Which tools, certifications and techniques do DFIR employers actually ask for? Explore demand from the job postings Forensic Focus tracks every week, filtered by country and role focus.
Demand at a glance
Across 2,008 unique DFIR job postings collected 2026-05-30 to 2026-08-31 in 13 countries, these are the tools, certifications and techniques employers name most often. Percentages are the share of tracked postings mentioning each term.
Tools most often named
| Tools | Share of postings |
|---|---|
| EnCase | 5% |
| FTK | 5% |
| Cellebrite | 4% |
| AXIOM | 3% |
| CrowdStrike | 3% |
| X-Ways | 3% |
| Splunk | 2% |
| Relativity | 2% |
| Nuix | 2% |
| Autopsy | 2% |
Certifications most often named
| Certifications | Share of postings |
|---|---|
| GCFA | 4% |
| GCIH | 3% |
| GCFE | 3% |
| SANS | 2% |
| GNFA | 2% |
| GREM | 1% |
| CISSP | 1% |
| EnCE | 1% |
| CHFI | 1% |
| CFCE | 1% |
Techniques most often named
| Techniques | Share of postings |
|---|---|
| threat hunting | 21% |
| malware analysis | 17% |
| triage | 17% |
| log analysis | 5% |
| reverse engineering | 5% |
| Python | 5% |
| network forensics | 4% |
| memory forensics | 2% |
| data recovery | 2% |
| PowerShell | 2% |
Use the explorer above to filter by country and role focus, and to compare tools, certifications and techniques side by side.
More DFIR career tools
- DFIR Salary Explorer: advertised pay by country, role and seniority
- DFIR Training Finder: courses and certifications ranked by employer demand
- DFIR Tool and Vendor Directory: commercial and open-source tools by category
- Practice and CTF Directory: evidence datasets, labs and challenges to build skills on
- Tool Release Tracker: latest releases across the open-source DFIR toolbox