Senior Disk Forensics Lead — 100% Remote

Coletivo 45+; Abu Dhabi; Remote; AED 350,000 - 650,000; Full time

Benefits offered by this job

100% remote

Competitive compensation

Complex investigations

Professional development

International collaboration

Job summary

Coletivo 45+ is seeking a Senior Disk Artifact Examination Specialist to conduct advanced digital forensic examinations of storage media, disk images, and file systems. You will identify, preserve, analyze, and interpret digital evidence to support cybersecurity investigations and regulatory matters.

The successful candidate will lead examinations, recover deleted data, analyze file systems (NTFS, APFS, ext4, etc.), and document evidence with robust reporting.

Qualifications

• Bachelor's or master's degree in Digital Forensics, Cybersecurity, Computer Science, Information Technology, or related discipline.
• Significant professional experience in digital forensic examination, disk analysis, incident response, or forensic investigations.
• Knowledge of deleted file recovery, file carving, metadata analysis, and forensic timeline reconstruction.

Responsibilities

• Lead forensic examinations of disk images, storage media, file systems, and digital storage artifacts.
• Analyze forensic images from hard drives, SSDs, removable storage, and virtual disks.
• Examine file system structures (NTFS, FAT, exFAT, APFS, ext4, etc.).
• Identify, recover, and analyze deleted files, hidden data, and residual artifacts.
• Examine metadata, timestamps, file access records, and directory structures.
• Analyze OS artifacts, browser histories, event logs, and user activity records.
• Conduct timeline analysis to reconstruct activities and events.
• Identify indicators of data deletion, manipulation, and unauthorized access.
• Examine partitions, boot records, volume structures, and file allocation information.
• Use forensic tools such as EnCase, FTK, Autopsy, X-Ways Forensics, Magnet AXIOM.
• Verify image integrity using cryptographic hashing and evidence validation procedures.
• Maintain chain-of-custody documentation and proper evidence handling standards.
• Develop examination methodologies, procedures, and QA controls.
• Collaborate with incident response teams, legal, and compliance professionals.
• Prepare detailed forensic reports explaining methods, findings, limitations, and evidence.
• Review results for accuracy, reproducibility, and evidential reliability.
• Provide technical guidance and mentorship to junior analysts.

Skills

Forensic analysis

Disk imaging

Evidence handling

Scripting (Python/PowerShell)

Timeline reconstruction

Report writing

Education

Bachelor's or Master's in Digital Forensics / Cybersecurity / CS

Tools

EnCase

FTK

Autopsy

X-Ways Forensics

Magnet AXIOM

Job description

Coletivo 45+ is seeking a Senior Disk Artifact Examination Specialist to conduct advanced digital forensic examinations of storage media, disk images, and file systems. You will identify, preserve, analyze, and interpret digital evidence to support cybersecurity investigations and regulatory matters.

The successful candidate will lead examinations, recover deleted data, analyze file systems (NTFS, APFS, ext4, etc.), and document evidence with robust reporting.