Release 1. This is the first release of this unit of competency in the DEF Defence Training Package.

This unit describes the skills and knowledge required to assess, control and examine digital incident scenes, including determining the resources required to examine the scene and plan a search for digital equipment that will require forensic examination.

This unit applies to those working in the gathering and analysis of digital information.

The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to work health and safety (WHS) and assessing, controlling and examining digital incident scenes.

Those undertaking this unit would work independently, with minimal supervision, while performing complex tasks, including making complex judgements. They would use discretion and judgement and take responsibility for the quality of their outputs.

No licensing, legislative or certification requirements apply to unit at the time of publication.

Not applicable.

Digital Forensics.

Not applicable.

ELEMENTS 

PERFORMANCE CRITERIA 

Elements describe the essential outcomes.

Performance criteria describe the performance needed to demonstrate achievement of the element.

1 

Respond to incident 

1.1 

Receive, record, acknowledge and prioritise tasking

1.2 

Undertake preliminary assessment and anticipate likely resource requirements prior to arrival at the incident scene

2 

Assess the scene 

2.1 

Obtain information from relevant personnel to determine incident details

2.2 

Survey the incident scene to establish its scope within the scene assessment

2.3 

Identify risk factors and develop strategies to maintain personnel safety and preserve physical evidence

2.4 

Identify resources required to conduct examination of the scene

2.5 

Identify tactical factors and resulting priorities to assist decision making/subsequent action

2.6 

Establish a systematic plan of action

2.7 

Conduct a systematic search to identify relevant physical evidence, and maintain the integrity of the evidence

3 

Control the scene 

3.1 

Coordinate investigations to preserve life, property and evidence, minimise disruption and comply with operational safety guidelines

3.2 

Task and coordinate support personnel if necessary to manage the incident scene

3.3 

Establish and review perimeters to maintain security and integrity of the scene

3.4 

Maintain a record of movement where relevant

3.5 

Safeguard persons at the scene and prevent contamination or alteration of the scene

3.6 

Identify entry and exit paths to preserve evidence and maintain safety of personnel

3.7 

Assess the incident scene to identify subsequent investigative and/or forensic action

4 

Examine and interpret the scene 

4.1 

Record the nature and location (spatial relationships) of physical evidence and identify the sequence of events

4.2 

Draw conclusions from the physical evidence

4.3 

Review the conclusions if additional relevant evidence is identified

Foundation skills essential to performance are explicit in the performance criteria of this unit of competency.

Range is restricted to essential operating conditions and any other variables essential to the work environment.

Non-essential conditions may be found in the DEF Defence Training Package Companion Volume Implementation Guide.

This unit supersedes and is equivalent to DEFFOR011 Assess, control and examine electronic incident scenes.

Release 1. This is the first release of this unit of competency in the DEF Defence Training Package.

Evidence required to demonstrate competence in this unit must be relevant to and satisfy all of the requirements of the elements and performance criteria on at least one occasion and include:

• analysing, making decisions and solving problems in response to a range of scene contexts, including the systematic examination of incident scenes
• communicating and negotiating
• controlling persons in the vicinity of the incident scene
• handling exhibits and preserving continuity of evidence
• managing resources and time
• maximising the value of physical evidence.
• operating safely
• using specialised investigatory equipment and software
• working effectively with a range of professionals.

Evidence required to demonstrate competence in this unit must be relevant to and satisfy all of the requirements of the elements and performance criteria and include knowledge of:

• appropriate scene management techniques and processes
• forensic methodology
• government and policy context in which scenes are managed and investigated and the relevant law, policy and procedures
• indicators of need for specialist knowledge and investigative techniques
• judicial and evidentiary requirements and organisational processes for the collection, preservation and continuity of exhibits
• legislative, procedural and quality systems requirements for the security, protection and preservation of the scene
• roles and functions of other stakeholders in managing scenes
• the application and potential limitations of forensic investigative techniques
• the range of services available to assist in the assessment, management and interpretation of scenes, in particular digital forensic services
• work health and safety (WHS) practices to be followed when assessing, controlling and examining scenes.

Assessors must hold credentials specified within the Standards for Registered Training Organisations current at the time of assessment.

Assessment must satisfy the Principles of Assessment and Rules of Evidence and all regulatory requirements included within the Standards for Registered Training Organisations current at the time of assessment.

Assessment must occur in workplace operational situations. Where this is not appropriate, assessment must occur in simulated workplace operational situations that reflect workplace conditions.

Assessment processes and techniques must be appropriate to the language, literacy and numeracy requirements of the work being performed and the needs of the candidate.

Resources for assessment must include access to:

• a range of relevant exercises, case studies and/or simulations
• applicable documentation, including workplace procedures, regulations, codes of practice and operation manuals
• relevant materials, tools, equipment and personal protective equipment (PPE) currently used in industry.