Electronic Forensics Analyst

Job Summary

Performs advanced and highly specialized forensic examinations of computer hard drives, cell phones, tablets, and other media sources for possible criminal behavior. Performs forensic examinations on seized digital storage media systems and provides investigative and technical guidance on related digital media evidence. Provides ongoing analysis of technology trends to incorporate proven forensic investigation and supporting technologies into practice.

Job Description

ESSENTIAL DUTIES

• Performs a variety of specialized computer forensics and electronic investigative services on digital media, including evidence preservation, analysis, data recovery, tape recovery, electronic mail extraction, and database exams. Digital media includes, but is not limited to, data storage and transfer devices, such as computers, laptops, cellular phones, personal digital assistants (PDA's), and the images, spreadsheets and other files stored on these devices.

• Maintains strict protocol guidelines for chain of custody and all the evidence to ensure integrity of each item of evidence is handled and analyzed according to meet legal practice requirements that includes collecting, transporting, receiving, storing, labeling, and preserving data collected for digital evidence on submittal for examination and analysis.

• Determines the most appropriate method of protecting original evidence and recovering deleted, erased, hidden, and encrypted digital evidence.

• Evaluates scientific results of analysis to determine the validity and whether the information has forensic significance.

• Provides technical guidance in evaluating and investigating cases where computer of related computer media contains potential evidence.

• Provides progress reports regarding investigations as well as detailed and technical report summaries of findings in written and verbal formats.

• Interacts with investigators from law enforcement and Information Technology (IT) department personnel to acquire information necessary to perform forensic examinations. Demonstrates the ability to communicate, coordinate and cooperate with these agencies and in a task force environment.

• Specially trained crime scene investigator that gathers forensic and photographic evidence, use of Alternative Light Sources, use of chemical processes, examination for latent prints, gathering of DNA evidence, diagramming scenes, and taking casting impressions.  Assist with initial protection and security of crime scenes and assist law enforcement officers and detectives to ensure that all fragile and crucial evidence is appropriately collected before law enforcement clears a scene.

• Uses the program Cellebrite/Graykey that requires specialized training to collect and preserve data lawfully from the widest range of digital devices and sources, making it accessible to anyone who needs it.  Review data in formats that are easy-to-comprehend, targeted and actionable.Analyze and process data quickly to find and validate key pieces of digital evidence, surfacing insights to expedite case resolution and time-to-justice.

• Coordination of Unmanned Aerial Vehicles (UAV) (Drones) program to ensure that pilots have the proper training and to understand and comply with the guidelines necessary to operate a drone. Check drones before a flight to ensure safe and proper operation. Collect and report data on drone use.  Analyze weather forecasts to ensure safe flights. Document pre- and post-flight logs. Monitor drones during flight. Plan drone flight routes. Navigate drones along designated paths. Gather information or produce aerial photographs, as needed. Perform equipment testing, troubleshooting, and maintenance.

• Provides expert testimony in the field of computer forensics; prepares evidence and presents expert testimony in court on results of seizure and handling of evidence and results of analysis conducted.

• Continually updates and develops skills regarding new computer technology and use of new software and hardware tools to extract information from computer and digital media systems.

• Attends training, workshops, and seminars to maintain current methodologies and knowledge of trends and developments in the field of computer forensics.

• Reviews various court decisions relating to the field of computer forensics.

• Travels to a variety of locations throughout the County to provide technical assistance to investigators and to collect evidence.

• Works the hours and/or shifts assigned and begins and ends work on time.  Duties may occasionally require work outside of an office setting and outside of normal business hours. 

• Performs other duties as required or assigned. 

MINIMUM QUALIFICATIONS
Requires equivalency of a bachelor's degree in digital Forensics (preferred), Computer Science, Computer Engineering, or related field and three years of experience working in forensic technology involving computer forensics, electronic discovery, and technical investigations. Must be able to demonstrate the ability to evaluate and maintain hardware and software necessary for the performance of criminal investigations preferable in a law enforcement environment. Additional skills required include understanding and analysis of systems security. The incumbent shall possess a valid driver's license and shall provide a reliable means of transportation for the performance of work responsibilities.

PREFERRED QUALIFICATION(S)

Certification as a Computer Forensic Technician or Certification as a Forensic Computer Examiner is desired, as well as the ability to understand and have experience with criminal law, computer forensic software.

SUPERVISORY CONTROLS
The employee is under general guidance and direction from the Investigations Sergeant and Support and Services Captain as well as the Chief Deputy and Sheriff. Work is performed in accordance with prescribed departmental policies and procedures. The employee works on his/her own initiative and has broad latitude for independent judgment. Work is reviewed through observation of results and evaluation of reports submitted.

Position receives direct supervision from the Investigations Sergeant and Support and Services Captain as well as the Chief Deputy and Sheriff.

CORE COMPETENCIES AND ABILITIES
Customer Service - Delivers government services in a respectful, responsive, and solution-oriented manner.

Communication - Is always clear about what we're doing and why we're doing it.

Collaboration - Works with partners – communities, schools, faith groups, private business, and non-profit agencies – to see that services are not duplicated but rather are complimentary, aligned, and provided by the partners who can deliver the service most effectively.

Stewardship - Works proactively to make investments, guided by resident input, which will transform lives, communities, and government.

Empowerment - Works with individuals and families to affirm strengths, develop skills, restore hope, and promote self-reliance.

Resiliency - Fosters public preparedness and responds when families and communities face health and safety emergencies.

Innovation - Takes informed risks to deliver services more effectively and learns from successes and failures.

Knowledge – Knowledge of current trends, and up to date methods of mining media devices of all types for evidentiary data.

Knowledge of digital, analytical and research concepts and methods.

Knowledge of relationships between internal and external agencies and their various administrative teams.

Knowledge in public safety business applications and industry solutions including data processing techniques and practices, forms and records management.

Ability – Ability to communicate the meaning and importance of digital evidence in such a fashion as it is understood by staff members without high level technology training.

Ability to design charts, graphs, etc which will assist in communicating digital evidence to an audience with varying levels of experience with technology.

Ability to provide suggestions based on what the data is showing.

Ability to work in a team environment including both county staff members as well as outside entities/professionals.

Ability to work independently without close supervision.

Ability to work outside of normal business hours and office settings.

Ability to speak, present, and interact in public arenas with composure, professionalism, and discretion.

Ability to use MS Office software for the performance of essential duties.

Ability to use appropriate discretion in dealing with matters of a confidential nature.

WORK ENVIRONMENT AND PHYSICAL DEMANDS
Typical characteristics of the regular, ongoing work environment of this position requires inside work, typically in an office setting.

Physical activities include sedentary to light work: Reaching, sitting, standing, walking, pushing, lifting, pulling, fingering, grasping, feeling, stooping, talking, hearing, seeing, and repetitive motions.  Lifts and/or navigates up to 35 pounds on a routine basis in handling files and equipment necessary for performing the essential duties of the job.

SELECTION PROCESS

Selection for this position will be based on a minimum qualifications screening and rating of training and experience. Top candidates will be forwarded to hiring manager or supervisor for consideration for interview and/or additional assessments. Final selection will include a background check and approval by the County Board.