Assessor Resource

DEFFOR002
Conduct initial electronic investigation

Assessment tool

Version 1.0
Issue Date: April 2024


This unit describes the skills required to gather and collate information and obvious and accessible electronic evidence from the scene of an incident and identify potential witnesses. In the context of this unit, electronic evidence may include computer hard drives, recording media, flash drives, tape drives or digital and analogue recording and communications equipment. It includes maintaining the chain of evidential record.

This unit applies to those working in the gathering and analysis of electronic information.

The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to WHS, recording details of witnesses, and the search and seizure of electronic evidence.

Those undertaking this unit would work independently or as part of a team, under indirect supervision, while performing complex tasks in a broad range of contexts. They must be able to use discretion and judgement and take responsibility for the quality of their outputs.

No licensing, legislative or certification requirements apply to this unit at the time of publication.

You may want to include more information here about the target group and the purpose of the assessments (eg formative, summative, recognition)


Evidence Required

List the assessment methods to be used and the context and resources required for assessment. Copy and paste the relevant sections from the evidence guide below and then re-write these in plain English.

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Conduct initial assessment of scene

1.1 Assess the scene.

1.2 Establish communication with the senior investigating officer and maintain liaison throughout the investigation.

1.3 Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel.

1.4 Define/redefine the scene boundaries as required to preserve physical evidence for collection.

1.5 Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination.

2. Control integrity of scene

2.1 Establish and maintain appropriate arrangements for scene access and egress.

2.2 Identify and access additional resources required to secure incident scene.

3. Examine scene

3.1 Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved.

3.2 Record details of the scene and types of electronic equipment and media.

3.3 Locate, collect, package, label and store electronic evidence to ensure preservation for further examination.

3.4 Maintain a log of all evidence.

4. Identify potential witnesses and record initial statements

4.1 Identify and record names and contact details of potential witnesses.

4.2 Record initial statement using appropriate recording practices.

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.

conducting the initial assessment of the scene

identifying witnesses

recording and compiling records of interview and statements accurately

maximising the potential evidentiary value of the electronic evidence

paying attention to detail

implementing a methodical and systematic approach

questioning potential witnesses

using recording and specialised evidence collection equipment

working with a variety of professionals

taking and compiling statements

collecting and recording electronic evidence

protecting from contamination evidence including at least one of computer hard drives, recording media, flash drives, and digital and analogue recording and communications equipment

managing access and egress by establishing:

clear brief as to who has control of access

physical barriers

roster guards

limited entry to essential personnel

delegation of authority to control entry

record of all persons who enter or depart the scene

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.

legislative, policy and quality system context and requirements

details of scene features and use of a variety of specialised equipment

functions and roles of other professionals and experts

incident scene protection and preservation

indicators of need for specialised investigations

policies and procedures relating to recording details of persons

public safety and duty of care at incident scene

Competency should be assessed in an actual workplace or in a simulated environment, with access to equipment and infrastructure appropriate to the outcome. Competency should be demonstrated over time to ensure the candidate is assessed across a variety of situations, with access to electronic devices with content suitable for forensic extraction including mobile devices, computers or communications equipment.

Assessors must satisfy the NVR/AQTF mandatory competency requirements for assessors.

Submission Requirements

List each assessment task's title, type (eg project, observation/demonstration, essay, assingnment, checklist) and due date here

Assessment task 1: [title]      Due date:

(add new lines for each of the assessment tasks)

Assessment Tasks

Copy and paste from the following data to produce each assessment task. Write these in plain English and spell out how, when and where the task is to be carried out, under what conditions, and what resources are needed. Include guidelines about how well the candidate has to perform a task for it to be judged satisfactory.

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Conduct initial assessment of scene

1.1 Assess the scene.

1.2 Establish communication with the senior investigating officer and maintain liaison throughout the investigation.

1.3 Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel.

1.4 Define/redefine the scene boundaries as required to preserve physical evidence for collection.

1.5 Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination.

2. Control integrity of scene

2.1 Establish and maintain appropriate arrangements for scene access and egress.

2.2 Identify and access additional resources required to secure incident scene.

3. Examine scene

3.1 Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved.

3.2 Record details of the scene and types of electronic equipment and media.

3.3 Locate, collect, package, label and store electronic evidence to ensure preservation for further examination.

3.4 Maintain a log of all evidence.

4. Identify potential witnesses and record initial statements

4.1 Identify and record names and contact details of potential witnesses.

4.2 Record initial statement using appropriate recording practices.

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.

conducting the initial assessment of the scene

identifying witnesses

recording and compiling records of interview and statements accurately

maximising the potential evidentiary value of the electronic evidence

paying attention to detail

implementing a methodical and systematic approach

questioning potential witnesses

using recording and specialised evidence collection equipment

working with a variety of professionals

taking and compiling statements

collecting and recording electronic evidence

protecting from contamination evidence including at least one of computer hard drives, recording media, flash drives, and digital and analogue recording and communications equipment

managing access and egress by establishing:

clear brief as to who has control of access

physical barriers

roster guards

limited entry to essential personnel

delegation of authority to control entry

record of all persons who enter or depart the scene

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.

legislative, policy and quality system context and requirements

details of scene features and use of a variety of specialised equipment

functions and roles of other professionals and experts

incident scene protection and preservation

indicators of need for specialised investigations

policies and procedures relating to recording details of persons

public safety and duty of care at incident scene

Competency should be assessed in an actual workplace or in a simulated environment, with access to equipment and infrastructure appropriate to the outcome. Competency should be demonstrated over time to ensure the candidate is assessed across a variety of situations, with access to electronic devices with content suitable for forensic extraction including mobile devices, computers or communications equipment.

Assessors must satisfy the NVR/AQTF mandatory competency requirements for assessors.
Copy and paste from the following performance criteria to create an observation checklist for each task. When you have finished writing your assessment tool every one of these must have been addressed, preferably several times in a variety of contexts. To ensure this occurs download the assessment matrix for the unit; enter each assessment task as a column header and place check marks against each performance criteria that task addresses.

Observation Checklist

Tasks to be observed according to workplace/college/TAFE policy and procedures, relevant legislation and Codes of Practice Yes No Comments/feedback
Assess the scene. 
Establish communication with the senior investigating officer and maintain liaison throughout the investigation. 
Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel. 
Define/redefine the scene boundaries as required to preserve physical evidence for collection. 
Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination. 
Establish and maintain appropriate arrangements for scene access and egress. 
Identify and access additional resources required to secure incident scene. 
Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved. 
Record details of the scene and types of electronic equipment and media. 
Locate, collect, package, label and store electronic evidence to ensure preservation for further examination. 
Maintain a log of all evidence. 
Identify and record names and contact details of potential witnesses. 
Record initial statement using appropriate recording practices. 
Assess the scene. 
Establish communication with the senior investigating officer and maintain liaison throughout the investigation. 
Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel. 
Define/redefine the scene boundaries as required to preserve physical evidence for collection. 
Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination. 
Establish and maintain appropriate arrangements for scene access and egress. 
Identify and access additional resources required to secure incident scene. 
Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved. 
Record details of the scene and types of electronic equipment and media. 
Locate, collect, package, label and store electronic evidence to ensure preservation for further examination. 
Maintain a log of all evidence. 
Identify and record names and contact details of potential witnesses. 
Record initial statement using appropriate recording practices. 

Forms

Assessment Cover Sheet

DEFFOR002 - Conduct initial electronic investigation
Assessment task 1: [title]

Student name:

Student ID:

I declare that the assessment tasks submitted for this unit are my own work.

Student signature:

Result: Competent Not yet competent

Feedback to student

 

 

 

 

 

 

 

 

Assessor name:

Signature:

Date:

Assessment Record Sheet

DEFFOR002 - Conduct initial electronic investigation

Student name:

Student ID:

Assessment task 1: [title] Result: Competent Not yet competent

(add lines for each task)

Feedback to student:

 

 

 

 

 

 

 

 

Overall assessment result: Competent Not yet competent

Assessor name:

Signature:

Date:

Student signature:

Date: