DEFFOR021 Produce a digital media image for forensic purposes

Release: 1

DEFFOR021 Produce a digital media image for forensic purposes

Modification History

Release 1. This is the first release of this unit of competency in the DEF Defence Training Package.

Application

This unit describes the skills and knowledge required to employ a range of digital media forensic methodologies to produce an image of a digital storage device. This unit applies to those working in the gathering and analysis of digital information. The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to work health and safety (WHS) and the search and seizure of digital evidence. Those undertaking this unit would work independently, with minimum of supervision, while performing complex tasks, including making complex judgements. They would use discretion and judgement and take responsibility for the quality of their outputs. No licensing, legislative or certification requirements apply to this unit at the time of publication.

Pre-requisite Unit

Not applicable.

Competency Field

Digital Forensics.

Unit Sector

Not applicable.

Elements and Performance Criteria

ELEMENTS	PERFORMANCE CRITERIA
Elements describe the essential outcomes.	Performance criteria describe the performance needed to demonstrate achievement of the element.
1	Determine job requirements	1.1	Detect digital evidence using observation techniques and appropriate technological methods
1.2	Isolate digital evidence prior to examination
1.3	Identify recording methods to document the digital evidence
1.4	Determine most appropriate methodology to image the digital evidence based on the information being sought and the actual process of analysis of the investigation
2	Image storage device	2.1	Prepare storage device for imaging
2.2	Acquire image and check for accuracy by removing internal components from devices if appropriate
2.3	Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out
3	Collect and package digital evidence	3.1	Collect digital evidence so as to prevent contamination or loss
3.2	Package and store evidence to maintain continuity and prevent degradation or contamination
3.3	Enter details of digital evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody

Foundation Skills

Foundation skills essential to performance are explicit in the performance criteria of this unit of competency.

Range of Conditions

Range is restricted to essential operating conditions and any other variables essential to the work environment. Non-essential conditions may be found in the DEF Defence Training Package Companion Volume Implementation Guide.

Unit Mapping Information

This unit supersedes and is equivalent to DEFFOR010 Produce an electronic media image for forensic purposes.

Links

Companion Volume Implementation Guides are found on VETNet - https://vetnet.gov.au/Pages/TrainingDocs.aspx?q=6bdbab1e-11ed-4bc9-9cba-9e1a55d4e4a9