Forensic Scientist I, Digital Evidence
Description of Work
Salary offers are based upon the candidate’s education and experience related to the position, as well as departmental budget and equity considerations.
For current State employees, please note that as of June 1, 2018, promotional priority and salary administration will be made based on the new Statewide NC Classification System.
The North Carolina Department of Justice, led by the Attorney General of North Carolina, represents the State of North Carolina in court and provides legal advice and representation to most state government departments, agencies, officers, and commissions. The Department also represents the State in criminal appeals from state trial courts, and brings legal actions on behalf of the state and its citizens when the public interest is at stake.
The primary purpose of the Digital Evidence Unit is to accept, find, preserve and provide scientific forensic analysis of evidence for the criminal justice community. The forensic services provided include in-lab analyses, technical field assistance, and expert witness testimony in the following areas: Distribution of child pornography, recovery of evidence of the sexual exploitation of children on computers, search of computers for evidence such as e-mails or chats in crimes of violence or threats of violence, forensic analysis of security video recovered from a crime scene or surveillance video recorded by law enforcement personnel, forensic analysis of audio evidence in order to clarify audio which may be recovered at crime scenes or recorded in covert investigations by law enforcement personnel. The unit also provides photographic services including crime scene photography, portrait photography, and graphic arts services including but not limited to crime scene sketches, court exhibits, investigative aids, lineups, timelines, reward posters, pamphlets, and brochures.
The Forensic Scientist I will perform casework with a limited degree of technical independence in one of the two disciplines in the Section: computer forensics or audio/visual. A determination will be made at the time of on-boarding as to which discipline the Forensic Scientist I will initially be assigned to conduct examinations.
Processes, examines and analyzes computer hardware, software, electronically stored data and other computer-related evidentiary materials.
• Prepares and presents reports of findings, provides expert testimony, and performs a variety of crime laboratory duties.
• Conducts thorough examinations of electronic devices and data storage media.
• Preserves and copies original media without introducing destructive elements (e.g., viruses, inadvertent writes, environmental factors)
• Recovers deleted data.
• Accesses password-protected and secured files.
• Uses forensic hardware and software applications to analyze electronic media.
• Examines the contents of a computer’s firmware.
• Examines boot record data, system configuration, and operation command files.
• Physically disassembles and examines electronic devices and related hardware components.
• Identifies evidence of computer-based crimes such as the theft and sabotage of data; fraud-based crimes; child pornography; and violent crimes.
• Examines and analyzes text, graphics, multimedia, digital images, and configuration/system file.
• Labels evidence.
• Prepares and presents reports of examinations and findings.
• Works with court officers to prepare cases for trial.
• Provides expert opinion testimony in courts.
• Provides advice and guidance regarding the seizure and handling of digital evidence.
• Examines and analyzes digital and analog video recording and storage devices and media
• Examines and analyzes digital and analog audio recording and storage devices and media
This position is subject to mandatory overtime and serving in an on-call capacity.
The Forensic Scientist shall be required to obtain individual certification consistent with international and ISO standards within 18 months of the date the analyst becomes eligible to seek certification according to the standards of the certifying entities.
- Selected candidate will undergo and must successfully complete a comprehensive background investigation which may take several months to complete. The background investigation includes: credit and arrest checks; interviews with associates, personal and business references, past employers and neighbors; verification of education achievement, urinalysis drug screening and polygraph.
- Out of state applicants: This may require the applicant to return to the State of North Carolina multiple times at his or her own expense after the initial interview, in order to undergo the background investigation process.
- In accordance with N.C. Gen. Stat. Sec. 126-1.1( c), effective July 11, 2016, employees who are hired by a State agency, department or university in a sworn law enforcement position or forensic scientist position and who are required to complete a formal training program prior to assuming law enforcement or forensic scientist duties with the hiring agency, department or university shall become career State employees only after being employed by the agency, department or university for 24 continuous months .
- Employees who transfer into forensic scientist positions from other positions within N.C. State government and are currently Career State employees will be required to complete a probationary period of 24 additional months.
- In accordance with Section 17.5 of Senate Bill 402, The Department of Justice shall not hire sworn personnel to fill vacant positions in the North Carolina State Crime Laboratory. Nothing in this section shall be construed to require the termination of sworn personnel, but as vacant positions in the State Laboratory are filled, they shall be filled only with non-sworn personnel. Nothing in this section shall be construed to affect North Carolina State Crime Laboratory personnel who are sworn and employed by the Laboratory as of the effective date of this section and who continue to meet the sworn status retention standards mandated by the NC Criminal Justice Education and Standards Commission.
- ** Transcripts are required at the time of application. Unofficial transcripts will be accepted.**
Knowledge, Skills and Abilities / Competencies
1. Employees must have knowledge of the principles, concepts, theories, reference sources and laboratory practices involved with the forensic examination of evidence.
2. Employees must have knowledge of criminal law and of the rules and regulations regarding evidence gathering and handling.
3. Employees must have knowledge of scientific methodology and of laboratory safety practices.
4. Ability to perform and record complex standardized and non-standardized laboratory tests and procedures.
5. Ability to analyze results, interpret methodology and to understand and solve theoretical problems.
6. Ability to express technical information clearly both orally and in writing when reporting results, testifying or explaining procedures to others.
7. Ability to understand and follow complex oral and written instructions.
8. Ability to perceive colors normally and make olfactory distinctions.
9. Ability to establish and maintain effective working relationships.
Minimum Education and Experience Requirements
Digital Evidence – Bachelor’s degree with a major in computer science, digital forensics, networking, information technology, cyber technology, criminal justice; or forensic science or multi-media studies with coursework in computer science or information technology; or biology, chemistry, physics, biochemistry and other science degrees (if degree includes significant coursework in computer science or information technology); or closely related curriculum from an appropriately accredited institution including coursework in science; or an equivalent combination of education and experience.
Necessary Special Requirement (Digital):
Must obtain individual certification consistent with international and ISO standards within eighteen months of the date the analyst becomes eligible to seek certification according to the standards of the certifying entity. Such vendor-neutral certifications may include:
Certified Computer Forensic Examiner (CFCE) – International Association of Computer Investigative Specialists, Certified Computer Examiner (CCE) – International Society of Forensic Computer Examiners Digital Forensics Certified Practitioner (DFCP) – Digital Forensics Certification Board (requires a minimum 5 years of verified experience prior to sitting for the exam), Global Information Assurance Certification Forensic Examiner (GCFE) – SANS Institute, Certified Video Technician (CFVT) – Law Enforcement & Emergency Service Video Association (requires a minimum of 3 years of verified experience prior to sitting for the exam), Certified Forensic Video Examiner (CFVE) – International Association for Identification (requires a minimum of 3-5 years of verified experience depending on applicant’s education level)
Management preference: 2 years of related experience.