Digital Forensic Collection Specialist

The Digital Forensics Collection Specialist is a client-dedicated on-site role based in Seattle WA that supports a major technology clients Legal department and eDiscovery team in the forensic preservation imaging collection transfer and secure storage of electronically stored information (ESI) during the discovery process.

This role requires hands-on expertise in digital forensics hardware and software including physical imaging of Windows and macOS devices cloud-based data transfers mobile phones both Android and IOS and meticulous evidence tracking. The ideal candidate combines deep technical acumen with strong collaboration skills to interface with counsel global IT teams custodians and stakeholders at all levels.

• Perform on-site forensic imaging and collection of Windows devices using Logicube physical imaging hardware
• Perform on-site forensic imaging and collection of macOS devices using Digital Collector
• Perform on-site forensic imaging of both Android and IOS Devices with Cellebrite Inseytes
• Maintain strict chain of custody protocols for all physical and digital evidence
• Transfer collected forensic images and data sets to AWS S3 storage in accordance with security and compliance standards
• Track and manage all evidence and collection efforts using QuickBase ensuring accurate and timely record-keeping
• Coordinate with custodians and IT staff to schedule and facilitate device collections with minimal business disruption
• Facilitate remote collection of data from enterprise systems including Exchange servers file shares and cloud-based collaboration tools (M365 SharePoint Slack etc.)
• Verify data integrity through hash validation and quality-assurance checks post-collection
• Effectively communicate with case teams outside counsel and corporate stakeholders in support of discovery workflows
• Analyze and deploy best practices for the forensic handling preservation and analysis of electronic evidence

• Assist with developing revising and maintaining process documentation SOPs and forensic workflow playbooks
• Evaluate and recommend new forensic tools techniques and technologies to improve collection efficiency
• Support team members with training and education on forensic best practices tool usage and evidence handling procedures
• Collaborate cross-functionally with IT Security Legal Operations and outside vendors to support investigation and litigation needs
• Participate in lab equipment maintenance inventory management and forensic hardware lifecycle planning

• 3 years of hands-on experience with digital forensic imaging and evidence collection
• Demonstrated experience with Forensic collection software and hardware
• Thorough understanding of the EDRM lifecycle and electronic discovery workflows
• Experience with cloud storage platforms specifically AWS S3 for secure data transfer and storage
• Experience with evidence tracking and case management systems (QuickBase or similar)
• Familiarity with enterprise IT environments and various forms of ESI including email systems (M365 Exchange GSuite) file shares and collaboration platforms
• Knowledge of data privacy regulations and cross-border data transfer considerations
• Prior experience in a legal services eDiscovery or client-facing forensic support role preferred

Required Skills:

• Strong understanding of forensic imaging formats (E01 DD/Raw AFF) and hash-based integrity verification (MD5 SHA-1 SHA-256)
• Proficiency with write-blockers forensic duplicators and chain-of-custody protocols
• Ability to troubleshoot hardware and software issues during live collection scenarios
• Strong communication skills including the ability to convey complex technical concepts in simple clear terms to non-technical stakeholders
• Attention to detail and commitment to accuracy in evidence documentation and handling

Education:

• Bachelors degree or higher in digital Forensics Computer Science Information Security Computer Engineering or related technical discipline

And

• At least 1 of the following Preferred Certifications listed below

Or

• At least 3 of the following Preferred Certifications with only 1 Cellebrite certification counting towards that total and 2 additional years of experience

Preferred Certifications:

• ACE (AccessData Certified Examiner)
• CFCE (Certified Forensic Computer Examiner) - IACIS
• CCE (Certified Computer Examiner) - ISFCE
• GIAC Experienced Forensics Examiner (GX-FE)
• GIAC Advanced Smartphone Forensics Certification (GASF)
• GIAC iOS and macOS Examiner (GIME)
• Cellebrite Inseyets Certified Operator (CCO)
• Cellebrite Inseyets Certified Physical Analyst (CCPA)
• Cellebrite Advanced Smartphone Analysis for Inseyets (CASA)
• EnCE (EnCase Certified Examiner)
• Department of Justice Digital Forensics Examiner Program
• AX200 Axiom Examination
• AWS Certified Cloud Practitioner or Solutions Architect (a plus)

Skills & Certifications

Required Skills:

• Strong understanding of forensic imaging formats (E01 DD/Raw AFF) and hash-based integrity verification (MD5 SHA-1 SHA-256)
• Strong understanding of both Android and IOS file system structures
• Proficiency with write-blockers forensic duplicators and chain-of-custody protocols
• Ability to troubleshoot hardware and software issues during live collection scenarios
• Strong communication skills including the ability to convey complex technical concepts in simple clear terms to non-technical stakeholders
• Attention to detail and commitment to accuracy in evidence documentation and handling

Additional Preferred Skills:

• Python scripting for automation of forensic workflows and data processing
• Experience with Amazon Web Services (S3 IAM CLI)
• Familiarity with forensic suites such as EnCase FTK X-Ways or AXIOM
• Experience with BitLocker FileVault and encrypted media handling

Work Environment

• This is a full-time on-site position based in Seattle WA remote work is not available for this role
• Must be able to lift and transport forensic equipment (up to 50 lbs) and work in a corporate lab/office environment
• Occasional travel to other client offices in the region may be required for on-site collections
• May require flexible scheduling to accommodate urgent legal preservation requests

Excellence We strive to make every client our advocate

Passion We DO because we CARE

Collaboration We win together through teamwork and communication

Agility We flex adapt and embrace change

People We value respect and invest in our teammates

Vision We create clarity of purpose and a clear path forward

Consilio LLC is an EEO/Affirmative Action Employer and does not discriminate on the basis of race color religion sex sexual orientation gender identity national origin protected veteran status disability or any other legally protected status.

#LI-RF1

#LI-Hybrid