[None] Adhere to legal policies and procedures related to handling digital media.
  DWAs: Monitor the security of digital information.

[None] Analyze log files or other digital information to identify the perpetrators of network intrusions.
  DWAs: Examine records or other types of data to investigate criminal activities.

[None] Conduct predictive or reactive analyses on security measures to support cyber security initiatives.
  DWAs: Analyze security of systems, network, or data.

[None] Create system images or capture network settings from information technology environments to preserve as evidence.
  DWAs: Compile technical information or documentation.

[None] Develop plans for investigating alleged computer crimes, violations, or suspicious activity.
  DWAs: Plan production or operational procedures or sequences.

[None] Develop policies or requirements for data collection, processing, or reporting.
  DWAs: Establish operational policies.

[None] Duplicate digital evidence to use for data recovery and analysis procedures.
  DWAs: Record images needed to address work issues.

[None] Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.
  DWAs: Identify information technology project resource requirements. | Develop technical methods or processes.

[None] Maintain cyber defense software or hardware to support responses to cyber incidents.
  DWAs: Maintain computer equipment or software.

[None] Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.
  DWAs: Maintain knowledge of laws or regulations.

[None] Perform file signature analysis to verify files on storage media or discover potential hidden files.
  DWAs: Examine records or other types of data to investigate criminal activities.

[None] Perform forensic investigations of operating or file systems.
  DWAs: Examine records or other types of data to investigate criminal activities.

[None] Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.
  DWAs: Examine records or other types of data to investigate criminal activities. | Analyze traffic data.

[None] Preserve and maintain digital forensic evidence for analysis.
  DWAs: Maintain records, documents, or other files.

[None] Recommend cyber defense software or hardware to support responses to cyber incidents.
  DWAs: Provide recommendations to others about computer hardware. | Recommend changes to improve computer or information systems.

[None] Recover data or decrypt seized data.
  DWAs: Translate information for others.

[None] Write and execute scripts to automate tasks, such as parsing large data files.
  DWAs: Write computer programming code. | Enter codes or other information into computers.

[None] Write cyber defense recommendations, reports, or white papers using research or experience.
  DWAs: Write reports or evaluations. | Recommend changes to improve computer or information systems.

[None] Write reports, sign affidavits, or give depositions for legal proceedings.
  DWAs: Write reports or evaluations. | Testify at legal or legislative proceedings.

[None] Write technical summaries to report findings.
  DWAs: Write reports or evaluations.

--- WORK STYLES ---
  Dependability (imp:7.00) — A tendency to be reliable, responsible, and consistent in meeting work-related o
  Attention to Detail (imp:6.00) — A tendency to be detail-oriented, organized, and thorough in completing work.
  Integrity (imp:5.00) — A tendency to be honest and ethical at work.
  Cautiousness (imp:4.00) — A tendency to be careful, deliberate, and risk-avoidant when making work-related
  Intellectual Curiosity (imp:3.00) — A tendency to seek out and acquire new work-related knowledge and obtain a deep 
  Attention to Detail (imp:3.00) — A tendency to be detail-oriented, organized, and thorough in completing work.
  Integrity (imp:2.93) — A tendency to be honest and ethical at work.
  Cautiousness (imp:2.78) — A tendency to be careful, deliberate, and risk-avoidant when making work-related
  Dependability (imp:2.65) — A tendency to be reliable, responsible, and consistent in meeting work-related o
  Intellectual Curiosity (imp:2.37) — A tendency to seek out and acquire new work-related knowledge and obtain a deep 
  Perseverance (imp:2.12) — A tendency to exhibit determination and resolve to perform or complete tasks in 
  Achievement Orientation (imp:2.08) — A tendency to establish and maintain personally challenging work-related goals, 
  Achievement Orientation (imp:2.00) — A tendency to establish and maintain personally challenging work-related goals, 
  Innovation (imp:1.97) — A tendency to be inventive, to be imaginative, and to adopt new perspectives on 
  Stress Tolerance (imp:1.96) — A tendency to cope and function effectively in stressful situations at work.
  Adaptability (imp:1.86) — A tendency to be open to and comfortable with change, new experiences, or ideas 
  Self-Control (imp:1.84) — A tendency to remain calm and composed and to manage emotions effectively in res
  Tolerance for Ambiguity (imp:1.76) — A tendency to be comfortable with ambiguity and uncertainty at work.
  Initiative (imp:1.72) — A tendency to be proactive and take on extra responsibilities and tasks that may
  Self-Confidence (imp:1.41) — A tendency to believe in one's work-related capabilities and ability to control 
  Perseverance (imp:1.00) — A tendency to exhibit determination and resolve to perform or complete tasks in 
  Cooperation (imp:0.80) — A tendency to be pleasant, helpful, and willing to assist others at work.
  Sincerity (imp:0.72) — A tendency to be genuine and sincere in interactions with others at work, withou
  Humility (imp:0.12) — A tendency to be modest and humble when interacting with others at work.
  Leadership Orientation (imp:0.02) — A tendency to lead, take charge, offer opinions, and provide direction at work.
  Innovation () — A tendency to be inventive, to be imaginative, and to adopt new perspectives on 
  Tolerance for Ambiguity () — A tendency to be comfortable with ambiguity and uncertainty at work.
  Initiative () — A tendency to be proactive and take on extra responsibilities and tasks that may
  Adaptability () — A tendency to be open to and comfortable with change, new experiences, or ideas 
  Self-Confidence () — A tendency to believe in one's work-related capabilities and ability to control 
  Leadership Orientation () — A tendency to lead, take charge, offer opinions, and provide direction at work.
  Humility () — A tendency to be modest and humble when interacting with others at work.
  Sincerity () — A tendency to be genuine and sincere in interactions with others at work, withou
  Empathy () — A tendency to show concern for others and be sensitive to others' needs and feel
  Cooperation () — A tendency to be pleasant, helpful, and willing to assist others at work.
  Optimism () — A tendency to exhibit a positive attitude and positive emotions at work, even un
  Social Orientation () — A tendency to seek out, enjoy, and be energized by social interaction at work.
  Stress Tolerance () — A tendency to cope and function effectively in stressful situations at work.
  Self-Control () — A tendency to remain calm and composed and to manage emotions effectively in res
  Empathy (imp:-0.09) — A tendency to show concern for others and be sensitive to others' needs and feel
  Optimism (imp:-0.13) — A tendency to exhibit a positive attitude and positive emotions at work, even un
  Social Orientation (imp:-0.16) — A tendency to seek out, enjoy, and be energized by social interaction at work.

--- NATIONAL WAGES ---
  total_employment : 435,370
  annual_median    : $116,580
  annual_pct10     : $55,940
  annual_pct25     : $79,370
  annual_pct75     : $157,500
  annual_pct90     : $188,470
  annual_mean      : $122,230
  hourly_median    : $56.05

--- GEOGRAPHIC DISPERSION ---
  highest_state    : District of Columbia ($156,590)
  lowest_state     : Puerto Rico ($60,470)
  dispersion_ratio : 2.590x

--- TOP STATES BY WAGE (54 total) ---
  Professional, Scientific, and Technical Services emp:  123,970  median: $ 121,310
  Federal, State, and Local Government, excluding State and Local Government Schools and Hospitals and the U.S. Postal Service (OEWS Designation) emp:   97,870  median: $ 124,530
  Information                              emp:   48,470  median: $ 131,720
  Finance and Insurance                    emp:   27,020  median: $ 131,760
  Management of Companies and Enterprises  emp:   25,080  median: $ 128,070
  Administrative and Support and Waste Management and Remediation Services emp:   23,450  median: $  99,210
  Manufacturing                            emp:   23,360  median: $ 105,040
  Educational Services                     emp:   17,310  median: $  83,120
  Wholesale Trade                          emp:   12,810  median: $ 109,960
  Health Care and Social Assistance        emp:   10,490  median: $  93,010

--- TOP INDUSTRIES BY EMPLOYMENT (20 total) ---
  Professional, Scientific, and Technical Services emp:  123,970  median: $ 121,310
  Federal, State, and Local Government, excluding State and Local Government Schools and Hospitals and the U.S. Postal Service (OEWS Designation) emp:   97,870  median: $ 124,530
  Information                              emp:   48,470  median: $ 131,720
  Finance and Insurance                    emp:   27,020  median: $ 131,760
  Management of Companies and Enterprises  emp:   25,080  median: $ 128,070
  Administrative and Support and Waste Management and Remediation Services emp:   23,450  median: $  99,210
  Manufacturing                            emp:   23,360  median: $ 105,040
  Educational Services                     emp:   17,310  median: $  83,120
  Wholesale Trade                          emp:   12,810  median: $ 109,960
  Health Care and Social Assistance        emp:   10,490  median: $  93,010

exact_match_status : found
matched_title      : Digital forensics
match_score        : 0.7907
wikidata_qid       : Q3246940
word_count         : 4,742
wikipedia_url      : https://en.wikipedia.org/wiki/Digital_forensics
license            : CC BY-SA 4.0
fetched_at         : 2026-06-02T20:25:05.508340Z

--- WIKIPEDIA FULL TEXT ---
Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery, investigation, examination, and analysis of material found in digital devices, often in relation to mobile devices and computer crime. The term "digital forensics" was originally used as a synonym for computer forensics but has been expanded to cover investigation of all devices capable of storing digital data. With roots in the personal computing revolution of the late 1970s and early 1980s, the discipline evolved in a haphazard manner during the 1990s, and it was not until the early 21st century that national policies emerged.
Digital forensics investigations have a variety of applications. The most common is to support or refute a hypothesis before criminal or civil courts. Criminal cases involve the alleged breaking of laws that are defined by legislation and enforced by the police and prosecuted by the state, such as murder, theft, and assault against the person. Civil cases, on the other hand, deal with protecting the rights and property of individuals (often associated with family disputes), but may also be concerned with contractual disputes between commercial entities where a form of digital forensics referred to as electronic discovery (ediscovery) may be involved.
Forensics may also feature in the private sector, such as during internal corporate investigations or intrusion investigations (a special probe into the nature and extent of an unauthorized network intrusion).
The technical aspect of an investigation is divided into several sub-branches related to the type of digital devices involved: computer forensics, network forensics, forensic data analysis, and mobile device forensics. The typical forensic process encompasses the seizure, forensic imaging (acquisition), and analysis of digital media, followed with the production of a report of the collected evidence.
As well as identifying direct evidence of a crime, digital forensics can be used to attribute evidence to specific suspects, confirm alibis or statements, determine intent, identify sources (for example, in copyright cases), or authenticate documents. Investigations are much broader in scope than other areas of forensic analysis (where the usual aim is to provide answers to a series of simpler questions), often involving complex time-lines or hypotheses.


== History ==
Prior to the 1970s, crimes involving computers were dealt with using existing laws. The first computer crimes were recognized in the 1978 Florida Computer Crimes Act, which included legislation against the unauthorized modification or deletion of data on a computer system. Over the next few years, the range of computer crimes being committed increased, and laws were passed to deal with issues of copyright, privacy/harassment (e.g., cyber bullying, happy slapping, cyber stalking, and online predators), and child pornography. It was not until the 1980s that federal laws began to incorporate computer offences. Canada was the first country to pass legislation in 1983. This was followed by the US Federal Computer Fraud and Abuse Act in 1986, Australian amendments to their crimes acts in 1989, and the British Computer Misuse Act in 1990. Digital forensics methods are increasingly being applied to preserve and authenticate born-digital cultural materials in heritage institutions.


=== 1980s–1990s: Growth of the field ===
The growth in computer crime during the 1980s and 1990s caused law enforcement agencies to begin establishing specialized groups, usually at the national level, to handle the technical aspects of investigations. For example, in 1984, the FBI launched a Computer Analysis and Response Team and the following year a computer crime department was set up within the British Metropolitan Police fraud squad. As well as being law enforcement professionals, many of the early members of these groups were also computer hobbyists and became responsible for the field's initial research and direction.
One of the first practical (or at least publicized) examples of digital forensics was Cliff Stoll's pursuit of hacker Markus Hess in 1986. Stoll, whose investigation made use of computer and network forensic techniques, was not a specialized examiner. Many of the earliest forensic examinations followed the same profile.
Throughout the 1990s, there was high demand for these new, and basic, investigative resources. The strain on central units lead to the creation of regional, and even local, level groups to help handle the load. For example, the British National Hi-Tech Crime Unit was set up in 2001 to provide a national infrastructure for computer crime, with personnel located both centrally in London and with the various regional police forces (the unit was folded into the Serious Organised Crime Agency (SOCA) in 2006).
During this period, the science of digital forensics grew from the ad-hoc tools and techniques developed by these hobbyist practitioners. This is in contrast to other forensics disciplines, which developed from work by the scientific community. It was not until 1992 that the term "computer forensics" was used in academic literature (although prior to this, it had been in informal use); a paper by Collier and Spaul attempted to justify this new discipline to the forensic science world. This swift development resulted in a lack of standardization and training. In his 1995 book, High-Technology Crime: Investigating Cases Involving Computers, K. Rosenblatt wrote the following:

Seizing, preserving, and analyzing evidence stored on a computer is the greatest forensic challenge facing law enforcement in the 1990s. Although most forensic tests, such as fingerprinting and DNA testing, are performed by specially trained experts the task of collecting and analyzing computer evidence is often assigned to patrol officers and detectives.


=== 2000s: Developing standards ===
Since 2000, in response to the need for standardization, various bodies and agencies have published guidelines for digital forensics. The Scientific Working Group on Digital Evidence (SWGDE) produced a 2002 paper, Best practices for Computer Forensics, this was followed, in 2005, by the publication of an ISO standard (ISO 17025, General requirements for the competence of testing and calibration laboratories). A European-led international treaty, the Budapest Convention on Cybercrime, came into force in 2004 with the aim of reconciling national computer crime laws, investigative techniques, and international co-operation. The treaty has been signed by 43 nations (including the US, Canada, Japan, South Africa, UK, and other European nations) and ratified by 16.
The issue of training also received attention. Commercial companies (often forensic software developers) began to offer certification programs, and digital forensic analysis was included as a topic at the UK specialist investigator training facility, Centrex.
In the late 1990s, mobile devices became more widely available, advancing beyond simple communication devices, and were found to be rich forms of information, even for crime not traditionally associated with digital forensics. Despite this, digital analysis of phones has lagged behind traditional computer media, largely due to problems over the proprietary nature of devices.
Focus has also shifted onto internet crime, particularly the risk of cyber warfare and cyberterrorism. A February 2010 report by the United States Joint Forces Command concluded the following:

Through cyberspace, enemies will target industry, academia, government, as well as the military in the air, land, maritime, and space domains. In much the same way that airpower transformed the battlefield of World War II, cyberspace has fractured the physical barriers that shield a nation from attacks on its commerce and communication.
The field of digital forensics still faces unresolved issues. A 2009 paper, "Digital Forensic Research: The Good, the 

--- SEMANTIC NEIGHBORS (5) ---

  Title: Computer forensics (similarity: 0.5000)
  URL: https://en.wikipedia.org/wiki/Computer_forensics
  QID: Q878553
  Extract: Computer forensics is a branch of digital forensic science pertaining to evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing, and presenting fac

  Title: Murder of Eric Richins (similarity: 0.2083)
  URL: https://en.wikipedia.org/wiki/Murder_of_Eric_Richins
  QID: Q138710737
  Extract: On March 4, 2022, Eric Eugene Richins, an American living in the state of Utah, died at the age of 39 from a lethal dose of illicit fentanyl. On May 8, 2023, Kouri Darden Richins was charged with the murder of her husband; financial charges were added on June 27, 2025, and the murder charges were am

  Title: Dunstan Guba (similarity: 0.2632)
  URL: https://en.wikipedia.org/wiki/Dunstan_Guba
  QID: Q135656685
  Extract: Dunstan Guba is a Ghanaian cybersecurity expert, digital forensic analyst, and law enforcement officer with the Ghana Police Service. He serves as the Cyber Intelligence Lead of the Service and is known for his contributions to cybercrime investigations, digital forensics, and cybersecurity capacity

  Title: Naval Criminal Investigative Service (similarity: 0.3548)
  URL: https://en.wikipedia.org/wiki/Naval_Criminal_Investigative_Service
  QID: Q765854
  Extract: The United States Naval Criminal Investigative Service (NCIS) is the primary investigative law enforcement agency of the United States Department of the Navy. Its primary function is to investigate major criminal activities involving the Navy and Marine Corps. However, its broad mandate includes nat

  Title: Forensic science (similarity: 0.4762)
  URL: https://en.wikipedia.org/wiki/Forensic_science
  QID: Q495304
  Extract: Forensic science, often known as with criminalistics, is the application of science principles and methods to support decision-making related to rules or law, generally criminal and civil law.

model_pass1          : claude-sonnet-4-20250514
model_pass2          : claude-haiku-4-5-20251001
inference_confidence : high
confidence_notes     : Strong confidence supported by comprehensive O*NET data, clear task definitions, robust wage data from BLS OEWS May 2025, and exact Wikipedia match providing field context. The 435,370 employment figure and detailed industry distribution provide solid market intelligence foundation.
inferred_at          : 2026-06-03T14:10:28.197007+00:00
tokens_input         : 3,494
tokens_output        : 4,511
cost_usd             : $0.048297
wikipedia_used       : True
wikipedia_title      : Digital forensics
wikipedia_note       : The Wikipedia entry confirms digital forensics as a specialized branch of forensic science focused on digital devices and computer crime investigation. The field has expanded beyond computer forensics to encompass all digital storage devices, aligning with the occupation's broad technology scope.

--- PROSE FIELDS ---

ROLE SUMMARY:
Digital Forensics Analysts conduct investigations on computer-based crimes, establishing documentary or physical evidence from digital media and logs associated with cyber intrusion incidents. They analyze digital evidence and investigate computer security incidents to derive information supporting system and network vulnerability assessments. These professionals serve as critical links between cybersecurity and law enforcement, translating technical evidence into actionable intelligence.

DAY IN THE LIFE:
Digital forensics analysts begin their day by reviewing security incident reports and prioritizing cases based on severity and legal requirements. They create forensic images of compromised systems and carefully preserve digital evidence following strict legal protocols. Throughout the day, they analyze log files, network traffic, and digital artifacts to identify attack vectors and perpetrators. They document their findings meticulously, prepare technical reports for legal proceedings, and collaborate with law enforcement and cybersecurity teams. Much of their work involves using specialized tools to recover deleted files, trace network intrusions, and reverse-engineer malicious software to understand attack methodologies.

WHO THRIVES:
Individuals who excel in this field possess strong analytical thinking and exceptional attention to detail, as evidenced by the high importance ratings for dependability and precision in the work style requirements. The Investigative and Conventional RIASEC profile indicates success for those who enjoy systematic problem-solving and methodical approaches to complex technical challenges. Professionals must maintain intellectual curiosity to stay current with evolving cyber threats and forensic techniques. The role demands high integrity and cautiousness given the legal implications of evidence handling and the sensitive nature of criminal investigations. Those who thrive combine technical expertise with strong communication skills to present complex findings to diverse audiences including attorneys, law enforcement, and executives.

CAREER ENTRY:
Entry typically requires a bachelor's degree in cybersecurity, computer science, information technology, or criminal justice, reflecting the Job Zone 4 considerable preparation requirement. Many employers prefer candidates with specialized certifications such as Certified Computer Hacking Forensic Investigator (CHFI) or SANS forensics certifications. Relevant experience through internships in cybersecurity, IT security roles, or law enforcement cyber units provides valuable practical exposure. Some professionals enter from related technical roles in information security or system administration before specializing in forensics.

CAREER TRAJECTORY:
Digital forensics analysts can advance to senior forensic examiner roles, leading complex multi-jurisdictional investigations and mentoring junior analysts. Many progress into cybersecurity management positions, leveraging their investigative experience to design better security architectures and incident response procedures. Career paths often lead to specialized roles in threat hunting, malware analysis, or consulting for law enforcement agencies. The field also offers opportunities to transition into expert witness roles for legal proceedings or entrepreneurial ventures in cybersecurity consulting.

MARKET INTELLIGENCE:
According to BLS OEWS May 2025 data, digital forensics analysts earn a median annual salary of $116,580, with the range spanning from $55,940 to $188,470 across experience levels. The field shows strong geographic wage variation, with the District of Columbia offering the highest compensation at $156,590 compared to Puerto Rico at $60,470, representing a 2.59x ratio. Employment is concentrated in Professional, Scientific, and Technical Services (123,970 positions), Government sectors (97,870), and Information industries (48,470). With 435,370 total employed nationwide, the field demonstrates robust demand driven by increasing cybercrime and regulatory compliance requirements. The concentration in government and professional services reflects the critical role these analysts play in national security and corporate incident response.

AUTOMATION OUTLOOK:
Digital forensics analysis maintains strong resilience against automation due to the complex reasoning and legal judgment required for evidence interpretation and case building. While automated tools continue to improve for data collection and pattern recognition, human expertise remains essential for contextualizing findings, adapting to novel attack vectors, and presenting evidence in legal proceedings. The investigative and analytical nature of the work, combined with the need for expert testimony, positions this occupation favorably in an increasingly automated landscape.

--- REASONED EDGES ---
  [skill_overlap] Information Security Analysts (15-1212.00) — confidence:high
    reasoning: Both roles analyze security incidents and maintain knowledge of cybersecurity technologies, with digital forensics providing specialized post-incident investigation capabilities.
    data: Shared security analysis tasks
    data: Common cybersecurity knowledge requirements
    data: O*NET primary-short relationship
  [riasec_cluster] Information Security Engineers (15-1299.05) — confidence:high
    reasoning: Both roles share the Investigative-Conventional RIASEC profile and focus on technical security implementations, with forensics providing post-breach analysis expertise.
    data: Similar RIASEC codes I:6.11, C:6.03
    data: Technology tools overlap
    data: Primary-short O*NET relationship
  [task_similarity] Intelligence Analysts (33-3021.06) — confidence:medium
    reasoning: Both roles examine records and data to investigate activities, though digital forensics focuses specifically on cyber incidents and digital evidence.
    data: Shared investigative methodologies
    data: Evidence analysis tasks
    data: O*NET primary-short relationship
  [knowledge_overlap] Penetration Testers (15-1299.04) — confidence:high
    reasoning: Both require deep understanding of cybersecurity vulnerabilities and attack methods, with forensics analyzing completed attacks while penetration testers proactively test defenses.
    data: Shared cybersecurity knowledge
    data: Similar technology tools
    data: Primary-short relationship
  [transferable_skill] Forensic Science Technicians (19-4092.00) — confidence:medium
    reasoning: Both roles require evidence preservation, chain of custody procedures, and expert testimony capabilities, though digital forensics specializes in electronic evidence.
    data: Evidence handling protocols
    data: Legal procedure knowledge
    data: Primary-long O*NET relationship
  [career_pathway] Security Managers (11-3013.01) — confidence:medium
    reasoning: Digital forensics analysts often advance to security management roles, leveraging their incident investigation experience to lead cybersecurity programs.
    data: Management progression pathway
    data: Security leadership requirements
    data: O*NET primary-long relationship
  [task_similarity] Business Intelligence Analysts (15-2051.01) — confidence:low
    reasoning: Both roles analyze complex data patterns and create reports for decision-making, though digital forensics focuses on security incidents rather than business metrics.
    data: Data analysis methodologies
    data: Report generation tasks
    data: Primary-long relationship

--- NORMALIZER SIGNALS ---
  match_keywords   : ['digital forensics', 'cyber forensics', 'computer forensics', 'forensic analyst', 'cyber defense analyst', 'digital evidence', 'incident response analyst', 'cyber threat analyst']
  exclude_keywords : ['general forensics', 'physical evidence', 'crime scene', 'laboratory technician', 'medical examiner']
  title_patterns   : ['*Digital*Forensic*', '*Cyber*Forensic*', '*Computer*Forensic*', '*Digital*Evidence*', '*Cyber*Defense*Analyst*']
  common_variations: ['Digital Forensics Analyst', 'Cyber Forensics Investigator', 'Computer Forensic Examiner', 'Digital Evidence Analyst', 'Cyber Incident Analyst', 'Digital Media Analyst', 'Forensic Computer Specialist', 'Cyber Defense Forensics Analyst']

total_terms    : 40
top_words      : ['digital', 'forensics', 'evidence', 'forensic', 'computer', 'tendency', 'analysis', 'investigations', 'tools', 'law', 'media', 'devices', 'criminal', 'investigation', 'crime', 'enforcement', 'network', 'security', 'legal', 'laws']
source_layers  : onet_tasks | onet_dimensions | dwas | wikipedia | inference

TERM                    COUNT     FREQ  DOMINANT SOURCE      SOURCE BREAKDOWN
──────────────────────────────────────────────────────────────────────────────────────────
digital                   122  0.03452  wikipedia            wikipedia:85%  inference:10%  onet_tasks:4%
forensics                  89  0.02518  wikipedia            wikipedia:89%  inference:10%  onet_tasks:1%
evidence                   67  0.01896  wikipedia            wikipedia:85%  inference:10%  onet_tasks:4%
forensic                   62  0.01754  wikipedia            wikipedia:89%  inference:8%  onet_tasks:3%
computer                   58  0.01641  wikipedia            wikipedia:79%  inference:10%  dwas:9%
tendency                   42  0.01188  onet_dimensions      onet_dimensions:100%
analysis                   28  0.00792  wikipedia            wikipedia:75%  onet_tasks:18%  inference:7%
investigations             28  0.00792  wikipedia            wikipedia:86%  inference:11%  onet_tasks:4%
tools                      25  0.00707  wikipedia            wikipedia:88%  inference:8%  onet_tasks:4%
law                        24  0.00679  wikipedia            wikipedia:79%  inference:21%
media                      22  0.00622  wikipedia            wikipedia:86%  onet_tasks:9%  inference:5%
devices                    21  0.00594  wikipedia            wikipedia:90%  inference:10%
criminal                   20  0.00566  wikipedia            wikipedia:70%  dwas:20%  inference:10%
investigation              20  0.00566  wikipedia            wikipedia:95%  inference:5%
crime                      19  0.00538  wikipedia            wikipedia:95%  inference:5%
enforcement                18  0.00509  wikipedia            wikipedia:72%  inference:28%
network                    17  0.00481  wikipedia            wikipedia:59%  onet_tasks:18%  inference:18%
security                   17  0.00481  wikipedia            wikipedia:41%  inference:35%  onet_tasks:12%
legal                      16  0.00453  inference            inference:44%  wikipedia:38%  onet_tasks:12%
laws                       15  0.00424  wikipedia            wikipedia:87%  onet_tasks:7%  dwas:7%
science                    14  0.00396  wikipedia            wikipedia:86%  inference:14%
cyber                      13  0.00368  onet_tasks           onet_tasks:46%  wikipedia:31%  inference:23%
device                     13  0.00368  wikipedia            wikipedia:100%
files                      12  0.00340  wikipedia            wikipedia:42%  onet_tasks:33%  inference:17%
technical                  12  0.00340  inference            inference:50%  wikipedia:25%  dwas:17%
others                     12  0.00340  onet_dimensions      onet_dimensions:83%  dwas:17%
mobile                     12  0.00340  wikipedia            wikipedia:100%
software                   10  0.00283  wikipedia            wikipedia:60%  onet_tasks:20%  dwas:10%
computers                  10  0.00283  wikipedia            wikipedia:90%  dwas:10%
act                        10  0.00283  wikipedia            wikipedia:100%
international              10  0.00283  wikipedia            wikipedia:100%
crimes                      9  0.00255  wikipedia            wikipedia:78%  onet_tasks:11%  inference:11%
requirements                9  0.00255  wikipedia            wikipedia:44%  inference:33%  onet_tasks:11%
write                       9  0.00255  onet_tasks           onet_tasks:44%  dwas:44%  wikipedia:11%
examination                 9  0.00255  wikipedia            wikipedia:100%
civil                       9  0.00255  wikipedia            wikipedia:100%
investigative               9  0.00255  wikipedia            wikipedia:67%  inference:33%
guidelines                  9  0.00255  wikipedia            wikipedia:100%
investigators               9  0.00255  wikipedia            wikipedia:100%
analysts                    9  0.00255  inference            inference:67%  wikipedia:33%