eDiscovery Forensic Analyst

Wits Solutions Inc. (WITS) is a SBA certified 8(a) company with headquarters in the metropolitan Washington D.C. area. WITS has been providing best-in-class solutions in professional IT and administrative consulting to various Federal State Local and commercial customers. At WITS we believe in working not for our clients but with them. This is why right from the beginning; our analysts and solution-builders work closely with our clients to ensure that the project outcomes continue to deliver value long into the future.

SECURITY CLEARANCE

NACI Clearance

EDUCATION/CERTIFICATIONS MANDATORY

Bachelors degree

WORK EXPERIENCE MANDATORY

• Minimum 2 years of experience in an eDiscovery role which encompasses each of the following tasks:
• Using mobile forensic tools (i.e. Cellebrite UFED/PA GrayKey Oxygen Forensics Magnet AXIOM etc.) to perform forensic imaging and analysis from mobile devices.
• Experience with hard drive imaging and targeted data extraction using such tools as Encase FTK Imager etc. using proper acquisition protocols including use of write blockers and chain-of-custody procedures.
• Experience with collaboration and messaging platform data such as Microsoft Teams Skype and Slack. Experience reviewing normalizing and converting exported data files (CSV JSON or HTML) for ingestion of such formats into eDiscovery and review platforms using tools such as Message Crawler.
• Experience with preparing detailed technical reports for use in investigations administrative proceedings and court.

WORK EXPERIENCE NICE TO HAVE

• An active Computer Forensics Examiner certification (such as Cellebrite CCO/CCPA EnCEGCFE CCE or CFCE.).
• Experience with handling case management tasks including oversight of case data and ESI preservation.
• Experience with using Litigation Holds software.
• Experience with using preservation tools such as Microsoft Purview.
• Experience with collecting and preserving data from network file shares using industry standard tools and techniques.
• Experience with cloud data acquisitions from services such as Microsoft 365.

ROLES AND RESPONSIBILITIES

• Review the current ESI Data Map which identifies each ESI IT system the purpose of the system system owner status (active or legacy) relevant location (network system directory) and data and metadata types (documents images video).
• The ESI data map will be the first step in OCC identification efforts and allows OCC staff or contractor staff to answer discovery questions about IT systems.
• Assist with disseminating ESI preservation requests using clear instructions and procedures if necessary.
• Assist CCISG with adhering to preservation instructions for OCC technology including MS SharePoint custodian hard drives departed custodian hard drives external medianetwork drives MS Outlook OCC computers backup tapes cellular/smart phones cloud storage or other sources of ESI when necessary.
• Collect-to-preserve highly relevant ESI or technically precarious data such as from mobile devices hard drives network shares or websites.
• Assist in the scoping of collection efforts tracking the progress of a collection and assigning the appropriate resources to a collection effort.
• Work with legal staff and ITS Resources to suggest collection search criteria filters and tags.
• Ensure that all ESI collected is logged and tracked addition any audit records associated with the collection are to be maintained for the full records retention period associated with the matter.
• Work with technical resources to resolve issues/questions during collection and to ensure that the appropriate ESI collection processes are being followed.
• Manage storage by creating documenting and cataloging network file shares to support automated and manual collection efforts.
• Coordinate with the OCC eDiscovery COR and ITS resources to identify data that the agency is not required to maintain for records or other purposes.