The work involves responsibility for highly specialized forensic testing that involves the forensic examination of computers and computer media for the presence of evidence relating to criminal activity. The Specialist III is the highest level in the Computer Evidence Specialist series and is distinguished from the Specialist II by the responsibility of providing the technical work direction and training of the Specialists I and II. This position oversees/provides guidance, training and technical assistance to all less experienced personnel. An employee in this class may assist the Senior Forensic Chemist or the Director of Laboratories in developing operating procedures, training programs for staff and user agency personnel, casework management, personnel performance evaluations and budget preparation.

The Computer Evidence Specialist III conducts the most difficult and complex examinations of computers, and media generated by computers to develop evidence in the specialty area of forensic computer science. The Computer Evidence Specialist III receives and maintains the integrity of evidence; uses knowledge of computer technologies and theories to conduct analysis of submitted evidence; evaluates scientific results to determine their validity and to determine whether the information has forensic significance; prepares formal written reports suitable for legal presentations that state results; is directly responsible for the accuracy and adequacy of the forensic examinations performed. An employee in this class may travel regionally to provide on-site expert forensic computer support at crime scenes and other areas required and testifies in court as a fact-witness presenting forensic testimony in layman’s terms. Work is performed under the general supervision of the Senior Forensic Chemist (Criminalistics). Supervision is exercised over a small number of Computer Evidence Specialists I and II. Does related work as required.




Prepare duplicate image backup copies of computer media.

Recover deleted computer files, password protected/encrypted files and hidden information.

Conduct comprehensive searches of computer media for text, data and images.

Prepare and/or convert recovered files and information into format compatible with needs.

Participate in crime scene response.

Perform quality assurance.

Prepare reports of findings.

Testify in court as an expert witness.

Review work of peers for technical accuracy.

Assists in the training of Computer Evidence Specialists I in technical procedures, handling of evidence and preparation of material for court testimony.

Trains Law Enforcement personnel and others responsible for gathering evidence.

Determines methods of analysis to be applied by Computer Evidence Specialist I and supervises the work through review of findings and standards of investigation.

Attends training classes/seminars/conferences.

Participates in public health preparedness activities as trained and assigned.




Thorough knowledge of PC hardware.

Thorough knowledge of the internal functioning of, as well as how to operate, various operating systems (MS-DOS, Windows 95/98, Windows NT/2000, Windows XP, Unix/Linux, or other).

Thorough knowledge of computer hardware to the component level.

Thorough knowledge of computer science and computer evidence recovery.

Good knowledge of the laws related to computer evidence recovery.

Good knowledge of the methodology applied in analysis of digital evidence for use in crime detection.

Good knowledge of networking and internet application software.

Ability to supervise the work of others in a manner conducive to full performance and high morale.

Ability to plan and carry out assigned projects to completion.

Ability to communicate both orally and in writing.

Ability to train lesser experienced co-workers and clients.

Physical condition commensurate with the demands of the position.





Graduation from a regionally accredited college or university or one accredited by the New York State Board of Regents to grant degrees with a Baccalaureate Degree or higher and five (5) years of paid work experience performing the duties similar to a Computer Evidence Specialist.


Note: Possession of a Master’s degree will be allowed to substitute for one year of the required experience.



Applicants will be required to undergo a State and national criminal history background investigation which will include a fingerprint check to determine suitability for appointment. Failure to meet the standards for the background investigation may result in disqualification.




01/2014 Date Revised