County of Alameda

DESCRIPTION

Under close supervision at the one level, and under direction at the two level, Forensic Computer Examiners investigate and analyze digital evidence by performing hardware, software and virtual analyses of digital evidence in the criminalistics laboratory and in the field. To process and analyze digital evidence including disassembly of computer hardware; forensic imaging of digital media; examination of data related to criminal offenses; recovery of data from cellular telephones; and perform related duties as required.

DISTINGUISHING FEATURES

The Forensic Computer Examiner is a flexibly staffed classification found only in the Digital & Multimedia Evidence Unit of the Criminalistics Laboratory and will primarily assist with the examination of digital evidence associated with criminal activity. The Forensic Computer Examiner will interpret the results of their findings to law enforcement officers/attorneys, prepare materials for presentation in court, appear as an expert witness, and perform other related duties. At the one level, incumbents primarily handle routine cases and receive a substantial amount of on-the-job training, working closely with senior staff members in a tutorial atmosphere. After a two year probationary period at the one level the incumbent should have gained experience in acquiring, analyzing and reporting on digital evidence. Incumbents will also be required to attain certification as an EnCase Certified Examiner (EnCE) during this two year period in order to qualify for promotion to the Forensic Computer Examiner II. Employment may not be extended beyond two years if the incumbent has not met the requirements to promote to the Forensic Computer Examiner II.

EXAMPLES OF DUTIES

NOTE: The following are the duties performed by employees in this classification. However, employees may perform other related duties at an equivalent level. Each individual in the classification does not necessarily perform all duties listed.

1. Creates forensic images of original digital evidence in a variety of formats using a number of validated imaging programs such as: EnCase, FTK Imager, Raptor, Helix, Linen, MacQuisition, etc.
2. Performs forensic examinations of digital media using the most current versions of a number of validated forensic software programs such as: EnCase, FTK, Subrosa Soft, Blackbag Technologies, Helix, and others.
3. Performs forensic video analysis, examination, repair, comparison and/or evaluation.
4. Uses specialized software programs such as: AccessData Password Recovery, AccessData Registry Viewer, DNA, Liveview, VMWare, and others.
5. Maintains chain of custody and documents entire analysis using approved methods and forms.
6. Prepares clear and complete reports detailing the entire digital evidence examination.
7. Prepares materials for presentation in a court of law and testifies as an expert witness.
8. Maintains records of repairs, maintenance, preventative maintenance, upgrades, and modifications to equipment.
9. Uses validated software and hardware write blocking devices to preserve digital evidence integrity.
10. Extracts digital information from cellular telephones using a variety of approved methods and tools such as: Cellebrite UFED, DataPilot, Device Seizure, Neutrino, BitPim, and others.
11. Maintain logs on all issued equipment and keep issued equipment in working condition and error free from software or hardware conflicts.
12. Attends continuing education classes and maintains any necessary certificates as required by the Sheriff’s Office.

MINIMUM QUALIFICATIONS

Either I
Experience:

The equivalent of two years of full-time experience in the class of Forensic Computer Examiner I in the Alameda County classified service (Non-classified includes District Attorney’s Office, Hospital Authority, and the Consolidated Courts.)

Or II
Education:

Possession of a Bachelor’s degree in computer science, information technology, or a closely related field from an accredited college or university AND

Experience:

The equivalent of two years of verifiable full time experience conducting forensic computer examinations and cellular phone data extractions for a public or private agency (two additional years of verifiable full time experience may be substituted for the Bachelor’s degree).

License:
Incumbents in this class must possess a valid California Motor Vehicle Operator’s License.

Certifications:

All candidates and incumbents are required to possess and maintain on-going EnCase Certified Examiner (EnCE) certification. Certified Computer Examiner (CCE) and Certified Forensic Computer Examiner (CFCE) certifications are also desirable.

Special Requirements:

Incumbents in this class must be able to work effectively in an environment in which they may encounter sensitive/confidential information and data that contains sexually explicit or disturbing content; including child pornography.

A thorough background investigation will be performed on all prospective appointees.

Incumbents in this class may be required to work day, evening, night and rotating shifts, including weekends and holidays and may be required to respond to crime scenes.

Incumbents must successfully complete annual proficiency testing in the area of computer forensics as required by ASCLD/LAB accreditation standards.

NOTE: The Civil Service Commission may modify the above Minimum Qualifications in the announcement of an examination.

KNOWLEDGE AND SKILLS

NOTE: The level and scope of the following knowledge and abilities are related to duties listed under the “Examples of Duties” section of this specification.

Knowledge of:

• Computers and associated hardware and peripheral devices.
• Computer software and operating systems such as: Windows, Linux, Unix, MacOS, DOS and various proprietary formats.
• The principles and practices of electronic data storage, data encryption and computer security systems.
• American Society of Crime Laboratory Director/Laboratory Accreditation Board standards applying to digital forensics.
• The methods and techniques used to access, recover, review, validate and preserve electronically stored data.
• A variety of forensic software programs such as EnCase, FTK, PRTK, Registry Viewer, Mac Forensic Labs software, Blackbag Technology software, Paraben, Datapilot, Cellebrite, Helix, Knoppix, Raptor and other commercially available forensic programs.
• The principles and practices of evidence collection, preservation and handling.
• The presentation of evidence in a court setting.

Ability to:

• Communicate effectively both orally and in writing.
• Examine and analyze computer hardware, software and electronically stored data pertaining to law enforcement investigations.
• Collect, transport, process and secure evidentiary materials.
• Effectively prepare and present detailed reports of findings.
• Find and extract electronically stored information to be used as evidence.
• Work with various operating systems including Window, MacOS, Linux, and Unix file systems.
• Work with different levels of Redundant Array of Independent Disks (RAID) 0, 1, 5, 10, etc.
• Work across most hardware platforms including desktops, laptops, servers and enterprise-level storage devices.
• Manage several projects at once and maintain precise notes and required documentation.
• Establish and maintain effective working relationships.
• Work effectively in an environment in which incumbents may encounter sensitive/confidential information and data that contains sexually explicit or disturbing content; including child pornography.

CLASS SPEC HISTORY

DS:po 8/6/09
Newspecs: 8516-8517.doc
CSC Date: 11/4/2009

BENEFITS

Alameda County offers a comprehensive and competitive benefits package that affords wide-ranging health care options to meet the different needs of a diverse workforce and their families. We also sponsor many different employee discount, fitness and health screening programs focused on overall well being.  These benefits include but are not limited to*:

For your Health & Well-Being

• Medical – HMO & PPO Plans
• Dental – HMO & PPO Plans
• Vision or Vision Reimbursement
• Share the Savings
• Basic Life Insurance 
• Supplemental Life Insurance (with optional dependent coverage for eligible employees) 
• County Allowance Credit
• Flexible Spending Accounts - Health FSA, Dependent Care and Adoption Assistance
• Short-Term Disability Insurance
• Long-Term Disability Insurance
• Voluntary Benefits - Accident Insurance, Critical Illness, Hospital Indemnity and Legal Services
• Employee Assistance Program

For your Financial Future

• Retirement Plan - (Defined Benefit Pension Plan)
• Deferred Compensation Plan (457 Plan or Roth Plan)

For your Work/Life Balance

• 12 paid holidays
• Floating Holidays
• Vacation and sick leave accrual
• Vacation purchase program
• Catastrophic Sick Leave
• Group Auto/Home Insurance
• Pet Insurance
• Commuter Benefits Program
• Guaranteed Ride Home
• Employee Wellness Program (e.g. At Work Fitness, Incentive Based Programs, Gym Membership Discounts)
• Employee Discount Program (e.g. theme parks, cell phone, etc.)
• Child Care Resources
• 1^st United Services Credit Union 

*Eligibility is determined by Alameda County and offerings may vary by collective bargaining agreement.  This provides a brief summary of the benefits offered and can be subject to change.