Thomas Edward Morales

***** ********** ***.

Moreno Valley, Ca. 92557

626-***-**** - Cell

OBJECTIVE: To obtain a position fully utilizing my 13 years computer forensic skills to analyze, detect, report and testify.

EXPERIENCE

Forensic Computer Examiner

10/2010 – 05/2018 40 hrs./wk.

U.S. Department of Health and Human Services, Office of the Inspector General, Office of Investigations

600 City Parkway West, Ste. 500, Orange, Ca. 92868

Demonstrates the ability to lead and/or convey comprehensive knowledge of state-of-

the art practices of data automation to advise on alternative approaches in application

systems development and/or problem resolution required in the forensic analysis of

computer evidence collected during investigations.

Participates in seizure planning and offers technical input to investigators in

developing a step-by-step scenario to include roles and responsibilities. Assists in the

coordination of possible seizure dates and anticipates post-seizure forensic analysis

and associated tool requirements.

Configures hardware and forensic analysis tools to store and process recovered

computer files. Copies and recovers computer files from computer evidence.

Conducts forensic analysis of computer evidence and provides continuing technical

support, which involves hardware, forensic analysis tools and computer files.

Recommends file review and search procedures based on knowledge gained during

seizure and recovery. Supports case findings with documentation of procedures and results.

Serve as a member of an investigation team, which may include a lead investigator

and other agents, both inside and outside the agency. The team may participate in a

variety of settings, including investigative sites under subpoena or search warrant.

Supports the investigators by providing technical information in case proceedings,

which include meetings with OIG senior staff. The incumbent may be called upon to

discuss his/her analysis of computer evidence with other Federal, State and local

government officials involved in a specific case.

Prepare detailed technical reports, presents findings and recommendations for review

and examination by a wide range of OIG and other persons, both inside and outside

findings to OIG investigators and others involved in the investigative process.

Attends computer and investigative training classes to enhance and maintain skills to

effectively perform the technical and physical duties associated with investigations.

Provide technical information in case proceedings to include meetings with OIG

senior staff, Department of Justice Attorneys, and the U.S. Attorney. As required, may

appear as an expert witness before a Grand Jury or Federal Court. Will discuss

his/her analysis of computer evidence with other Federal, State and local government

officials involved in a specific case, as needed.

Computer Forensic Examiner

08/2008 – 10/2010 40 hrs./wk.

Orange County District Attorney's Office, 401 Civic Center Drive West, Santa Ana, Ca. 92701

• Use industry-accepted principles in retrieving, recovering and preserving digital evidence

Comprehensive knowledge of data automation practices as it applies to troubleshooting forensic analysis issues

• Collaborate with law enforcement officers to seize and image various digital devices and provides information about the devices to assist investigations

Participate in seizure planning by offering technical input regarding digital media

• Collect, examine and perform comprehensive technical analyses of computer-related evidence such as magnetic media storage devices (floppy disks, hard disks, magnetic tapes, optical disks, memory cards magnetic strip cards and the like)

• Use various forensic tools such as EnCase, FTK, and Cellebrite to search for information and evidence

Ability to analyze and resolve complex problems

• Search a wide range of digital devices, computers, servers, phones, etc.

• Extensive knowledge of common file utility and access control products

• Conduct database research on a variety of public information databases

• Review files and conduct investigation of a case

• Prepare clear and comprehensive reports of findings, through effective and strong communication skills

• Testify in court regarding the facts of the case

• Collaborate and train other forensic technicians in the lab

• Familiar with 9th Circuit CDT Filter Review process

Forensic Consultant

03/2007 – 08/2008 50 hrs./wk.

Guidance Software Inc., 215 N. Marengo Ave., Pasadena, Ca. 91101

• Perform installations and provide training for users of EnCase Enterprise software

• Perform installations and provide training for users of EnCase eDiscovery software

• Perform imaging and analysis, eDiscovery collections

• Assist in creating procedural manuals for Implementation Team

• Attend internal/external training classes as necessary

Senior Technical Services Specialist

11/2002 – 03/2007 40 hrs./wk.

Guidance Software Inc., 215 N. Marengo Ave., Pasadena, Ca. 91101

• Provide technical services to users of EnCase software

• Expertise in Forensic methodology

• Serve as Lead for CTD Beta Tester program

• Expertise in media acquisitions

• Strong troubleshooting skills

• Provide training to new and junior staff members

• Expertise with EnCase Forensic and Enterprise products

• Familiarity with eDiscovery, Information Assurance and AIRS products

• Experienced with Windows, Linux and some Unix

• Perform cyclical software regression testing for quality assurance purposes

• Research and document “bugs” and change requests based on feedback from users

• Attend training classes to further enhance my knowledge of the product

Education

High School: Don Bosco Technical Institute, 1151 S. San Gabriel Blvd., Rosemead, Ca. 91770

Diploma earned: 1976

College: Santa Monica College, 1900 Pico Blvd., Santa Monica, Ca. 90405

Completed 20 credit hours in the Basic Accounting program

Professional Certifications:

EnCase Certified Examiner Date: 01/2005 By: Guidance Software Inc.

Access Data Certified Examiner Date: 04/2010 By: Access Data Corp.

Microsoft Certified Professional Date: 11/1999 By: Microsoft Corp.

Comptia A+ Date: 09/2003 By: CompTIA

Comptia Network + Date: 03/2010 By: CompTIA

Blacklight Certified Examiner Date: 07/2015 By: Blackbag Technologies

Cellebrite Logical Operator Date: 07/2017 By: Cellebrite

Training:

EnCase Advanced Enterprise

EnCase Intermediate Analysis & Reporting

EnCase Advanced Computer Forensics

EnCase Network Intrusion

EnCase Incident Response Forensic Auditing and Discovery

EnCase Advanced Incident Response Forensic Auditing and Discovery

EnCase eDiscovery

Access Data FTK Boot Camp

Access Data FTK Internet Forensics

Access Data FTK Windows

FBI CART 101

FBI CAIR

Basic Homicide Investigation

FLETC MacIntosh Forensics Training Program MFTP-202

FLETC Computer Network Investigations Training Program CNITP-103

FLETC Mobile Device Investigations Program MDIP-102

FLETC Seized Computer Evidence Recovery Specialist SCERS-102

FLETC Internet Investigations Training Program IITP-101

SANS FOR518 MacIntosh Forensics

Blackbag Technologies Blacklight training

Memberships:

Southern California High Tech Crime Investigators Association

High Tech Crime Consortium

Contact this candidate