Digital Forensics Analysts
Computer and Mathematical Occupations- O*NET-SOC 代码
- 15-1299.06
Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.
- 数据来源: BLS发布时间: 2026-08
很高· 相对
低四级相对区间很高职业群单位数值
尺度 · 母数 · 来源
四级相对类别（低 / 中等 / 高 / 很高）
以BLS就业预测表中831个细分职业为基数。取值按 NEM（全国就业矩阵）代码给定，因此共用同一 NEM 代码的职业得到相同分档
- 数据来源: Anthropic发布时间: 2026-03
0.311
0.000此处所载数值的范围0.745职业群单位数值
尺度 · 母数 · 来源
- 数据来源: ILO发布时间: 2025
0.43–0.55· ISCO-08 职业组 3 个
尺度 · 母数 · 来源
生成式AI暴露度指数，按发布原值0–1
按 ISCO-08 细类（4 位）发布的数值。按原样应用美国劳工统计局（BLS）的官方对照表（ISCO-08→2010 SOC、2010 SOC→2018 SOC）关联到本职业，对应关系为全部或部分对应
该来源发布的是什么性质的数值
BLS的类别是相对排位而非绝对水平，也不是一手测量：它把多项已发表研究给出的职业百分位排名归并为四个等级。它不是就业或工资预测，不是采用概率，也不区分自动化与增强。
各关联 ISCO-08 职业组的 ILO 数值
- ISCO-08 2519Software and Applications Developers and Analysts Not Elsewhere Classified0.55
- ISCO-08 2529Database and Network Professionals Not Elsewhere Classified0.49
- ISCO-08 3511Information and Communications Technology Operations Technicians0.43
Task-level exposure
显示隐藏的 17 项工作已评分任务 20 项 · β ≥ 0.5 的任务 20 项（100.0%）
β = 直接暴露（E1）+ 0.5 × 借助工具时的暴露（E2），依据原始代码库的定义。
- 原始单位：O*NET 27.2 任务 → O*NET 31.0 职业代码
- 所有已评分任务均在 O*NET 31.0 任务列表中。
- 来源
- OpenAI "GPTs are GPTs" exposure rubric
- 版本
- gh-main-0471612
- 许可
- MIT License, Copyright (c) 2024 OpenAI
| Task (O*NET 30.2) | Claude.aiRaw / share % | APIRaw / share % |
|---|---|---|
Write and execute scripts to automate tasks, such as parsing large data files.15-1299.06 | 0.210087.5 | 0.160050.0 |
Write technical summaries to report findings.15-1299.06 | 0.02008.3 | 0.060018.8 |
Conduct predictive or reactive analyses on security measures to support cyber security initiatives.15-1299.06 | 0.01004.2 | 0.100031.3 |
Values in this tab are predicted labels, not observations. Eloundou et al. (2023) published two rating regimes — human raters and GPT-4 — and the β shown here is derived from the GPT-4 rater basis alone; the same task can take a different value under the other regime. The unit and the meaning differ from the observed shares (%) in the other tabs, so do not place them on the same axis.
| Task (O*NET 27.2) | βE1 + 0.5 × E2 |
|---|---|
Adhere to legal policies and procedures related to handling digital media.O*NET Task ID 21786 | 1.0 |
Duplicate digital evidence to use for data recovery and analysis procedures.O*NET Task ID 21792 | 1.0 |
Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.O*NET Task ID 21793 | 1.0 |
Maintain cyber defense software or hardware to support responses to cyber incidents.O*NET Task ID 21794 | 1.0 |
Recover data or decrypt seized data.O*NET Task ID 21801 | 1.0 |
Write and execute scripts to automate tasks, such as parsing large data files.O*NET Task ID 21802 | 1.0 |
Write cyber defense recommendations, reports, or white papers using research or experience.O*NET Task ID 21803 | 1.0 |
Write reports, sign affidavits, or give depositions for legal proceedings.O*NET Task ID 21804 | 1.0 |
Write technical summaries to report findings.O*NET Task ID 21805 | 1.0 |
Analyze log files or other digital information to identify the perpetrators of network intrusions.O*NET Task ID 21787 | 0.5 |
Conduct predictive or reactive analyses on security measures to support cyber security initiatives.O*NET Task ID 21788 | 0.5 |
Create system images or capture network settings from information technology environments to preserve as evidence.O*NET Task ID 21789 | 0.5 |
Develop plans for investigating alleged computer crimes, violations, or suspicious activity.O*NET Task ID 21790 | 0.5 |
Develop policies or requirements for data collection, processing, or reporting.O*NET Task ID 21791 | 0.5 |
Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.O*NET Task ID 21795 | 0.5 |
Perform file signature analysis to verify files on storage media or discover potential hidden files.O*NET Task ID 21796 | 0.5 |
Perform forensic investigations of operating or file systems.O*NET Task ID 21797 | 0.5 |
Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.O*NET Task ID 21798 | 0.5 |
Preserve and maintain digital forensic evidence for analysis.O*NET Task ID 21799 | 0.5 |
Recommend cyber defense software or hardware to support responses to cyber incidents.O*NET Task ID 21800 | 0.5 |
β = E1 + 0.5 × E2 · E1 = tasks where direct LLM access alone cuts time by at least 50%, E2 = tasks where software built on top of an LLM cuts time by at least 50%. Values take only 0 / 0.5 / 1.0.
Data sources & licenses — O*NET®, Anthropic Economic Index, Eloundou et al. (2023): see full notices on the Credits page
O*NET 31.0 全部任务（20 项）
本职业在 O*NET 31.0 中的全部任务（英文原文；任务类型为核心或补充）。暴露值不列在此清单中，而在上方表格里，位于各来源所用 O*NET 版本的任务表述旁。
| 任务（O*NET 31.0） | 类型 |
|---|---|
| Adhere to legal policies and procedures related to handling digital media. | 核心 |
| Analyze log files or other digital information to identify the perpetrators of network intrusions. | 核心 |
| Create system images or capture network settings from information technology environments to preserve as evidence. | 核心 |
| Develop plans for investigating alleged computer crimes, violations, or suspicious activity. | 核心 |
| Develop policies or requirements for data collection, processing, or reporting. | 核心 |
| Duplicate digital evidence to use for data recovery and analysis procedures. | 核心 |
| Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities. | 核心 |
| Maintain cyber defense software or hardware to support responses to cyber incidents. | 核心 |
| Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy. | 核心 |
| Perform file signature analysis to verify files on storage media or discover potential hidden files. | 核心 |
| Perform forensic investigations of operating or file systems. | 核心 |
| Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends. | 核心 |
| Preserve and maintain digital forensic evidence for analysis. | 核心 |
| Recover data or decrypt seized data. | 核心 |
| Write cyber defense recommendations, reports, or white papers using research or experience. | 核心 |
| Write reports, sign affidavits, or give depositions for legal proceedings. | 核心 |
| Write technical summaries to report findings. | 核心 |
| Conduct predictive or reactive analyses on security measures to support cyber security initiatives. | 补充 |
| Recommend cyber defense software or hardware to support responses to cyber incidents. | 补充 |
| Write and execute scripts to automate tasks, such as parsing large data files. | 补充 |
0.09/ 3· 机器人暴露指数
尺度 · 母数 · 来源
对每项体力任务，按已实际部署、销售或演示的机器人能够完成它的环境评定 0–3 级（0 不可 · 1 围栏式机器单元、灌装线等机器人专用设施 · 2 医院药房、集装箱港口等受管理的设施 · 3 私人住宅、建筑工地等非结构化环境），再按工作时间占比求平均
以该职业 O*NET 29.3 任务中的体力任务为准
等级与时间占比由 Anthropic 使用 Claude Opus 5（网络搜索）估算（截至 2026 年）。
机器人暴露指数与本站的 AI 暴露度是不同的指标，不能相加或相互比较。该指数不代表实际采用情况或成本竞争力，0 也包括没有体力任务的职业。
每项体力任务的等级
机器人环境等级（E0–E3）
E0 机器人不可详情
评定为已实际部署、销售或演示的机器人即使在机器人专用设施中也无法完成
E1 机器人专用设施详情
评定为可在围绕机器搭建的设施中完成，例如围栏式机器单元或灌装线
E2 受管理的设施详情
评定为可在由机构按工作标准维护的人类工作设施中完成，例如医院药房或集装箱港口
E3 非结构化环境详情
评定为可在没有机构按工作标准维护的环境中完成，例如私人住宅或建筑工地
仅列出被归类为体力任务的任务；其他任务在来源中没有等级。
| 任务（O*NET 29.3） | 机器人环境等级 |
|---|---|
| Duplicate digital evidence to use for data recovery and analysis procedures. | E1 机器人专用设施 |
| Preserve and maintain digital forensic evidence for analysis. | E1 机器人专用设施 |
职业信息
就业展望（BLS）
这些数值属于整个 SOC 15-1299 组（Computer occupations, all other），并非仅属于该 O*NET 职业。
- 就业人数，2025
- 471K
- 预计就业人数，2035
- 495K
- 变化 (2025–35)
- +5.1%
- 年薪中位数，2025
- $116,580
- 入职通常所需学历
- Bachelor's degree
韩国职业分类关联（KSCO）
来自 AI Changing Work 制作的 Korea Occupation Direct Crosswalk v1.1 当前版本的关联。关系值从 O*NET-SOC 职业一侧解读。
| KSCO 代码 | KSCO 名称 | 关系 | 状态 |
|---|---|---|---|
| 22391 | 디지털 포렌식 전문가 | 范围相同 | 已确认 |
关系与状态的定义(kr-direct v1.1)
国际劳工组织（ILO）职业说明
以下 ISCO-08 职业组由 AI Changing Work 原样套用美国劳工统计局（BLS）发布的对照表（2018 SOC→2010 SOC、2010 SOC→ISCO-08）、不逐案取舍，与本职业相关联；每项关联可能是完全对应，也可能是部分对应。
- ISCO-08 2519Software and Applications Developers and Analysts Not Elsewhere Classified
其他未列明的软件和应用开发人员及分析师
- ISCO-08 2529Database and Network Professionals Not Elsewhere Classified
其他未列明的数据库和网络专业人员
- ISCO-08 3511Information and Communications Technology Operations Technicians
信息和通信技术运行技术员
自行翻译
自行翻译 · 非 ISCO 官方词汇 — 未经国际劳工组织审核。
Sources: ILO ISCO-08 — details: Credits
ESCO 职业词汇
以下每一项都是在已公开的ESCO-O*NET Crosswalk（第 1 版，2022 年）中与本职业逐项对应的。对应类型出自该对照表；表述出自 AI Changing Work。
- digital forensics expertESCO 2529.2范围相同
Digital forensics experts retrieve and analyse information from computers and other types of data storage devices. They examine digital media that may have been hidden, encrypted or damaged, in a forensic manner with the aim to identify, preserve, recover, analyse and present facts and opinions about the digital information.
来源: European Commission, DG EMPL — ESCO API 2026-08-08 (bridge v1.2.1)
许可: CC BY 4.0 (EU Reuse Notice)
ESCO reuse terms and the modification notice are in Credits.
法国职业分类关联（ROME）
本职业与 ROME 4.0 职业条目（fiche）之间的关联，由 AI Changing Work 借助 AI 模型判定。关系从本职业一侧解读。标为「暂定」的关联仅凭同一模型系列（Claude）两位判定者的判定采纳，或对其判定适用运营方规则后采纳，因此其依据弱于已确认的关联。
| ROME 代码 | ROME 名称（法语） | 关系 |
|---|---|---|
| K1721 | Technicien / Technicienne en investigation criminelle | 相关，但不对应 |
| M1856 | Expert / Experte en cybersécurité | 相关，但不对应 |
Source: France Travail — Répertoire Opérationnel des Métiers et des Emplois (ROME 4.0), version 61, last updated 15 June 2026 (https://www.data.gouv.fr/datasets/repertoire-operationnel-des-metiers-et-des-emplois-rome). Licence Ouverte 2.0.
ROME codes and titles are reproduced unchanged; the links to O*NET-SOC occupations are AI Changing Work's own judgment and are not a France Travail correspondence.
(AI Changing Work link release: fr-direct v1)
西班牙职业分类关联（CNO-11）
本职业与 CNO-11 职业之间的关联，由 AI Changing Work 借助 AI 模型判定。关系从本职业一侧解读。
| CNO-11 代码 | CNO-11 名称（西班牙语） | 关系 |
|---|---|---|
| 2729 | Especialistas en bases de datos y en redes informáticas no clasificados bajo otros epígrafes | 本职业范围更窄暂定 |
Source: Instituto Nacional de Estadística (INE), National Classification of Occupations 2011 (CNO-11, Royal Decree 1591/2010) — www.ine.es · Licensed CC BY 4.0. CNO-11 codes and Spanish titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own judgment and are not an INE correspondence.
(AI Changing Work link release: es-direct v1)
德国职业分类关联（KldB）
本职业与 KldB 职业之间的关联，由 AI Changing Work 借助 AI 模型判定。关系从本职业一侧解读。
| KldB 代码 | KldB 名称（德语） | 关系 |
|---|---|---|
| 43384 | Berufe in der IT-Netzwerktechnik, IT-Koordination, IT-Administration und IT-Organisation (sonstige spezifische Tätigkeitsangabe) - hoch komplexe Tätigkeiten | 本职业范围更窄 |
Source: © Statistik der Bundesagentur für Arbeit — Klassifikation der Berufe 2010 – überarbeitete Fassung 2020, https://statistik.arbeitsagentur.de. KldB codes and titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own mapping (eigene Zuordnung) and are not a Bundesagentur für Arbeit correspondence.
(AI Changing Work link release: de-direct v1)
日本职业分类关联（JSCO）
本职业与 JSCO 职业之间的关联，由 AI Changing Work 借助 AI 模型判定。关系从本职业一侧解读。
| JSCO 代码 | JSCO 名称（日语） | 关系 |
|---|---|---|
| 109 | その他の情報処理・通信技術者 | 本职业范围更窄 |
Source: Ministry of Internal Affairs and Communications (MIC), Japan Standard Occupational Classification (Dec. 2009, MIC Notification No. 555). JSCO codes and Japanese titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own judgment and are not a MIC correspondence.
(AI Changing Work link release: jp-direct v1)
本页数据的来源与许可，以及 AI Changing Work 的修改与翻译说明：致谢与来源