Assessor Resource
DEFFOR010
Produce an electronic media image for forensic purposes
Assessment tool
Version 1.0
Issue Date: March 2024
This unit describes the skills required to employ a range of electronic media forensic methodologies to produce an image of a storage device. Storage devices may include hard disk drives, solid state drives, read-only memory (ROM), random-access memory (RAM), flash drives, tape drives, basic input/output system (BIOS) and USBs. Common objectives may include keyword searches, files recovery, including deleted files, extraction of registry information and metadata. Mobile devices such as mobile phones may afford additional information, including location, but require the use of specific methodologies.
This unit applies to those working in the gathering and analysis of electronic information.
The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to WHS and the search and seizure of electronic evidence.
Those undertaking this unit would work independently, with minimum of supervision, while performing complex tasks, including making complex judgements. They would use discretion and judgement and take responsibility for the quality of their outputs.
No licensing, legislative or certification requirements apply to this unit at the time of publication.
You may want to include more information here about the target group and the purpose of the assessments (eg formative, summative, recognition)