Release 1. This is the first release of this unit of competency in the DEF Defence Training Package.

This unit describes the skills and knowledge required to gather and collate information and obvious and accessible digital evidence from the scene of an incident and identify potential witnesses. It includes maintaining the chain of evidential record.

This unit applies to those working in gathering and analysis of digital information.

The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to work health and safety (WHS), recording details of witnesses, and the search and seizure of digital evidence.

Those undertaking this unit would work independently or as part of a team, under indirect supervision, while performing complex tasks in a broad range of contexts. They must be able to use discretion and judgement and take responsibility for the quality of their outputs.

No licensing, legislative or certification requirements apply to this unit at the time of publication.

Not applicable.

Digital Forensics.

Not applicable.

ELEMENTS 

PERFORMANCE CRITERIA 

Elements describe the essential outcomes.

Performance criteria describe the performance needed to demonstrate achievement of the element.

1 

Conduct initial assessment of scene 

1.1 

Assess the scene

1.2 

Establish communication with the senior investigating officer and maintain liaison throughout the investigation

1.3 

Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel

1.4 

Define/redefine the scene boundaries as required to preserve physical evidence for collection

1.5 

Locate obvious and accessible digital evidence and, where appropriate, protect from possible contamination

2 

Control integrity of scene 

2.1 

Establish and maintain appropriate arrangements for scene access and egress

2.2 

Identify and access additional resources required to secure incident scene

3 

Examine scene 

3.1 

Instigate an appropriate search pattern to ensure all digital evidence is located and preserved

3.2 

Record details of the scene and types of digital equipment and media

3.3 

Locate, collect, package, label and store digital evidence to ensure preservation for further examination

3.4 

Maintain a log of all evidence

4 

Identify potential witnesses and record initial statements 

4.1 

Identify and record names and contact details of potential witnesses

4.2 

Record initial statement using appropriate recording practices

Foundation skills essential to performance are explicit in the performance criteria of this unit of competency.

Range is restricted to essential operating conditions and any other variables essential to the work environment.

Non-essential conditions may be found in the DEF Defence Training Package Companion Volume Implementation Guide.

This unit supersedes and is equivalent to DEFFOR002 Conduct initial electronic investigation.

Release 1. This is the first release of this unit of competency in the DEF Defence Training Package.

Evidence required to demonstrate competence in this unit must be relevant to and satisfy all of the requirements of the elements and performance criteria on at least one occasion and include:

• collecting and recording digital evidence
• conducting the initial assessment of the scene
• identifying witnesses
• implementing a methodical and systematic approach
• managing access and egress by establishing:

• clear brief as to who has control of access
• delegation of authority to control entry
• limited entry to essential personnel
• physical barriers
• record of all persons who enter or depart the scene
• roster guards

• maximising the potential evidentiary value of the digital evidence
• paying attention to detail
• protecting evidence from contamination, including at least one digital storage device
• questioning potential witnesses
• recording and compiling records of interviews and statements accurately using a variety of means, including video and audio equipment
• taking and compiling statements
• using recording and specialised evidence collection equipment, including a variety of digital video and audio recording devices
• working with a variety of professionals.

Evidence required to demonstrate competence in this unit must be relevant to and satisfy all of the requirements of the elements and performance criteria and include knowledge of:

• details of scene features and use of a variety of specialised equipment, including video and audio recording equipment
• functions and roles of other professionals and experts
• incident scene protection and preservation
• indicators of need for specialised investigations
• legislative, policy and quality system context and requirements
• policies and procedures relating to recording details of persons
• public safety, work health and safety (WHS) and duty of care requirements at incident scene.

Assessors must hold credentials specified within the Standards for Registered Training Organisations current at the time of assessment.

Assessment must satisfy the Principles of Assessment and Rules of Evidence and all regulatory requirements included within the Standards for Registered Training Organisations current at the time of assessment.

Assessment must occur in workplace operational situations. Where this is not appropriate, assessment must occur in simulated workplace operational situations that reflect workplace conditions.

Assessment processes and techniques must be appropriate to the language, literacy and numeracy requirements of the work being performed and the needs of the candidate.

Resources for assessment must include access to:

• a range of relevant exercises, case studies and/or simulations
• applicable documentation, including workplace procedures, regulations, codes of practice and operation manuals
• relevant materials, tools, equipment and personal protective equipment (PPE) currently used in industry.