Digital Forensics Examiner

The Amatriot Group; Linthicum (MD); On-site; USD 130,000 - 180,000; Full time

Job summary

The Amatriot Group seeks a Digital Forensics Examiner to support a federal government agency. You will analyze electronic media, preserve and recover data, and prepare findings for courtroom presentation. Testimony as an expert witness in federal or military court may be required.

Required: active Secret clearance, 4+ years of forensic analysis across multiple platforms, and proficiency with EnCase/FTK/X-Ways. On-site Linthicum Heights, MD location with full-time employment.

Qualifications

• Bachelor’s degree and 8+ years of relevant experience.
• Master’s degree and 6+ years of relevant experience.
• An additional 4 years of relevant experience or specialized training may be considered in lieu of a bachelor’s degree.
• Formalized training in computer science, forensics, or related areas.

Responsibilities

• Examine electronic devices for evidence to be used in court.
• Perform digital evidence preservation, forensic analysis, and data recovery.
• Document procedures and findings for courtroom presentation.
• Testify as an expert witness in federal or military court when required.

Skills

Digital forensic analysis

Evidence handling

Expert witness

Technical reporting

Networking knowledge

Education

Bachelor's degree

Master's degree

Forensic training

Experience in lieu of degree

Tools

EnCase

FTK

X-Ways

Axiom

Forensic Explorer

Cellebrite

Job description

Location: Linthicum Heights, MD

Security Clearance: Active Secret or higher [Required]

Job Type: Full-Time

Target Salary Range*: $130,000 - $180,000

This represents the potential salary range for this position depending on education level, years of experience and/or certifications in addition to other position specific requirements which may impact salary

Position Overview

The Digital Forensics Examiner analyzes electronic media for a federal government agency in support of sensitive, ongoing criminal investigations and operations. The role examines digital devices, preserves and analyzes evidence, recovers data, and documents findings for courtroom presentation. The examiner may be required to testify as an expert witness in federal or military court.

Key Responsibilities

Digital Evidence Examination and Recovery

• Examine computers, storage devices, cell phones, PDAs, and other electronic devices for evidence that may be used in court.
• Perform digital evidence preservation, forensic analysis, data recovery, tape recovery, email extraction, and database examination.
• Use forensic tools and techniques to crack file and system passwords, detect steganography, and recover deleted, fragmented, and corrupted data from digital media.

Evidence Handling and Documentation

• Gather and handle digital evidence using proper evidence custody and control procedures.
• Document procedures and findings in a manner suitable for courtroom presentation.
• Prepare comprehensive written notes and reports.
• Testify as an expert witness in federal or military court when required.

QualificationsEducation And Experience

• Meet one of the following education and experience combinations: [Required]
  • Bachelor’s degree and 8+ years of relevant experience.
  • Master’s degree and 6+ years of relevant experience.
• An additional 4 years of relevant experience or specialized training may be considered in lieu of a bachelor’s degree.
• Formalized training in computer science, forensics, or related areas. [Required]

Experience

• At least 4 years of experience conducting digital forensic analysis across a variety of media, including Windows, OS X, Linux, Android, and iOS. [Required]
• Experience supporting criminal investigations. [Required]
• Experience writing technical reports detailing analysis results. [Required]
• Experience with EnCase, FTK, X-Ways, Axiom, Forensic Explorer, Cellebrite, and other forensic tools. [Required]
• Knowledge of and experience with virtual environments. [Required]

Skills

• Understanding of network protocols and networking concepts. [Required]

Certifications

• Hold one or more active forensic certifications from the following list: [Required]
  • Digital Media Collector (DMC).
  • Digital Forensic Examiner (DFE).
  • Cyber Crime Investigator (CCI).
  • Computer Hacking Forensic Investigator (CHFI).
  • International Association of Computer Investigative Specialists (IACIS) certifications: Certified Computer Examiner (CCE) or Certified Forensic Computer Examiner (CFCE).
  • GIAC Certified Forensic Examiner (GCFE).
  • GIAC Certified Forensic Analyst (GCFA).
  • Mobile device forensic tool certifications, such as Cellebrite Certified Mobile Examiner (CCME), XRY, or Oxygen Forensic® Certified Examiner (OFCE).
  • Computer forensic tool certifications, such as EnCase Certified Examiner (EnCE), X-Ways Professional in Evidence Recovery Techniques (X-PERT), or Magnet Certified Forensic Examiner (MCFE).
  • Data recovery or advanced data acquisition certifications.
• Submit a copy of the certification with the resume. [Required]

Clearance

• Minimum active Secret clearance. [Required]

Other Requirements

• Pass the customer’s Mentorship Program within 4 months. [Required]
• Task Order: CFL.

Working Conditions

• Location: Linthicum Heights, MD (full-time on-site). [Required]

Preferred QualificationsExperience

• Previous law enforcement experience.
• Experience performing technical or peer reviews.
• Experience mentoring other examiners.
• Experience testifying as an expert witness in criminal trials.