Attention to detail, analytical thinking, and communication are key. What else do you find crucial?
I’d add courtroom-proof documentation: I log every data pull, hash the files, and jot a one-line “why” after each step so the trail reads like it’s ready to be Exhibit A. All the analysis in the world won’t help if chain of custody is fuzzy — do you keep a simple evidence log or use a tool like Caseware IDEA?