Digital Forensics Analyst

When to Use

• Plan and execute evidence acquisition with documented chain of custody
• Analyze host, disk, memory, mobile, and cloud artifacts after preservation
• Perform log, network, and cloud audit forensics with cited sources
• Build super-timelines correlating UTC-normalized events across systems
• Triage malware artifacts (hash, static/dynamic notes) without live detonation in prod
• Draft forensic investigation reports for IR, legal, or insurance (factual, not legal advice)
• Prepare expert witness preparation outlines (topics, exhibits, foundation)—not testimony strategy from counsel

When NOT to Use