DEFFOR016 Conduct initial digital investigation

Release: 1

DEFFOR016 Conduct initial digital investigation

Modification History

Release 1. This is the first release of this unit of competency in the DEF Defence Training Package.

Application

This unit describes the skills and knowledge required to gather and collate information and obvious and accessible digital evidence from the scene of an incident and identify potential witnesses. It includes maintaining the chain of evidential record. This unit applies to those working in gathering and analysis of digital information. The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to work health and safety (WHS), recording details of witnesses, and the search and seizure of digital evidence. Those undertaking this unit would work independently or as part of a team, under indirect supervision, while performing complex tasks in a broad range of contexts. They must be able to use discretion and judgement and take responsibility for the quality of their outputs. No licensing, legislative or certification requirements apply to this unit at the time of publication.

Pre-requisite Unit

Not applicable.

Competency Field

Digital Forensics.

Unit Sector

Not applicable.

Elements and Performance Criteria

ELEMENTS	PERFORMANCE CRITERIA
Elements describe the essential outcomes.	Performance criteria describe the performance needed to demonstrate achievement of the element.
1	Conduct initial assessment of scene	1.1	Assess the scene
1.2	Establish communication with the senior investigating officer and maintain liaison throughout the investigation
1.3	Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel
1.4	Define/redefine the scene boundaries as required to preserve physical evidence for collection
1.5	Locate obvious and accessible digital evidence and, where appropriate, protect from possible contamination
2	Control integrity of scene	2.1	Establish and maintain appropriate arrangements for scene access and egress
2.2	Identify and access additional resources required to secure incident scene
3	Examine scene	3.1	Instigate an appropriate search pattern to ensure all digital evidence is located and preserved
3.2	Record details of the scene and types of digital equipment and media
3.3	Locate, collect, package, label and store digital evidence to ensure preservation for further examination
3.4	Maintain a log of all evidence
4	Identify potential witnesses and record initial statements	4.1	Identify and record names and contact details of potential witnesses
4.2	Record initial statement using appropriate recording practices

Foundation Skills

Foundation skills essential to performance are explicit in the performance criteria of this unit of competency.

Range of Conditions

Range is restricted to essential operating conditions and any other variables essential to the work environment. Non-essential conditions may be found in the DEF Defence Training Package Companion Volume Implementation Guide.

Unit Mapping Information

This unit supersedes and is equivalent to DEFFOR002 Conduct initial electronic investigation.

Links

Companion Volume Implementation Guides are found on VETNet - https://vetnet.gov.au/Pages/TrainingDocs.aspx?q=6bdbab1e-11ed-4bc9-9cba-9e1a55d4e4a9