Exhibit A
POLICE DIGITAL FORENSIC ANALYST
DEFINITION
Under general direction, to perform forensic examination and analysis of digital devices for police investigations; to assist in standard evidence collection practice; to ensure effective storage, maintenance, control of evidence and related computer forensic equipment and supplies; to maintain necessary data and statistics; and perform related duties as required.
DISTINGUISHING CHARACTERISTICS
This classification is responsible for performing a variety of non-sworn, advanced and highly specialized tasks related to examination of and collection of digital forensic evidence. It is distinguished from other civilian police classifications by its primary responsibility for evaluating and analyzing digital forensic evidence.
SUPERVISION RECEIVED AND EXERCISED
Receives supervision from the Investigations Sergeant.
May provide lead direction to interns or other staff as necessary.
EXAMPLES OF DUTIES - Depending upon assignment, duties may include, but are not limited to, the following:
Conduct forensic analysis, comparison and examination of evidence from mobile devices, computers and other digital devices for the purpose of police investigations.
Examine, disassemble, reassemble, evaluate, extract and interpret data from cell phones, smart phones, mobile devices, tablets, desktop and laptop computers, personal computers, servers, closed-circuit television (CCTV) systems, security equipment, vehicles, compact discs, digital video discs, DVR’s, gaming consoles, portable hard drives and related devices.
Transfer data and evidence from evidentiary items to other forms of media for presentation to sworn personnel, court, and for long term storage as evidence, ensuring proper evidentiary protocols are followed.
Prepare and maintain statistical and operational logs, records, databases, and other files according to department policies; prepare written reports on analysis completed and communicate findings.
Collect, preserve, label, catalog, and store evidentiary items for presentation in criminal proceedings in accordance with legal standards.
City of San Mateo
Police Digital Forensic Analyst
1 1
1 8
9 Track all evidentiary devices and performs audits of property and evidence.
Prepare digital evidence for owner release or disposal.
Assist by providing on-scene forensic examination of evidence from mobile devices, computers and other digital devices when search warrants are being served.
Maintain records and prepare reports detailing findings and investigative methods for digital forensic examinations.
Research and evaluate new technical developments in digital forensic examination and analysis of digital evidence.
Maintain a consistent and current understanding of laws and technology in the areas of digital forensics and other areas of responsibility and recommend changed in policies and procedures consistent with laws.
Perform crypto-currency tracking.
Serve as primary point of contact between the Police Department and US Secret Service Electronic Crimes Task Force.
Maintain and ensure operability of computer forensic equipment.
Represent the Department at community meetings and with other agencies on issues relating cybercrime and computer and network safety.
Prepare evidence displays and testify in court as an expert witness in computer/digital forensics.
Provide file information to authorized personnel.
Train new employees in legal requirements, department policies and procedures as they relate to digital forensic evidence collection.
Perform administrative and law enforcement support activities as designated.
Assume responsibility for ensuring the duties of the position are performed in a safe, efficient manner.
Perform related duties as assigned.
City of San Mateo
Police Digital Forensic Analyst
1 1
1 8
9 QUALIFICATIONS
Knowledge of:
Crime scene forensic investigation procedures.
Operating systems, intrusion, and computer forensic tools.
Forensic science as it applies to the collection and preservation and handling of evidence.
Methods and techniques used in the identification, collection and preservation of digital forensic evidence.
Photographic techniques, equipment, and documentation used in crime scene photography.
Rules and procedures of providing testimony in court.
Programs used in the digital examination of evidence such as Cellebrite, and other computer applications related to the work, including word processing and commonly used law enforcement databases.
California Electronic Communications Privacy Act, and other Codes, regulations, policies and procedures related to the tasks to which assigned.
Advanced mobile device recovery techniques such as JTAG and Chip-off is highly desirable.
Applicable Federal, State, and local criminal and civil laws, codes, and regulations.
Principles and practices of electronic data storage, data encryption, and computer security systems.
Ability to:
Use current methods and techniques of digital evidence collection, recognition, identification, comparison and verification.
Effectively examine and analyze computer hardware, software, and electronically stored data pertaining to law enforcement.
Safely collect, handle, transport, process, secure, and store digital evidence.
Find and extract electronically stored information to be used as evidence.
City of San Mateo
Police Digital Forensic Analyst
1 1
1 8
9 Perform complex digital evidence recovery and analysis work.
Operate office equipment including computer information systems to include digital processing, database inquiry and word processing.
Effectively testify as an expert witness in court.
Work cooperatively with other law enforcement organizations and federal agencies.
Maintain confidentiality with classified and sensitive information.
Review and process evidence which may be disturbing in nature.
Maintain the integrity of evidence and chain of custody in accordance with established guidelines.
Prepare accurate written reports; maintain accurate and legible logs and records.
Communicate clearly and concisely, both orally and in writing.
Work in a safe manner, following safety practices and procedures, model, and coach others in correct procedures.
Maintain confidentiality.
Experience and Training Guidelines
Any combination of experience and training that would likely provide the required knowledge and abilities is qualifying. A typical way to obtain the knowledge and abilities would be:
Experience:
Two years of experience performing police-related duties specifically related to digital evidence technology related to computer forensics including some experience with handling of evidence, evidence collection and processing.
Training:
A Bachelor’s of Arts or Science degree from an accredited college in administration of justice, evidence technology, computer science or related field.
Licenses and Certificates:
City of San Mateo
Police Digital Forensic Analyst
1 1
1 8
9 Possession of, or ability to obtain, a valid California Driver’s License and a satisfactory driving record.
Possession of or ability to obtain ENCE certification from ENCASE, and certification to use Cellebrite highly desirable
ADA Special Requirement:
Essential duties require the following physical abilities and work environment:
Must be able to work a flexible schedule including emergency call-in, overtime with extended hours, call-back, shift-work, nights, holidays, and weekends to accommodate investigatory needs.
Must be able to perform work in a variety of locations to include on-site work at crime scenes, and in the Police Department. Work is performed in indoor and outdoor environments. When work is performed outdoors, there is full exposure to the elements. The incumbent may be exposed to related health hazards to include blood and other bodily fluids/products, infectious diseases, human borne parasites, air, water, and blood borne pathogens, and may have contact with complete and/or partial human corpses in various stages of decomposition. Other health hazards may include odors, toxic chemicals, and hazardous substances. Occasionally, work is performed within confined areas or at high altitudes, including photography from helicopters. Physical demands include some ability to stand, walk, bend, lift, and reach. May be required to independently work crime scene investigations either without supervision or without sworn police presence. Incumbents must be able to meet the physical requirements of the class and have mobility, vision, hearing and dexterity levels appropriate to the duties to be performed.
ADOPTED CC: 11-8-17
REVISED CC:
FORMER TITLES:
BARGAINING UNIT: GENERAL UNIT
FLSA: NON-EXEMPT
PERFORMANCE APPRAISAL: WHITE COLLAR LEADS / PROGRAMS
DOT: NO
PRE APPT-MEDICAL: YES
SAFETY SENSITIVE: YES
REQUIRED HARASSMENT PREVENTION TRAINING: SUPERVISORY
FORM 700: NO
JOB CODES: 5286
ABOLISHED: