Assessor Resource

DEFFOR011
Assess, control and examine electronic incident scenes

Assessment tool

Version 1.0
Issue Date: April 2024


This unit describes the skills required to assess, control and examine electronic incident scenes, including determining the resources required to examine the scene and plan a search for electronic equipment that will require forensic examination. In the context of this unit, physical evidence includes both digital and analogue recording and communications equipment, including hard drives, recording media, flash drives, tape drives, random-access memory (RAM), read-only memory (ROM), basic input/output system (BIOS) and other peripherals.

This unit applies to those working in the gathering and analysis of electronic information.

The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to WHS and assessing, controlling and examining electronic incident scenes.

Those undertaking this unit would work independently, with minimal supervision, while performing complex tasks, including making complex judgements. They would use discretion and judgement and take responsibility for the quality of their outputs.

No licensing, legislative or certification requirements apply to unit at the time of publication.

You may want to include more information here about the target group and the purpose of the assessments (eg formative, summative, recognition)


Evidence Required

List the assessment methods to be used and the context and resources required for assessment. Copy and paste the relevant sections from the evidence guide below and then re-write these in plain English.

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Respond to incident

1.1 Receive, record, acknowledge and prioritise tasking.

1.2 Undertake preliminary assessment and anticipate likely resource requirements prior to arrival at the incident scene.

2. Assess the scene

2.1 Obtain information from relevant personnel to determine incident details.

2.2 Survey the incident scene to establish its scope within the scene assessment.

2.3 Identify resources required to conduct examination of the scene.

2.4 Identify risk factors and develop strategies to maintain personnel safety and preserve physical evidence.

2.5 Identify tactical factors and resulting priorities to assist decision making/subsequent action.

2.6 Establish a systematic plan of action.

2.7 Conduct a systematic search to identify relevant physical evidence, and maintain the integrity of the evidence.

3. Control the scene

3.1 Coordinate investigations to preserve life, property and evidence, minimise disruption and comply with operational safety guidelines.

3.2 Task and coordinate support personnel if necessary to manage the incident scene.

3.3 Establish and review perimeters to maintain security and integrity of the scene.

3.4 Maintain a record of movement where relevant.

3.5 Safeguard persons at the scene and prevent contamination or alteration of the scene.

3.6 Identify entry and exit paths to preserve evidence and maintain safety of personnel.

3.7 Assess the incident scene to identify subsequent investigative and/or forensic action.

4. Examine and interpret the scene

4.1 Record the nature and location (spatial relationships) of physical evidence and identify the sequence of events.

4.2 Draw conclusions from the physical evidence.

4.3 Review the conclusions if additional relevant evidence is identified.

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.

communicating (listening, questioning) and negotiating

controlling persons in the vicinity of the incident scene

analysing, making decisions and solving problems in response to a range of scene contexts, including the systematic examination of incident scenes

working effectively with a range of professionals

managing resources and time

handling exhibits and preserving continuity of evidence

using specialised investigatory equipment, including computer software and/or photographic equipment

operating safely

maximising the value of physical evidence

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.

government and policy context in which scenes are managed and investigated and the relevant law, policy and procedures

the range of services available to assist in the assessment, management and interpretation of scenes, in particular electronic forensic services

indicators of need for specialist knowledge and investigative techniques

judicial and evidentiary requirements and organisational processes for the collection, preservation and continuity of exhibits

roles and functions of other stakeholders in managing scenes

appropriate scene management techniques and processes

the application and potential limitations of forensic investigative techniques

legislative, procedural and quality systems requirements for the security, protection and preservation of the scene

WHS practices to be followed when examining scenes

forensic methodology

Competency should be assessed in an actual workplace or in a simulated environment, with access to equipment and infrastructure appropriate to the outcome. Competency should be demonstrated over time to ensure the candidate is assessed across a variety of situations, with access to electronic devices with content suitable for forensic extraction including mobile devices, computers or communications equipment.

Assessors must satisfy the NVR/AQTF mandatory competency requirements for assessors.

Submission Requirements

List each assessment task's title, type (eg project, observation/demonstration, essay, assingnment, checklist) and due date here

Assessment task 1: [title]      Due date:

(add new lines for each of the assessment tasks)

Assessment Tasks

Copy and paste from the following data to produce each assessment task. Write these in plain English and spell out how, when and where the task is to be carried out, under what conditions, and what resources are needed. Include guidelines about how well the candidate has to perform a task for it to be judged satisfactory.

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Respond to incident

1.1 Receive, record, acknowledge and prioritise tasking.

1.2 Undertake preliminary assessment and anticipate likely resource requirements prior to arrival at the incident scene.

2. Assess the scene

2.1 Obtain information from relevant personnel to determine incident details.

2.2 Survey the incident scene to establish its scope within the scene assessment.

2.3 Identify resources required to conduct examination of the scene.

2.4 Identify risk factors and develop strategies to maintain personnel safety and preserve physical evidence.

2.5 Identify tactical factors and resulting priorities to assist decision making/subsequent action.

2.6 Establish a systematic plan of action.

2.7 Conduct a systematic search to identify relevant physical evidence, and maintain the integrity of the evidence.

3. Control the scene

3.1 Coordinate investigations to preserve life, property and evidence, minimise disruption and comply with operational safety guidelines.

3.2 Task and coordinate support personnel if necessary to manage the incident scene.

3.3 Establish and review perimeters to maintain security and integrity of the scene.

3.4 Maintain a record of movement where relevant.

3.5 Safeguard persons at the scene and prevent contamination or alteration of the scene.

3.6 Identify entry and exit paths to preserve evidence and maintain safety of personnel.

3.7 Assess the incident scene to identify subsequent investigative and/or forensic action.

4. Examine and interpret the scene

4.1 Record the nature and location (spatial relationships) of physical evidence and identify the sequence of events.

4.2 Draw conclusions from the physical evidence.

4.3 Review the conclusions if additional relevant evidence is identified.

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.

communicating (listening, questioning) and negotiating

controlling persons in the vicinity of the incident scene

analysing, making decisions and solving problems in response to a range of scene contexts, including the systematic examination of incident scenes

working effectively with a range of professionals

managing resources and time

handling exhibits and preserving continuity of evidence

using specialised investigatory equipment, including computer software and/or photographic equipment

operating safely

maximising the value of physical evidence

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.

government and policy context in which scenes are managed and investigated and the relevant law, policy and procedures

the range of services available to assist in the assessment, management and interpretation of scenes, in particular electronic forensic services

indicators of need for specialist knowledge and investigative techniques

judicial and evidentiary requirements and organisational processes for the collection, preservation and continuity of exhibits

roles and functions of other stakeholders in managing scenes

appropriate scene management techniques and processes

the application and potential limitations of forensic investigative techniques

legislative, procedural and quality systems requirements for the security, protection and preservation of the scene

WHS practices to be followed when examining scenes

forensic methodology

Competency should be assessed in an actual workplace or in a simulated environment, with access to equipment and infrastructure appropriate to the outcome. Competency should be demonstrated over time to ensure the candidate is assessed across a variety of situations, with access to electronic devices with content suitable for forensic extraction including mobile devices, computers or communications equipment.

Assessors must satisfy the NVR/AQTF mandatory competency requirements for assessors.

Copy and paste from the following performance criteria to create an observation checklist for each task. When you have finished writing your assessment tool every one of these must have been addressed, preferably several times in a variety of contexts. To ensure this occurs download the assessment matrix for the unit; enter each assessment task as a column header and place check marks against each performance criteria that task addresses.

Observation Checklist

Tasks to be observed according to workplace/college/TAFE policy and procedures, relevant legislation and Codes of Practice Yes No Comments/feedback
Receive, record, acknowledge and prioritise tasking. 
Undertake preliminary assessment and anticipate likely resource requirements prior to arrival at the incident scene. 
Obtain information from relevant personnel to determine incident details. 
Survey the incident scene to establish its scope within the scene assessment. 
Identify resources required to conduct examination of the scene. 
Identify risk factors and develop strategies to maintain personnel safety and preserve physical evidence. 
Identify tactical factors and resulting priorities to assist decision making/subsequent action. 
Establish a systematic plan of action. 
Conduct a systematic search to identify relevant physical evidence, and maintain the integrity of the evidence. 
Coordinate investigations to preserve life, property and evidence, minimise disruption and comply with operational safety guidelines. 
Task and coordinate support personnel if necessary to manage the incident scene. 
Establish and review perimeters to maintain security and integrity of the scene. 
Maintain a record of movement where relevant. 
Safeguard persons at the scene and prevent contamination or alteration of the scene. 
Identify entry and exit paths to preserve evidence and maintain safety of personnel. 
Assess the incident scene to identify subsequent investigative and/or forensic action. 
Record the nature and location (spatial relationships) of physical evidence and identify the sequence of events. 
Draw conclusions from the physical evidence. 
Review the conclusions if additional relevant evidence is identified. 
Receive, record, acknowledge and prioritise tasking. 
Undertake preliminary assessment and anticipate likely resource requirements prior to arrival at the incident scene. 
Obtain information from relevant personnel to determine incident details. 
Survey the incident scene to establish its scope within the scene assessment. 
Identify resources required to conduct examination of the scene. 
Identify risk factors and develop strategies to maintain personnel safety and preserve physical evidence. 
Identify tactical factors and resulting priorities to assist decision making/subsequent action. 
Establish a systematic plan of action. 
Conduct a systematic search to identify relevant physical evidence, and maintain the integrity of the evidence. 
Coordinate investigations to preserve life, property and evidence, minimise disruption and comply with operational safety guidelines. 
Task and coordinate support personnel if necessary to manage the incident scene. 
Establish and review perimeters to maintain security and integrity of the scene. 
Maintain a record of movement where relevant. 
Safeguard persons at the scene and prevent contamination or alteration of the scene. 
Identify entry and exit paths to preserve evidence and maintain safety of personnel. 
Assess the incident scene to identify subsequent investigative and/or forensic action. 
Record the nature and location (spatial relationships) of physical evidence and identify the sequence of events. 
Draw conclusions from the physical evidence. 
Review the conclusions if additional relevant evidence is identified. 

Forms

Assessment Cover Sheet

DEFFOR011 - Assess, control and examine electronic incident scenes
Assessment task 1: [title]

Student name:

Student ID:

I declare that the assessment tasks submitted for this unit are my own work.

Student signature:

Result: Competent Not yet competent

Feedback to student

 

 

 

 

 

 

 

 

Assessor name:

Signature:

Date:

Assessment Record Sheet

DEFFOR011 - Assess, control and examine electronic incident scenes

Student name:

Student ID:

Assessment task 1: [title] Result: Competent Not yet competent

(add lines for each task)

Feedback to student:

 

 

 

 

 

 

 

 

Overall assessment result: Competent Not yet competent

Assessor name:

Signature:

Date:

Student signature:

Date: