Release 1. This is the first release of this unit of competency in the DEF Defence Training Package.

This unit describes the skills and knowledge required to employ a range of digital media forensic methodologies to produce an image of a digital storage device.

This unit applies to those working in the gathering and analysis of digital information.

The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to work health and safety (WHS) and the search and seizure of digital evidence.

Those undertaking this unit would work independently, with minimum of supervision, while performing complex tasks, including making complex judgements. They would use discretion and judgement and take responsibility for the quality of their outputs.

No licensing, legislative or certification requirements apply to this unit at the time of publication.

Not applicable.

Digital Forensics.

Not applicable.

ELEMENTS 

PERFORMANCE CRITERIA 

Elements describe the essential outcomes.

Performance criteria describe the performance needed to demonstrate achievement of the element.

1 

Determine job requirements 

1.1 

Detect digital evidence using observation techniques and appropriate technological methods

1.2 

Isolate digital evidence prior to examination

1.3 

Identify recording methods to document the digital evidence

1.4 

Determine most appropriate methodology to image the digital evidence based on the information being sought and the actual process of analysis of the investigation

2 

Image storage device 

2.1 

Prepare storage device for imaging

2.2 

Acquire image and check for accuracy by removing internal components from devices if appropriate

2.3 

Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out

3 

Collect and package digital evidence 

3.1 

Collect digital evidence so as to prevent contamination or loss

3.2 

Package and store evidence to maintain continuity and prevent degradation or contamination

3.3 

Enter details of digital evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody

Foundation skills essential to performance are explicit in the performance criteria of this unit of competency.

Range is restricted to essential operating conditions and any other variables essential to the work environment.

Non-essential conditions may be found in the DEF Defence Training Package Companion Volume Implementation Guide.

This unit supersedes and is equivalent to DEFFOR010 Produce an electronic media image for forensic purposes.

Release 1. This is the first release of this unit of competency in the DEF Defence Training Package.

Evidence required to demonstrate competence in this unit must be relevant to and satisfy all of the requirements of the elements and performance criteria on at least one occasion and include:

• adhering to operational safety
• applying exhibit handling skills
• applying resource management and time management
• collecting, packaging and preserving specific evidence types
• maximising the potential evidentiary value of the digital evidence
• preserving continuity of evidence
• using analytical, decision-making and problem-solving skills in response to a range of digital evidence contexts, including the systematic examination of items of digital evidence
• using specialised evidence-recording software or equipment as required.

Evidence required to demonstrate competence in this unit must be relevant to and satisfy all of the requirements of the elements and performance criteria and include knowledge of:

• application and potential limitations of forensic investigative techniques
• legislative, policy and quality system context
• required forensic documentation for the recording and collection of digital evidence
• roles and functions of other forensic discipline specialists
• the range of techniques available for the recording, collection, packaging and preservation of digital evidence
• work health and safety (WHS) practices to be followed when producing a digital media image for forensic purposes.

Assessors must hold credentials specified within the Standards for Registered Training Organisations current at the time of assessment.

Assessment must satisfy the Principles of Assessment and Rules of Evidence and all regulatory requirements included within the Standards for Registered Training Organisations current at the time of assessment.

Assessment must occur in workplace operational situations. Where this is not appropriate, assessment must occur in simulated workplace operational situations that reflect workplace conditions.

Assessment processes and techniques must be appropriate to the language, literacy and numeracy requirements of the work being performed and the needs of the candidate.

Resources for assessment must include access to:

• a range of relevant exercises, case studies and/or simulations
• applicable documentation, including workplace procedures, regulations, codes of practice and operation manuals
• relevant materials, tools, equipment and personal protective equipment (PPE) currently used in industry.