Thomas Edward Morales
Moreno Valley, Ca. 92557
626-***-**** - Cell
OBJECTIVE: To obtain a position fully utilizing my 13 years computer forensic skills to analyze, detect, report and testify.
Forensic Computer Examiner
10/2010 – 05/2018 40 hrs./wk.
U.S. Department of Health and Human Services, Office of the Inspector General, Office of Investigations
600 City Parkway West, Ste. 500, Orange, Ca. 92868
Demonstrates the ability to lead and/or convey comprehensive knowledge of state-of-
the art practices of data automation to advise on alternative approaches in application
systems development and/or problem resolution required in the forensic analysis of
computer evidence collected during investigations.
Participates in seizure planning and offers technical input to investigators in
developing a step-by-step scenario to include roles and responsibilities. Assists in the
coordination of possible seizure dates and anticipates post-seizure forensic analysis
and associated tool requirements.
Configures hardware and forensic analysis tools to store and process recovered
computer files. Copies and recovers computer files from computer evidence.
Conducts forensic analysis of computer evidence and provides continuing technical
support, which involves hardware, forensic analysis tools and computer files.
Recommends file review and search procedures based on knowledge gained during
seizure and recovery. Supports case findings with documentation of procedures and results.
Serve as a member of an investigation team, which may include a lead investigator
and other agents, both inside and outside the agency. The team may participate in a
variety of settings, including investigative sites under subpoena or search warrant.
Supports the investigators by providing technical information in case proceedings,
which include meetings with OIG senior staff. The incumbent may be called upon to
discuss his/her analysis of computer evidence with other Federal, State and local
government officials involved in a specific case.
Prepare detailed technical reports, presents findings and recommendations for review
and examination by a wide range of OIG and other persons, both inside and outside
findings to OIG investigators and others involved in the investigative process.
Attends computer and investigative training classes to enhance and maintain skills to
effectively perform the technical and physical duties associated with investigations.
Provide technical information in case proceedings to include meetings with OIG
senior staff, Department of Justice Attorneys, and the U.S. Attorney. As required, may
appear as an expert witness before a Grand Jury or Federal Court. Will discuss
his/her analysis of computer evidence with other Federal, State and local government
officials involved in a specific case, as needed.
Computer Forensic Examiner
08/2008 – 10/2010 40 hrs./wk.
Orange County District Attorney's Office, 401 Civic Center Drive West, Santa Ana, Ca. 92701
• Use industry-accepted principles in retrieving, recovering and preserving digital evidence
Comprehensive knowledge of data automation practices as it applies to troubleshooting forensic analysis issues
• Collaborate with law enforcement officers to seize and image various digital devices and provides information about the devices to assist investigations
Participate in seizure planning by offering technical input regarding digital media
• Collect, examine and perform comprehensive technical analyses of computer-related evidence such as magnetic media storage devices (floppy disks, hard disks, magnetic tapes, optical disks, memory cards magnetic strip cards and the like)
• Use various forensic tools such as EnCase, FTK, and Cellebrite to search for information and evidence
Ability to analyze and resolve complex problems
• Search a wide range of digital devices, computers, servers, phones, etc.
• Extensive knowledge of common file utility and access control products
• Conduct database research on a variety of public information databases
• Review files and conduct investigation of a case
• Prepare clear and comprehensive reports of findings, through effective and strong communication skills
• Testify in court regarding the facts of the case
• Collaborate and train other forensic technicians in the lab
• Familiar with 9th Circuit CDT Filter Review process
03/2007 – 08/2008 50 hrs./wk.
Guidance Software Inc., 215 N. Marengo Ave., Pasadena, Ca. 91101
• Perform installations and provide training for users of EnCase Enterprise software
• Perform installations and provide training for users of EnCase eDiscovery software
• Perform imaging and analysis, eDiscovery collections
• Assist in creating procedural manuals for Implementation Team
• Attend internal/external training classes as necessary
Senior Technical Services Specialist
11/2002 – 03/2007 40 hrs./wk.
Guidance Software Inc., 215 N. Marengo Ave., Pasadena, Ca. 91101
• Provide technical services to users of EnCase software
• Expertise in Forensic methodology
• Serve as Lead for CTD Beta Tester program
• Expertise in media acquisitions
• Strong troubleshooting skills
• Provide training to new and junior staff members
• Expertise with EnCase Forensic and Enterprise products
• Familiarity with eDiscovery, Information Assurance and AIRS products
• Experienced with Windows, Linux and some Unix
• Perform cyclical software regression testing for quality assurance purposes
• Research and document “bugs” and change requests based on feedback from users
• Attend training classes to further enhance my knowledge of the product
High School: Don Bosco Technical Institute, 1151 S. San Gabriel Blvd., Rosemead, Ca. 91770
Diploma earned: 1976
College: Santa Monica College, 1900 Pico Blvd., Santa Monica, Ca. 90405
Completed 20 credit hours in the Basic Accounting program
EnCase Certified Examiner Date: 01/2005 By: Guidance Software Inc.
Access Data Certified Examiner Date: 04/2010 By: Access Data Corp.
Microsoft Certified Professional Date: 11/1999 By: Microsoft Corp.
Comptia A+ Date: 09/2003 By: CompTIA
Comptia Network + Date: 03/2010 By: CompTIA
Blacklight Certified Examiner Date: 07/2015 By: Blackbag Technologies
Cellebrite Logical Operator Date: 07/2017 By: Cellebrite
EnCase Advanced Enterprise
EnCase Intermediate Analysis & Reporting
EnCase Advanced Computer Forensics
EnCase Network Intrusion
EnCase Incident Response Forensic Auditing and Discovery
EnCase Advanced Incident Response Forensic Auditing and Discovery
Access Data FTK Boot Camp
Access Data FTK Internet Forensics
Access Data FTK Windows
FBI CART 101
Basic Homicide Investigation
FLETC MacIntosh Forensics Training Program MFTP-202
FLETC Computer Network Investigations Training Program CNITP-103
FLETC Mobile Device Investigations Program MDIP-102
FLETC Seized Computer Evidence Recovery Specialist SCERS-102
FLETC Internet Investigations Training Program IITP-101
SANS FOR518 MacIntosh Forensics
Blackbag Technologies Blacklight training
Southern California High Tech Crime Investigators Association
High Tech Crime Consortium