Digital Forensic Collection Specialist

Consilio LLC • ,

2d • Onsite

About The Position

The Digital Forensics Collection Specialist is a client-dedicated, on-site role based in Seattle, WA that supports a major technology client's Legal department and eDiscovery team in the forensic preservation, imaging, collection, transfer, and secure storage of electronically stored information (ESI) during the discovery process. This role requires hands-on expertise in digital forensics hardware and software, including physical imaging of Windows and macOS devices, cloud-based data transfers, and meticulous evidence tracking. The ideal candidate combines deep technical acumen with strong collaboration skills to interface with counsel, global IT teams, custodians, and stakeholders at all levels.

Requirements

• Bachelor's degree in Digital Forensics, Computer Science, Information Security, Computer Engineering, or related technical discipline
• 3+ years of hands-on experience with digital forensic imaging and evidence collection
• Demonstrated experience with physical imaging hardware (Logicube Falcon, Falcon NEO, or similar forensic duplicators)
• Experience performing forensic collections on macOS using tools such as Digital Collector, MacQuisition, or similar
• Thorough understanding of the EDRM lifecycle and electronic discovery workflows
• Experience with cloud storage platforms, specifically AWS S3, for secure data transfer and storage
• Experience with evidence tracking and case management systems (QuickBase or similar)
• Familiarity with enterprise IT environments and various forms of ESI, including email systems (M365, Exchange, GSuite), file shares, and collaboration platforms
• Knowledge of data privacy regulations and cross-border data transfer considerations
• Strong understanding of forensic imaging formats (E01, DD/Raw, AFF) and hash-based integrity verification (MD5, SHA-1, SHA-256)
• Proficiency with write-blockers, forensic duplicators, and chain-of-custody protocols
• Ability to troubleshoot hardware and software issues during live collection scenarios
• Strong communication skills, including the ability to convey complex technical concepts in simple, clear terms to non-technical stakeholders
• Attention to detail and commitment to accuracy in evidence documentation and handling

Nice To Haves

• Advanced degree or specialized forensic coursework preferred
• Prior experience in a legal services, eDiscovery, or client-facing forensic support role preferred
• Python scripting for automation of forensic workflows and data processing
• Experience with Amazon Web Services (S3, IAM, CLI)
• Familiarity with forensic suites such as EnCase, FTK, X-Ways, or AXIOM
• Experience with BitLocker, FileVault, and encrypted media handling

Responsibilities

• Perform on-site forensic imaging and collection of Windows devices using Logicube physical imaging hardware
• Perform on-site forensic collection of macOS devices using Digital Collector
• Maintain strict chain of custody protocols for all physical and digital evidence
• Transfer collected forensic images and data sets to AWS S3 storage in accordance with security and compliance standards
• Track and manage all evidence and collection efforts using QuickBase, ensuring accurate and timely record-keeping
• Coordinate with custodians and IT staff to schedule and facilitate device collections with minimal business disruption
• Facilitate remote collection of data from enterprise systems, including Exchange servers, file shares, and cloud-based collaboration tools (M365, SharePoint, Slack, etc.)
• Verify data integrity through hash validation and quality-assurance checks post-collection
• Effectively communicate with case teams, outside counsel, and corporate stakeholders in support of discovery workflows
• Analyze and deploy best practices for the forensic handling, preservation, and analysis of electronic evidence
• Assist with developing, revising, and maintaining process documentation, SOPs, and forensic workflow playbooks
• Evaluate and recommend new forensic tools, techniques, and technologies to improve collection efficiency
• Support team members with training and education on forensic best practices, tool usage, and evidence handling procedures
• Collaborate cross-functionally with IT Security, Legal Operations, and outside vendors to support investigation and litigation needs
• Participate in lab equipment maintenance, inventory management, and forensic hardware lifecycle planning

Benefits

• Consilio's True North Values: Excellence, Passion, Collaboration, Agility, People, Vision

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level