K
- Change (2025–35)
- +5.1%
- Median annual wage, 2025
- $116,580
- Typical education needed for entry
- Bachelor's degree
Korea classification links (KSCO)
Links from the current release of the Korea Occupation Direct Crosswalk v1.1, made by AI Changing Work. Relation values are read from the O*NET-SOC occupation side.
| KSCO code | KSCO title | Relation | Status |
|---|---|---|---|
| 22391 | 디지털 포렌식 전문가 | Same scope | confirmed |
Relation and status definitions(kr-direct v1.1)
ILO occupational description
AI Changing Work links the ISCO-08 unit groups below to this occupation by applying the U.S. Bureau of Labor Statistics crosswalks (2018 SOC to 2010 SOC, 2010 SOC to ISCO-08) as published, without case-by-case selection; each link may be whole or partial.
- ISCO-08 2519Software and Applications Developers and Analysts Not Elsewhere Classified
- ISCO-08 2529Database and Network Professionals Not Elsewhere Classified
- ISCO-08 3511Information and Communications Technology Operations Technicians
Sources: ILO ISCO-08 — details: Credits
ESCO occupational vocabulary
Each entry below is matched to this occupation in the published ESCO-O*NET Crosswalk (version 1, 2022). The match types are that crosswalk's; the wording is AI Changing Work's.
- digital forensics expertESCO 2529.2Same scope
Digital forensics experts retrieve and analyse information from computers and other types of data storage devices. They examine digital media that may have been hidden, encrypted or damaged, in a forensic manner with the aim to identify, preserve, recover, analyse and present facts and opinions about the digital information.
Source: European Commission, DG EMPL — ESCO API 2026-08-08 (bridge v1.2.1)
License: CC BY 4.0 (EU Reuse Notice)
ESCO reuse terms and the modification notice are in Credits.
France classification links (ROME)
AI Changing Work's links between this occupation and ROME 4.0 job profiles, judged with AI models. Relations are read from this occupation's side. Links marked “provisional” were adopted on the judgments of two judges from the same model family (Claude) alone, or by an operator rule applied to their judgments, so they rest on weaker evidence than confirmed links.
| ROME code | ROME title (French) | Relation |
|---|---|---|
| K1721 | Technicien / Technicienne en investigation criminelle | Related, not a match |
| M1856 | Expert / Experte en cybersécurité | Related, not a match |
Source: France Travail — Répertoire Opérationnel des Métiers et des Emplois (ROME 4.0), version 61, last updated 15 June 2026 (https://www.data.gouv.fr/datasets/repertoire-operationnel-des-metiers-et-des-emplois-rome). Licence Ouverte 2.0.
ROME codes and titles are reproduced unchanged; the links to O*NET-SOC occupations are AI Changing Work's own judgment and are not a France Travail correspondence.
(AI Changing Work link release: fr-direct v1)
Spain classification links (CNO-11)
AI Changing Work's links between this occupation and CNO-11 occupations, judged with AI models. Relations are read from this occupation's side.
| CNO-11 code | CNO-11 title (Spanish) | Relation |
|---|---|---|
| 2729 | Especialistas en bases de datos y en redes informáticas no clasificados bajo otros epígrafes | This occupation is narrowerprovisional |
Source: Instituto Nacional de Estadística (INE), National Classification of Occupations 2011 (CNO-11, Royal Decree 1591/2010) — www.ine.es · Licensed CC BY 4.0. CNO-11 codes and Spanish titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own judgment and are not an INE correspondence.
(AI Changing Work link release: es-direct v1)
Germany classification links (KldB)
AI Changing Work's links between this occupation and KldB occupations, judged with AI models. Relations are read from this occupation's side.
| KldB code | KldB title (German) | Relation |
|---|---|---|
| 43384 | Berufe in der IT-Netzwerktechnik, IT-Koordination, IT-Administration und IT-Organisation (sonstige spezifische Tätigkeitsangabe) - hoch komplexe Tätigkeiten | This occupation is narrower |
Source: © Statistik der Bundesagentur für Arbeit — Klassifikation der Berufe 2010 – überarbeitete Fassung 2020, https://statistik.arbeitsagentur.de. KldB codes and titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own mapping (eigene Zuordnung) and are not a Bundesagentur für Arbeit correspondence.
(AI Changing Work link release: de-direct v1)
Japan classification links (JSCO)
AI Changing Work's links between this occupation and JSCO occupations, judged with AI models. Relations are read from this occupation's side.
| JSCO code | JSCO title (Japanese) | Relation |
|---|---|---|
| 109 | その他の情報処理・通信技術者 | This occupation is narrower |
Source: Ministry of Internal Affairs and Communications (MIC), Japan Standard Occupational Classification (Dec. 2009, MIC Notification No. 555). JSCO codes and Japanese titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own judgment and are not a MIC correspondence.
(AI Changing Work link release: jp-direct v1)
Sources, licenses and AI Changing Work's modification and translation notices for this page: Credits & sources