Elements and Performance Criteria
- Reduce and describe data
- Identify electronic forensic data to be analysed.
- Reduce the data, identify possible artefacts and describe these in a suitable form to support the development of interpretations.
- Decrypt data if appropriate.
- Review the reduction and description processes to determine their appropriateness, and make improvements where necessary.
- Save data not used in the reduction and description processes for future reference.
- Analyse and interpret data
- Interpret the data using appropriate thinking processes based on deduction, induction and/or problem solving techniques.
- Analyse electronic storage devices for artefacts, i.e. any kind of tangible electronic byproduct produced during user or system activity that may become evidence.
- Apply sound reasoning to ensure consistency of interpretations based on the data.
- Base interpretations on the factual quantitative and qualitative data.
- Develop a reconstruction of events using analysis techniques.
- Develop conclusions and recommendations
- Test and review possible interpretations to ensure they are credible and consistent with relevant data.
- Refine and consolidate interpretations to strengthen inferences drawn.
- Clearly state assumptions in the arguments leading to inferences.
- Formulate sound inferences, probable predictions, interpretations and/or explanations from facts and the tested interpretations.
- Ensure transparency in the investigation process by formulating inferences through a clear chain of reasoning.
- Review inferences to identify and address any fallacies in reasoning.
- Assess the relationship between the data developed and the probable interpretations to ensure validity and compliance, and report orally and/or in writing, formally or informally.
- Develop and report conclusions and recommendations, addressing both strategic and tactical issues.
- Reduce and describe data
- Identify electronic forensic data to be analysed.
- Reduce the data, identify possible artefacts and describe these in a suitable form to support the development of interpretations.
- Decrypt data if appropriate.
- Review the reduction and description processes to determine their appropriateness, and make improvements where necessary.
- Save data not used in the reduction and description processes for future reference.
- Analyse and interpret data
- Interpret the data using appropriate thinking processes based on deduction, induction and/or problem solving techniques.
- Analyse electronic storage devices for artefacts, i.e. any kind of tangible electronic byproduct produced during user or system activity that may become evidence.
- Apply sound reasoning to ensure consistency of interpretations based on the data.
- Base interpretations on the factual quantitative and qualitative data.
- Develop a reconstruction of events using analysis techniques.
- Develop conclusions and recommendations
- Test and review possible interpretations to ensure they are credible and consistent with relevant data.
- Refine and consolidate interpretations to strengthen inferences drawn.
- Clearly state assumptions in the arguments leading to inferences.
- Formulate sound inferences, probable predictions, interpretations and/or explanations from facts and the tested interpretations.
- Ensure transparency in the investigation process by formulating inferences through a clear chain of reasoning.
- Review inferences to identify and address any fallacies in reasoning.
- Assess the relationship between the data developed and the probable interpretations to ensure validity and compliance, and report orally and/or in writing, formally or informally.
- Develop and report conclusions and recommendations, addressing both strategic and tactical issues.