Assessor Resource

DEFFOR010
Produce an electronic media image for forensic purposes

Assessment tool

Version 1.0
Issue Date: March 2024


This unit describes the skills required to employ a range of electronic media forensic methodologies to produce an image of a storage device. Storage devices may include hard disk drives, solid state drives, read-only memory (ROM), random-access memory (RAM), flash drives, tape drives, basic input/output system (BIOS) and USBs. Common objectives may include keyword searches, files recovery, including deleted files, extraction of registry information and metadata. Mobile devices such as mobile phones may afford additional information, including location, but require the use of specific methodologies.

This unit applies to those working in the gathering and analysis of electronic information.

The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to WHS and the search and seizure of electronic evidence.

Those undertaking this unit would work independently, with minimum of supervision, while performing complex tasks, including making complex judgements. They would use discretion and judgement and take responsibility for the quality of their outputs.

No licensing, legislative or certification requirements apply to this unit at the time of publication.

You may want to include more information here about the target group and the purpose of the assessments (eg formative, summative, recognition)



Evidence Required

List the assessment methods to be used and the context and resources required for assessment. Copy and paste the relevant sections from the evidence guide below and then re-write these in plain English.

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Determine job requirements

1.1 Detect electronic evidence using observation techniques and appropriate technological methods.

1.2 Isolate electronic evidence prior to examination.

1.3 Identify recording methods to document the electronic evidence.

1.4 Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.

2. Image storage device

2.1 Prepare storage device for imaging.

2.2 Acquire image and check for accuracy by removing internal components from devices if appropriate.

2.3 Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.

3. Collect and package electronic evidence

3.1 Collect electronic evidence so as to prevent contamination or loss.

3.2 Package and store evidence to maintain continuity and prevent degradation or contamination.

3.3 Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.

using analytical, decision-making and problem-solving skills in response to a range of electronic evidence contexts, including the systematic examination of items of electronic evidence

applying resource management and time management

applying exhibit handling skills

preserving continuity of evidence

using specialised evidence-recording equipment as required

collecting, packaging and preserving specific evidence types

adhering to operational safety

maximising the potential evidentiary value of the electronic evidence

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.

legislative, policy and quality system context

the range of techniques available for the recording, collection, packaging and preservation of electronic evidence

required forensic documentation for the recording and collection of electronic evidence

application and potential limitations of forensic investigative techniques

roles and functions of other forensic discipline specialists

WHS

Competency should be assessed in an actual workplace or in a simulated environment, with access to equipment and infrastructure appropriate to the outcome. Competency should be demonstrated over time to ensure the candidate is assessed across a variety of situations, with access to electronic devices with content suitable for forensic extraction including mobile devices, computers or communications equipment.

Assessors must satisfy the NVR/AQTF mandatory competency requirements for assessors.


Submission Requirements

List each assessment task's title, type (eg project, observation/demonstration, essay, assingnment, checklist) and due date here

Assessment task 1: [title]      Due date:

(add new lines for each of the assessment tasks)


Assessment Tasks

Copy and paste from the following data to produce each assessment task. Write these in plain English and spell out how, when and where the task is to be carried out, under what conditions, and what resources are needed. Include guidelines about how well the candidate has to perform a task for it to be judged satisfactory.

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Determine job requirements

1.1 Detect electronic evidence using observation techniques and appropriate technological methods.

1.2 Isolate electronic evidence prior to examination.

1.3 Identify recording methods to document the electronic evidence.

1.4 Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.

2. Image storage device

2.1 Prepare storage device for imaging.

2.2 Acquire image and check for accuracy by removing internal components from devices if appropriate.

2.3 Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.

3. Collect and package electronic evidence

3.1 Collect electronic evidence so as to prevent contamination or loss.

3.2 Package and store evidence to maintain continuity and prevent degradation or contamination.

3.3 Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.

using analytical, decision-making and problem-solving skills in response to a range of electronic evidence contexts, including the systematic examination of items of electronic evidence

applying resource management and time management

applying exhibit handling skills

preserving continuity of evidence

using specialised evidence-recording equipment as required

collecting, packaging and preserving specific evidence types

adhering to operational safety

maximising the potential evidentiary value of the electronic evidence

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.

legislative, policy and quality system context

the range of techniques available for the recording, collection, packaging and preservation of electronic evidence

required forensic documentation for the recording and collection of electronic evidence

application and potential limitations of forensic investigative techniques

roles and functions of other forensic discipline specialists

WHS

Competency should be assessed in an actual workplace or in a simulated environment, with access to equipment and infrastructure appropriate to the outcome. Competency should be demonstrated over time to ensure the candidate is assessed across a variety of situations, with access to electronic devices with content suitable for forensic extraction including mobile devices, computers or communications equipment.

Assessors must satisfy the NVR/AQTF mandatory competency requirements for assessors.

Copy and paste from the following performance criteria to create an observation checklist for each task. When you have finished writing your assessment tool every one of these must have been addressed, preferably several times in a variety of contexts. To ensure this occurs download the assessment matrix for the unit; enter each assessment task as a column header and place check marks against each performance criteria that task addresses.

Observation Checklist

Tasks to be observed according to workplace/college/TAFE policy and procedures, relevant legislation and Codes of Practice Yes No Comments/feedback
Detect electronic evidence using observation techniques and appropriate technological methods. 
Isolate electronic evidence prior to examination. 
Identify recording methods to document the electronic evidence. 
Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation. 
Prepare storage device for imaging. 
Acquire image and check for accuracy by removing internal components from devices if appropriate. 
Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out. 
Collect electronic evidence so as to prevent contamination or loss. 
Package and store evidence to maintain continuity and prevent degradation or contamination. 
Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody. 
Detect electronic evidence using observation techniques and appropriate technological methods. 
Isolate electronic evidence prior to examination. 
Identify recording methods to document the electronic evidence. 
Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation. 
Prepare storage device for imaging. 
Acquire image and check for accuracy by removing internal components from devices if appropriate. 
Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out. 
Collect electronic evidence so as to prevent contamination or loss. 
Package and store evidence to maintain continuity and prevent degradation or contamination. 
Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody. 

Forms

Assessment Cover Sheet

DEFFOR010 - Produce an electronic media image for forensic purposes
Assessment task 1: [title]

Student name:

Student ID:

I declare that the assessment tasks submitted for this unit are my own work.

Student signature:

Result: Competent Not yet competent

Feedback to student

 

 

 

 

 

 

 

 

Assessor name:

Signature:

Date:


Assessment Record Sheet

DEFFOR010 - Produce an electronic media image for forensic purposes

Student name:

Student ID:

Assessment task 1: [title] Result: Competent Not yet competent

(add lines for each task)

Feedback to student:

 

 

 

 

 

 

 

 

Overall assessment result: Competent Not yet competent

Assessor name:

Signature:

Date:

Student signature:

Date: