Stanislaus County Sheriff’s Office – Modesto, CA

Forensic Computer Examiner

THE POSITION

To learn more about the Sheriff’s Department, click here. 

The Forensic Computer Examiner investigates and analyzes digital evidence by performing hardware, software and virtual analysis of digital evidence in the office and in the field on sensitive, complex, criminal and civil investigations for the Stanislaus County Sheriff’s Office.  This position processes and analyzes digital evidence including the disassembly of computer hardware; forensic imaging of digital media; examination of data related to criminal offenses; recovery of data from cellular telephones; and performs related duties as required.  The Forensic Computer Examiner will prepare comprehensive examination reports for the analysis of digital media and will testify in court as a forensic expert.  Incumbents in this classification must be able to work effectively in an environment in which they may encounter sensitive/confidential information and data that contains sexually explicit or disturbing content; including child pornography.  

Unless otherwise provided, this position is part of the Classified Service of the County and is assigned to the AFSCME bargaining unit for labor relations purposes.

Individuals who are in a full-time classification position are required to serve a twelve-month probationary period, which may be extended an additional six months, for a total of eighteen months. Incumbents may also be subject to overtime, standby, callback, weekend, holiday and shift assignments as identified in their MOU (Memorandum of Understanding).

The Job Task Analysis provides information detailing the physical and functional demands of the classification. For the complete job task analysis, visit the Risk Management website at http://www.stancounty.com/riskmgmt/ under “Disability Management”.Typical Tasks

• Investigate complex crimes involving digital media under the jurisdiction of Stanislaus County Sheriff’s Office;
• Incorporate computer forensic methods for searching seized computers in accordance with the rules of evidence and laws of search and seizure;
• Perform specialized investigative assignments in the collection, preservation, analysis of evidence and does other related work as required;
• Examine, disassemble, reassemble, evaluate, extract data, and interpret extracted data from computer hardware, smart phones, data storage devices, media storage devices, compact discs, digital video disc (DVDs) , floppy discs and detached or attached hard drives;
• Collect evidence, transfer data from evidentiary items to other forms of media for presentation in court and for long term storage as evidence;
• Prepare written reports on the analysis completed and verbally communicate significant findings to the assigned Sheriff’s Office personnel responsible for the specific investigation;
• Testify in State and Federal courts on evidence related issues as an expert witness;
• Foster professionalism, collegiality, teamwork and information sharing with fellow examiners;
• Facilitate and provide cross-training opportunities among staff;
• Communicate and work effectively with County and department staff, contract partners, State and Federal agencies, local, public and private agencies, and Command staff;
• Supervise staff, assign and review the work of others, complete evaluations, provide staff development and training;
• Complete and analyze data from various sources;
• Research and analysis of various issues;
• Perform special assignments as needed to achieve program objectives;
• Analyze and interpret State legislation as it applies to County programs;
• Maintain accurate records; and
• Maintain confidential information according to the legal standards and/or County regulations as required.

Minimum Qualifications (Skills, Ability, Knowledge, Education/Experience)

SKILLS/ABILITIES

• Communicate effectively both orally and in writing;
• Examine and analyze computer hardware, software and electronically stored data pertaining to law enforcement investigations;
• Collect, transport, process and secure evidentiary materials;
• Effectively prepare and present detailed reports of findings;
• Find and extract electronically stored information to be used as evidence;
• Work with various operating systems including but not limited to Windows, MacOS, Linux and Unix file systems;
• Work with different levels of Redundant Array of Independent Disks (RAID) 0,1,5,10, etc;
• Work across most hardware platforms including desktops, laptops, servers and enterprise-level storage devices;
• Manage several projects at once and maintain precise notes and required documentation;
• Establish and maintain effective working relationships;
• Maintain proficiency with industry standard tools and practices;
• Problem solve; and
• Respond to changing priorities.

KNOWLEDGE

• Principles and practices of digital media processing necessary to conduct computer forensic examinations;
• Forensic techniques and the most commonly used forensic toolsets, such as Encase, and FTK computer forensic suites;
• Windows, Macintosh, and Linux Operating Systems;
• Computer system hardware and software installation and troubleshooting;
• Rules of evidence and court room procedures;
• Operate various computer forensics software/equipment;
• The principles and practices of electronic data storage, data encryption and computer security systems;
• American Society of Crime Laboratory Director/Laboratory Accreditation Board standards applying to digital forensics; and
• The principles and practices of evidence collection, preservation and handling.

EDUCATION AND EXPERIENCE
We recognize your time is valuable, please only apply if you meet the following required qualifications.

PATTERN I

• Possession of a Bachelor’s Degree in computer science, information technology, or a closely related field from an accredited college or university (progressively responsible experience in related area may be substituted for the required education on a year for year basis); AND
• The equivalent of two (2) years of verifiable full time experience conducting forensic computer examinations or cellular phone data extractions for a public or private agency (progressively responsible experience in a related area may be substituted on a year-for-year basis). 

PATTERN II

• Four (4) years of verifiable full-time experience conducting forensic computer examination or cellular phone data extractions for a public or private agency (progressively responsible experience in a related area may be substituted on a year-for-year basis).

Proof of education is required for verification purposes at the time of application. Applicants who are unable to submit proof must call (209) 567-4412 to make other arrangements before 5 pm on the final filing date. Failure to submit proof or make other arrangements before the final filing deadline will result in disqualification.


LICENSE

• Applicants must possess and maintain a valid California Driver’s License and remain free from repeated preventable accidents; AND
• Must attain and maintain on-going Certified Forensic Computer Examiner (CFCE) certification within two years of appointment. 

DESIRABLE QUALIFICATIONS
In addition to the minimum qualifications, applicant screening will focus on the following desirable qualifications. Please list any of these qualifications you may have within the “Duties” section of the online application.

• Certified Computer Examiner (CCE) and EnCase Certified Examiner (EnCE) certifications; OR
• Master’s Degree in computer science, information technology or a closely related field from an accredited college or university.