Conducts investigations on computer-based crimes establishing documentary or physical evidence, such as digital media, mobile devices, vehicle infotainment systems and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.

• Adheres to legal policies and procedures related to handling digital media;
• Analyzes log files or other digital information to identify the perpetrators of network intrusions;
• Creates system images or captures network settings from information technology environments to preserve as evidence;
• Develops plans for investigating alleged computer crimes, violations, or suspicious activity;
• Develops policies or requirements for data collection, processing, or reporting;
• Duplicates digital evidence to use for data recovery and analysis procedures;
• Identifies or develops reverse-engineering tools to improve system capabilities or detect vulnerabilities;
• Maintains knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy;
• Performs file signature analysis to verify files on storage media or discover potential hidden files;
• Performs forensic investigations of operating or file systems;
• Preserves and maintains digital forensic evidence for analysis;
• Recovers deleted data or decrypt seized data;
• Writes and executes scripts to automate tasks, such as parsing large data files;
• Prepares written reports, affidavits and technical summaries, and provides deposition testimony for legal proceedings;
• Conducts analysis of digital evidence across a wide range of devices, including computers, cellphones, cell site data and external storage media;
• Writes technical summaries to report findings;
• Performs all other duties as assigned.