Forensic Scientist II – Digital Evidence
Description of Work
Salary determination is based upon the candidate’s education and experience related to the position, as well as departmental budget and equity considerations.
The North Carolina Department of Justice, led by the Attorney General of North Carolina, represents the State of North Carolina in court and provides legal advice and representation to most state government departments, agencies, officers, and commissions. The Department also represents the State in criminal appeals from state trial courts, and brings legal actions on behalf of the state and its citizens when the public interest is at stake.
The primary purpose of the Digital Evidence Unit is to accept, find, preserve and provide scientific forensic analysis of evidence for the criminal justice community. The forensic services provided include in-lab analyses, technical field assistance, and expert witness testimony in the following areas: Distribution of child pornography, recovery of evidence of the sexual exploitation of children on computers, search of computers for evidence such as e-mails or chats in crimes of violence or threats of violence, forensic analysis of security video recovered from a crime scene or surveillance video recorded by law enforcement personnel, forensic analysis of audio evidence in order to clarify audio which may be recovered at crime scenes or recorded in covert investigations by law enforcement personnel.
The unit also provides photographic services including crime scene photography, portrait photography, and graphic arts services including but not limited to crime scene sketches, court exhibits, investigative aids, lineups, timelines, reward posters, pamphlets, and brochures.
• Under general supervision, processes, examines and analyzes computer hardware, software, electronically stored data and other computer-related evidentiary materials
• Prepares and presents reports of findings, provides expert testimony, and performs a variety of crime laboratory duties.• Conducts thorough examinations of electronic data storage media.
• Preserves and copies the original media.
• Prevents the transference of viruses, destructive programs, and inadvertent writes to and from the original media.
• Recovers deleted data.
• Accesses password-protected and secured files.
• Uses forensic hardware and software applications to analyze electronic media.
• Examines the contents of a computer’s firmware.
• Examines boot record data, system configuration, and operation command files.
• Verifies the correctness of the computer’s internal clock.
• Physically disassembles and examines electronic devices and related hardware components.
• Identifies evidence of computer-based crimes such as the theft and sabotage of data; fraudulent use of bank, credit, and telecommunications accounts; and the trafficking of pornography.
• Examines and analyzes text, graphics, multimedia, and digital images.
• Labels evidence.
• Prepares and presents reports of examinations and findings.
• Works with court officers to prepare cases for trial.
• Provides expert opinion testimony in courts.
• Trains and instructs other employees.
• Provides advice and guidance regarding the seizure and handling of digital evidence.
• Examines and analyzes digital and analog video recording and storage devices and media
• Examines and analyzes digital and analog audio recording and storage devices and media
• Analyzes digital and analog video Analyzes digital and analog audio
• Gives presentations to community groups.
This position is subject to mandatory overtime and serving in an on-call capacity. Position is subject to the Fair Labor Standards Act. Position is non-sworn.
The Forensic Scientist shall be required to obtain individual certification consistent with the international and ISO standards within 18 months of the date the analyst becomes eligible to seek certification according to the standards of the certifying entity.
- Selected candidate will undergo and must successfully complete a comprehensive background investigation which may take several months to complete. The background investigation includes: credit and arrest checks; interviews with associates, personal and business references, past employers and neighbors; verification of education achievement, and urinalysis drug screening and polygraph, and psychological screening.
- Out of state applicants: This may require the applicant to return to the State of North Carolina multiple times at his or her own expense after the initial interview, in order to undergo the background investigation process.
- In accordance with N.C. Gen. Stat. Sec. 126-1.1( c), effective July 11, 2016, employees who are hired by a State agency, department or university in a sworn law enforcement position or forensic scientist position and who are required to complete a formal training program prior to assuming law enforcement or forensic scientist duties with the hiring agency, department or university shall become career State employees only after being employed by the agency, department or university for 24 continuous months .
- Employees who transfer into forensic scientist positions from other positions within N.C. State government and are currently Career State employees will be required to complete a probationary period of 24 additional months.
- In accordance with Section 17.5 of Senate Bill 402, The Department of Justice shall not hire sworn personnel to fill vacant positions in the North Carolina State Crime Laboratory. Nothing in this section shall be construed to require the termination of sworn personnel, but as vacant positions in the State Laboratory are filled, they shall be filled only with non sworn personnel. Nothing in this section shall be construed to affect North Carolina State Crime Laboratory personnel who are sworn and employed by the Laboratory as of the effective date of this section and who continue to meet the sworn status retention standards mandated by the NC Criminal Justice Education and Standards Commission.
- ** Transcripts are required at the time of application. Unofficial transcripts will be accepted. Credit for foreign degrees will only be given if verification of degree certification is attached. Transcripts for foreign degrees have to be evaluated by an organization like World Education Services to determine US equivalency.
Knowledge, Skills and Abilities / Competencies
1. Employees must have a working knowledge of the principles, concepts, theories, reference sources, and laboratory practices involved with the forensic examination of evidence.
2. Employees must have a working knowledge of criminal law and of the rules and regulations regarding evidence gathering.
3. Employees must have a working knowledge of scientific methodology and of laboratory safety practices.
4. Ability to perform and record complex standardized and non-standardized laboratory tests and procedures.
5. Ability to analyze results, interpret methodology, and to understand and solve theoretical problems.
6. Ability to express technical information clearly both orally and in writing when reporting results, testifying, or explaining procedures to others.
7. Ability to understand and follow complex oral and written instructions.
8. Ability to perceive colors normally and make olfactory distinctions.
9. Ability to establish and maintain effective working relationships.Minimum Education and Experience Requirements
Digital Evidence Bachelor’s degree with a major in computer science, digital forensics, networking, information technology, cyber technology, criminal justice; or forensic science or multi-media studies with coursework in computer science or information technology; or biology, chemistry, physics, biochemistry and other science degrees (if degree includes significant coursework in computer science or information technology); or closely related curriculum from an appropriately accredited institution including coursework in science; and two years of experience performing bench level analysis in digital evidence; or an equivalent combination of education and experience.
Necessary Special Requirement (Digital): Must obtain individual certification consistent with international and ISO standards within eighteen months of the date the analyst becomes eligible to seek certification according to the standards of the certifying entity.
Such vendor-neutral certifications may include: Certified Computer Forensic Examiner (CFCE) International Association of Computer Investigative Specialists, Certified Computer Examiner (CCE) International Society of Forensic Computer Examiners Digital Forensics Certified Practitioner (DFCP) Digital Forensics Certification Board (requires a minimum 5 years of verified experience prior to sitting for the exam), Global Information Assurance Certification Forensic Examiner (GCFE) SANS Institute, Certified Video Technician (CFVT) Law Enforcement & Emergency Service Video Association (requires a minimum of 3 years of verified experience prior to sitting for the exam), Certified Forensic Video Examiner (CFVE) International Association for Identification (requires a minimum of 3-5 years of verified experience depending on applicant s education level).
Management preference: 4 years of related experience