Digital Forensic Examiner

The Digital Forensic Examiner is responsible for providing expertise in digital forensics, call detail record with geolocation analysis, and video evidence recovery with a preferred focus in public safety.  This role will assist law enforcement officers with enforcing criminal laws through forensic collection, recovery, processing, preservation, analysis, storage, maintenance, and/or presentation of digital evidence.  As assigned, work may include serving as a liaison with vendors; recommending purchases; assisting with budget monitoring; assisting in the selection of new equipment; installing and configuring digital forensic lab equipment.

Supervision Exercised/Received:

• Exercised: This classification typically does not supervise other employees.
• Received: This classification typically reports to a coordinator, supervisor, or manager.
• Note: Other reporting relationships may apply.

• Identify, acquire, and analyze digital evidence from a multitude of media sources using scientifically accepted and validated processes and leading the entire digital forensic process, implementing best practices, and ensuring the highest standards of accuracy and efficiency in evidence analysis.

• Proficient in using various computer forensic programs such as: Magnet Axiom, Forensic Explorer, Access Data FTK lmager, WinHex, and others to perform analysis on Windows and Apple operating systems along with cell phone forensic programs such as: Cellebrite and Graykey to include proper preservation and extraction of digital evidence from iOS and Android operating systems.
• Serve as the technical advisor throughout the life cycle of digital investigations. Gathering all available information to assess the needs of the case to provide technical guidance, investigative strategies, and provide case updates as deemed necessary to investigators.
• Possess expert knowledge of the principles, methods, and techniques used in the field of digital forensics and thorough knowledge of general operating system software and computer hardware.
• Provides training and instruction to law enforcement officers and civilians on proper digital forensic techniques used to identify, seize, secure, and transport digital evidence, e.g., computers, digital equipment, and electronic media; on computer-related crimes and forensic techniques; and on proper handling of evidence. Produce thorough and detailed reports documenting the examinations and analysis of digital evidence, call detail records, internet communications, etc.
• Maintains all digital forensic equipment in satisfactory condition. Researches and recommends software, hardware and training to maintain best practices. Is responsible in the contribution of research concerning legal issues and case law as it relates to digital forensics and call detail record analysis.  Attends and completes all required coursework and instruction to obtain and maintain digital forensic examiner certifications.
• Works with law enforcement officers and prosecutors to assist with the preparation of search warrants for digital evidence; investigating and gathering information; and documenting findings.
• Prepares reports, expert court opinions, and other correspondence accurately and timely.  Maintains case files on the digital evidence server and accurately records case information into the RMS database.
• Provide expert witness testimony in the fields of computer forensics, cellphone data extractions, geolocation analysis, internet communications, and presentation of video evidence.  Prepares documents and media for case agents and Commonwealth Attorneys as required.
• Conduct in-depth analysis of emails, and other internet communications data to identify evidence in criminal investigations.  Analyzing extracted data to identify relevant patterns and trends related to communication activities. Identify and interpret patterns in extracted data that maybe relevant to investigations.
• Proficient in surveillance video recovery, analysis, and editing using forensic programs.
• Performs other duties as assigned.

MINIMUM TRAINING AND EXPERIENCE:

• Bachelor's degree in computer science, business or a related field
• Related hardware/software support experience.
• Experience working in a law enforcement environment, including conducting and/or assisting with forensic investigations related to complex criminal and administrative investigations.
• An equivalent combination of training and experience (as approved by the department) may be used to meet the minimum qualifications of the classification

PREFERRED TRAINING AND EXPERIENCE:

• Computer and computer forensic examiner certifications such as Certified Forensic Computer Examiner (CFCE), Encase Certified Examiner (EnCE), Magnet Certified Forensic Examiner (MCFE), and Cellebrite mobile forensic certifications such as CCO/CCPA/CCPO/CCME is strongly preferred.

LICENSING, CERTIFICATIONS, and/or OTHER SPECIAL REQUIREMENTS:

• Some assignments may require a valid Virginia Driver's License with a satisfactory driving record and a valid Commonwealth of Virginia Driver's License within 30 days of hire.
• Required to maintain proficiency and certifications in conducting digital forensic examinations.

KNOWLEDGE, SKILLS, AND ABILITIES:

Knowledge (some combination of the following):

• Common computer programs such as Microsoft Office Suite (Word, Excel, etc.)
• Electronic databases and related software applications
• Process improvement

Skills (some combination of the following):

• Maintaining and reviewing work orders
• Communicating to various internal and external departments
• Interacting with a wide variety of people (staff and public) with varying degrees of technical or communication skills
• Evaluating equipment
• Customer Service
• Oral and written communication

Abilities (some combination of the following):

• Adapt
• Analyze
• Pay attention to detail
• Follow standard procedures and established practices
• Multi-task
• Problem solve
• Work effectively in teams
• Maintain vendor relationships
• Prioritize

Reasonable accommodations may be made to enable qualified individuals with disabilities to perform the essential functions of the job. Prospective and current employees are invited to discuss accommodations.

ENVIRONMENTAL HAZARDS: Working conditions may include exposure to travel to other locations within the City of Richmond as well as outside of the City of Richmond; exposure to hazardous physical conditions such as mechanical parts, electrical currents, vibrations, etc.; atmospheric conditions such as fumes, odors, dusts, gases, and poor ventilation; inadequate lighting; intense noise; and environmental hazards such as disruptive people, imminent danger, and a threatening environment. 

Physical Requirements and Working Environment: Due to the nature of work assignments, incumbents must be able to perform detailed work on multiple, concurrent tasks, with frequent interruptions and under time constraint. The essential duties of this classification may require the ability to regularly perform repetitive motions, see, hear, talk, feel, grasp, finger, walk, and lift; frequently reach, push, and pull; and occasionally stand, crouch, kneel, stoop, balance, and climb. The working conditions may include environmental hazards. In terms of the physical strength to perform the essential duties, this classification is considered to be light work, exerting up to 20 pounds of force occasionally, up to 10 pounds of force frequently, and a negligible amount of force constantly to move objects.

Salary : $61,526 - $96,450