Do narcs make the best DF/IR investigators?

The digital forensics field attracts a wide range of professionals from diverse backgrounds. Still, one trend that caught my curiosity years ago was the number of narcotics investigators (“narcs”) that I met who transitioned into digital forensics. At first glance, it may seem like an unlikely leap. After all, the stereotypical narc is chasing dealers and hanging out in some of the most dangerous places with some of the most dangerous criminals; they’re not parsing through hexadecimal code on a computer screen. But the reality is that narcs are not only making this move—they’re excelling in it.

Here’s why I think they are drawn to digital forensics and what they bring to the table.

Why Narcs Are Transitioning to Digital Forensics

Let’s get my story out of the way. I was decent enough working narcs that a 4-year assignment in a local unit turned into more than a decade of international undercover operations in multiple task forces. It was during one of my narc assignments at a federal task force that I came across “computer forensics.”  And it was not until I saw how much working a case with children as victims moved me more than any drug case.  That is how I got started in a short story.

In a few of my initial classes (PCERT, BCERT, & ACERT) while I was still in narcs, I noticed that nearly all of the students were either prior or current narcs. I thought that odd at the time, but having thought and researched mindsets in investigations over the past years, I think I know why the narcs move into digital forensics.

1. The Digital Shift in Crime: Narcotics investigations have evolved dramatically over the past two decades. Traditional street-level operations have increasingly become digital operations. Traffickers now coordinate deals over encrypted messaging apps, sell their products on the dark web, and launder money through cryptocurrencies. For narcs, the “keyboard” has become just as critical as the street corner. Transitioning to digital forensics allows them to remain effective in dismantling drug networks that now rely heavily on technology.

2. Longevity and Career Growth: Narcotics work is physically and mentally demanding. Busting down doors and running undercover operations are not sustainable forever. Digital forensics offers a path for seasoned narcs to leverage their investigative skills in a less hazardous environment while staying engaged in meaningful, high-impact work. I would say it’s even more impactful.

3. The Increasing Demand for Experienced Investigators: The digital forensics field is growing rapidly, and there’s a high demand for professionals who can investigate complex cases. Agencies and private companies alike are seeking individuals with not just technical know-how, but also real-world investigative experience. Narcs fit that profile perfectly.

What Narcs Bring to Digital Forensics

1. Investigative Mindset: Narcs are trained to think and act like criminals. They’ve spent years piecing together evidence, connecting dots, and predicting behaviors. This investigative mindset translates seamlessly into digital forensics. Whether tracking a suspect through phone records or uncovering hidden data in a computer’s file system, their ability to think critically and creatively is a significant asset. Not only are they trained to think like a criminal, but they portray themselves as criminals when undercover. The most significant difference between an actor portraying themselves as criminals on the big screen and a narc is that a narc could be killed if their acting sucks.

2. Interpersonal Skills: One of the most underrated digital forensics skills is effectively communicating findings. Narcs are accustomed to testifying in court, interviewing suspects, and writing reports that hold up under scrutiny. These skills are invaluable when presenting digital evidence to attorneys, judges, or a jury. Most critical is communicating with those who have spent a life in crime and prison as if you did, too. Knowing the audience and reading the room is a key skill in narc work.

3. Experience with Multi-Faceted Cases: Narcotics investigations often involve layers of complexity—from financial crimes and money laundering to organized crime syndicates and international operations. Narcs are adept at managing multi-faceted investigations, a skill that aligns perfectly with the complexities of digital forensics cases. The big picture of a narcotic investigation is not just drugs. There are multiple crimes, many involved jurisdictions, and dozens of actively moving parts.

4. A Sense of Mission: Narcs are motivated by a deep sense of purpose. They’re not just collecting evidence; they’re dismantling criminal networks and protecting communities. This mission-driven attitude carries over into digital forensics, where the stakes are just as high if not higher depending on the case. Whether it’s catching a hacker, finding evidence in a child exploitation case, or uncovering corporate fraud, narcs bring a level of commitment that elevates the field.

Challenges and Opportunities

Of course, transitioning to digital forensics isn’t without its challenges. Narcs must develop technical skills, from understanding file systems to mastering forensic tools like X-Ways Forensics or Magnet AXIOM. However, their learning curve is often shorter than expected, thanks to their investigative background and adaptability.

One headstart that narcs have is access to tech. In every case I worked, I constantly looked for tech to help me wrap up the case. I installed GPSs, remotely turned on GPSs, broke into buildings to install covert A/V, used the coolest body wires, drove around with a Stingray and FLIRs, and initiated cases that turned into T3s with big budgets and more toys! One thing that I did not do was fall in love with any tech. I simply wanted whatever tech could do the task that I needed. There were more than a few occasions where we designed and modified our tech to fit specific needs.

The point is that whatever tool was available to help work the case, I wanted it and used it. This is no different from using whatever DFIR tool works to get the job done.

For agencies and companies hiring in this space, recognizing the value that narcs bring can open doors to a talent pool that is highly skilled, motivated, and ready to hit the ground running.

Final Thoughts

The move from narcotics to digital forensics is a natural evolution for many investigators. As crime continues to shift into the digital realm, the skills and experience that narcs bring are more relevant than ever. By embracing this transition, both the individuals making the move and the digital forensics field as a whole stand to benefit immensely.

If you’re a narc considering a career in digital forensics, leap. The keyboard may not have the same adrenaline rush as a raid or undercover op, but the impact you can make—and the skills you’ll bring—are just as powerful. I think more so.

Hey! What about everyone else?

First, I don’t think any job or field “makes” a person.  I think certain jobs draw a specific type of person.  For the DF part of IR, I think the job pulls in those with similar character traits, like a strong drive to figure out who did what, when, and how. Those with a natural inclination to investigate shine, especially in this field.

And if only narcs were in this field, it would not be as effective. Narcs have a unique perspective that others don’t have, making DF/IR one of the most effective tools against computer and computer-facilitated crimes. Yes, other investigators bring skills to the DF/IR table (homicide, robbery, etc…). Yes, even patrol officers bring skills into DF/IR.  But, only the undercover narc brings the experience, skills, and thinking that allows them to blend into the very criminals that they are investigating while at the same time, maintaining legal and ethical behavior. 

My point on the narc side of things is that narcs have a serious headstart in tracking criminals, thinking like criminals, predicting their behavior, constantly looking for evidence that supports the story, and not only seeing the big picture of an investigation but also taking on the role of a small cog among a wheel of criminals to watch, remember, learn, and investigate for the goal to place the suspect at a series of crimes.

I harp on this with the DF/IR investigative mindset. Anyone ever attending my presentations on this topic is getting this narc mindset applied to DF/IR, with every drop of experience that I have to share.

If you can increase your investigative skills by 1%, that might mean the difference in saving a life in a case. That in itself would make an entire career in DF/IR worthwhile. My recommendation is to push for that 1% increase, even if you already consider yourself a ‘good enough’ investigator, because when you leave this field after making someone’s life better, or save a life, your time on the planet was certainly worthwhile to others.

A little note on my mindset book

Take a look at the tech editor.  Lee Harris.  A total narc.  I handpicked him to tech edit the book for the very reasons I laid out.  Although I never worked narcs with Lee, we would have lit the streets on fire with good casework. But he did some pretty good cases, too.