Digital Evidence Examiner | Incident Reconstruction Specialist

Abu Dhabi Berkeley Services LLC; Abu Dhabi Emirate; On-site; AED 180,000 - 320,000; Full time

Job summary

Abu Dhabi Berkeley Services LLC in Abu Dhabi seeks a Digital Evidence Examiner | Incident Reconstruction Specialist to conduct digital forensic examinations, analyze electronic evidence, and reconstruct incidents across computers, mobile devices, networks, and storage media. The role collaborates with cybersecurity, legal, and compliance teams to produce accurate findings and detailed reports.

Candidates should be proficient in forensic methodologies, operating systems, storage technologies, and

Qualifications

• Bachelor's degree or higher in digital forensics, cybersecurity, CS, IT, or related field.
• Experience in digital forensic examination, incident investigation, or electronic evidence handling.
• Knowledge of forensic methodologies, evidence preservation, and chain-of-custody procedures.

Responsibilities

• Conduct digital forensic examinations on computers, laptops, mobile devices, storage media, and other electronic systems.
• Identify, collect, preserve, and examine digital evidence per established forensic procedures.
• Ensure evidence integrity through documentation, secure handling, and chain-of-custody management.
• Perform forensic imaging and data acquisition using validated methodologies.
• Analyze file systems, OS artifacts, logs, and metadata for incident reconstruction.
• Reconstruct timelines and sequences of events from system records and artifacts.
• Correlate evidence from multiple sources to establish incident timelines and relationships.

Skills

Analytical thinking

Attention to detail

Technical writing

Communication skills

Problem solving

Team collaboration

Education

Bachelor's degree in Digital Forensics, Cybersecurity, Computer Science, or related field

Tools

EnCase

FTK

Autopsy

X-Ways Forensics

Magnet AXIOM

Job description

We are seeking a highly analytical, detail-oriented, and technically skilled Digital Evidence Examiner | Incident Reconstruction Specialist to conduct digital forensic examinations, analyze electronic evidence, and reconstruct incidents involving computer systems, digital devices, networks, and electronic data. This role combines digital forensics, evidence preservation, incident analysis, forensic investigation, and technical reconstruction.

The successful candidate will work closely with cybersecurity teams, forensic investigators, legal professionals, compliance departments, and relevant stakeholders to identify, collect, preserve, examine, and interpret digital evidence. The ideal candidate has a strong understanding of forensic methodologies, operating systems, digital storage technologies, network activity, and evidence handling procedures, with the ability to produce accurate findings and defensible technical reports.

Key Responsibilities

• Conduct digital forensic examinations involving computers, laptops, mobile devices, storage media, and other electronic systems.
• Identify, collect, preserve, and examine digital evidence in accordance with established forensic procedures.
• Ensure evidence integrity through proper documentation, secure handling, and chain-of-custody management.
• Perform forensic imaging and data acquisition using appropriate tools and validated methodologies.
• Analyze file systems, operating system artifacts, application records, system logs, and metadata.
• Examine deleted, hidden, fragmented, or otherwise difficult-to-access digital data where legally authorized.
• Reconstruct timelines of digital activities based on system records, timestamps, logs, and available artifacts.
• Analyze digital events to determine the sequence of actions associated with security incidents or other investigated events.
• Examine network logs, connection records, access histories, and communication artifacts to support incident reconstruction.
• Investigate potential unauthorized access, data manipulation, suspicious file activity, and digital system misuse.
• Analyze email records, browser histories, application data, and relevant communication records when within the authorized scope.
• Examine mobile device artifacts, including messages, call records, application activity, and location-related data where legally permitted.
• Support investigations involving malware-related activity, data breaches, insider threats, and unauthorized data transfers.
• Correlate evidence from multiple digital sources to establish incident timelines and identify relationships between events.
• Use digital forensic software and specialized examination tools to extract, process, and analyze electronic evidence.
• Validate forensic findings through repeatable examination methods and appropriate technical verification.
• Document examination procedures, evidence sources, technical observations, and analytical findings in detail.
• Prepare comprehensive forensic reports explaining methodologies, findings, limitations, and conclusions.
• Create technical timelines, evidence summaries, diagrams, and supporting materials for investigation teams.
• Identify inconsistencies, missing information, and potential evidence gaps requiring further examination.
• Work with cybersecurity incident response teams to support investigations and determine the technical scope of incidents.
• Coordinate with legal and compliance departments to ensure forensic activities follow applicable laws, policies, and evidence requirements.
• Maintain secure evidence repositories and ensure examination records are accurate and properly controlled.
• Support the preparation of evidence packages for internal investigations, regulatory reviews, and legal proceedings.
• Present technical findings to investigators, legal representatives, management, and other authorized stakeholders.
• Explain complex digital evidence and forensic procedures in clear, understandable language.
• Maintain awareness of developments in digital forensic technologies, investigative methodologies, and relevant standards.
• Evaluate forensic tools and recommend improvements to examination procedures and evidence management practices.
• Support quality assurance reviews to maintain consistency, accuracy, and reliability across forensic examinations.
• Ensure confidential information and sensitive digital evidence are protected throughout the investigation process.
• Provide technical guidance and knowledge sharing to colleagues involved in digital investigations.

We’re Hiring: Digital Evidence Examiner | Incident Reconstruction Specialist

Employment Type: Full-Time

Level: Mid-Level to Senior

We are seeking a highly analytical, detail-oriented, and technically skilled Digital Evidence Examiner | Incident Reconstruction Specialist to conduct digital forensic examinations, analyze electronic evidence, and reconstruct incidents involving computer systems, digital devices, networks, and electronic data. This role combines digital forensics, evidence preservation, incident analysis, forensic investigation, and technical reconstruction.

The successful candidate will work closely with cybersecurity teams, forensic investigators, legal professionals, compliance departments, and relevant stakeholders to identify, collect, preserve, examine, and interpret digital evidence. The ideal candidate has a strong understanding of forensic methodologies, operating systems, digital storage technologies, network activity, and evidence handling procedures, with the ability to produce accurate findings and defensible technical reports.

Key Responsibilities

• Conduct digital forensic examinations involving computers, laptops, mobile devices, storage media, and other electronic systems.
• Identify, collect, preserve, and examine digital evidence in accordance with established forensic procedures.
• Ensure evidence integrity through proper documentation, secure handling, and chain-of-custody management.
• Perform forensic imaging and data acquisition using appropriate tools and validated methodologies.
• Analyze file systems, operating system artifacts, application records, system logs, and metadata.
• Examine deleted, hidden, fragmented, or otherwise difficult-to-access digital data where legally authorized.
• Reconstruct timelines of digital activities based on system records, timestamps, logs, and available artifacts.
• Analyze digital events to determine the sequence of actions associated with security incidents or other investigated events.
• Examine network logs, connection records, access histories, and communication artifacts to support incident reconstruction.
• Investigate potential unauthorized access, data manipulation, suspicious file activity, and digital system misuse.
• Analyze email records, browser histories, application data, and relevant communication records when within the authorized scope.
• Examine mobile device artifacts, including messages, call records, application activity, and location-related data where legally permitted.
• Support investigations involving malware-related activity, data breaches, insider threats, and unauthorized data transfers.
• Correlate evidence from multiple digital sources to establish incident timelines and identify relationships between events.
• Use digital forensic software and specialized examination tools to extract, process, and analyze electronic evidence.
• Validate forensic findings through repeatable examination methods and appropriate technical verification.
• Document examination procedures, evidence sources, technical observations, and analytical findings in detail.
• Prepare comprehensive forensic reports explaining methodologies, findings, limitations, and conclusions.
• Create technical timelines, evidence summaries, diagrams, and supporting materials for investigation teams.
• Identify inconsistencies, missing information, and potential evidence gaps requiring further examination.
• Work with cybersecurity incident response teams to support investigations and determine the technical scope of incidents.
• Coordinate with legal and compliance departments to ensure forensic activities follow applicable laws, policies, and evidence requirements.
• Maintain secure evidence repositories and ensure examination records are accurate and properly controlled.
<
• Support the preparation of evidence packages for internal investigations, regulatory reviews, and legal proceedings.
• Present technical findings to investigators, legal representatives, management, and other authorized stakeholders.
• Explain complex digital evidence and forensic procedures in clear, understandable language.
• Maintain awareness of developments in digital forensic technologies, investigative methodologies, and relevant standards.
• Evaluate forensic tools and recommend improvements to examination procedures and evidence management practices.
• Support quality assurance reviews to maintain consistency, accuracy, and reliability across forensic examinations.
• Ensure confidential information and sensitive digital evidence are protected throughout the investigation process.
• Provide technical guidance and knowledge sharing to colleagues involved in digital investigations.

Requirements

• Bachelor's degree in Digital Forensics, Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field.
• Relevant experience in digital forensic examination, incident investigation, cybersecurity analysis, or electronic evidence handling.
• Strong understanding of digital forensic principles, evidence preservation, and chain-of-custody procedures.
• Knowledge of computer hardware, storage devices, file systems, and operating system structures.
• Familiarity with Windows, Linux, and macOS environments and their relevant forensic artifacts.
• Understanding of digital evidence acquisition, forensic imaging, hashing, and data integrity verification.
• Experience with forensic tools such as EnCase, FTK, Autopsy, X-Ways Forensics, Magnet AXIOM, or equivalent platforms.
• Knowledge of mobile device forensic examination and relevant extraction methodologies is advantageous.
• Familiarity with network traffic analysis, system logs, event records, and digital activity reconstruction.
• Understanding of common cybersecurity incidents, including unauthorized access, malware activity, and data exfiltration.
• Ability to analyze timestamps, metadata, application records, and system artifacts to reconstruct event sequences.
• Strong analytical and critical-thinking skills when evaluating digital evidence and investigative findings.
• Ability to distinguish verified evidence, technical observations, assumptions, and limitations.
• Excellent technical documentation and report-writing skills.
• Strong attention to detail when recording evidence, examination steps, and investigative findings.
• Understanding of evidence handling requirements and applicable legal or regulatory considerations.
• Ability to maintain objectivity, confidentiality, and professional integrity throughout investigations.
• Familiarity with incident response processes, investigation frameworks, and forensic reporting standards.
• Ability to communicate technical findings effectively to both technical and non-technical audiences.
• Strong problem-solving skills and the ability to work with complex or incomplete digital evidence.
• Experience supporting legal investigations, corporate investigations, or regulatory examinations is an advantage.
• Knowledge of forensic standards and guidance such as ISO/IEC 27037, NIST digital forensics guidance, or equivalent frameworks is beneficial.
• Ability to manage multiple examinations while maintaining accuracy and meeting investigation deadlines.
• Strong organizational skills and the ability to maintain secure, structured evidence records.
• Willingness to participate in technical reviews, investigation briefings, and professional development activities.
• Relevant certifications in digital forensics, incident response, or cybersecurity are advantageous.

What We Offer

• Competitive salary and comprehensive employee benefits.
• Opportunities to work on complex digital forensic examinations and incident reconstruction cases.
• Exposure to advanced forensic tools, investigation technologies, and evidence analysis techniques.
• Professional development in digital forensics, cybersecurity, and incident investigation.
• Opportunities to collaborate with forensic investigators, cybersecurity specialists, and legal professionals.
• Access to professional forensic software, technical resources, and examination environments.
• A structured working environment focused on evidence integrity, accuracy, and professional standards.
• Opportunities to participate in digital investigation and forensic process improvement projects.
• Support for relevant professional training and industry certifications.
• Opportunities to strengthen technical analysis, investigative reporting, and expert communication skills.
• Career progression toward Senior Digital Forensic Examiner, Digital Forensics Manager, Incident Investigation Lead, or Digital Forensics Director.