Application
This unit describes the skills required to conduct activities involved in the detection, recording and collection of electronic evidence prior to laboratory examination. It requires the individual to detect, record, collect and package both digital and analogue recording and communications equipment including hard drives, recording media, flash drives, tape drives, random-access memory (RAM), read-only memory (ROM), basic input/output system (BIOS) and other peripherals.
This unit applies to those working in the gathering and analysis of electronic information.
The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to WHS and the search for and seizure of electronic evidence.
Those undertaking this unit would work independently, with minimal supervision, while performing complex tasks, including making complex judgements. They would use discretion and judgement and take responsibility for the quality of their outputs.
No licensing, legislative or certification requirements apply to this unit at the time of publication.
Elements and Performance Criteria
ELEMENTS | PERFORMANCE CRITERIA |
Elements describe the essential outcomes | Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section. |
1. Detect and record electronic evidence | 1.1 Detect electronic evidence using observational techniques and technological methods. 1.2 Record electronic evidence prior to examination. 1.3 Document the recorded electronic evidence. |
2. Collect electronic evidence | 2.1 Collect electronic evidence by handpicking or removing media from machines to prevent contamination or loss. 2.2 Ensure that collected electronic evidence is sufficient in quantity, where possible, to allow all potential examinations/analyses to be carried out. |
3. Package electronic evidence | 3.1 Package and store items to maintain continuity and prevent degradation or contamination. 3.2 Package electronic evidence. 3.3 Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain continuity. |
Evidence of Performance
Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.
solving problems
making analytical decisions
examining electronic evidence
maximising the evidentiary value of the electronic evidence
handling and preserving continuity of evidence
collecting and preserving specific evidence types
operating safely
packaging and storing items to maintain continuity and prevent degradation or contamination by considering:
physical nature of exhibit
electronic stability
packaging medium
tamper-evident seals
exhibit labels
storage temperature
Evidence of Knowledge
Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.
legislative, policy and quality system context and requirements
available techniques and their limitations
required documentation
roles and functions of other forensic discipline specialists
WHS
Assessment Conditions
Competency should be assessed in an actual workplace or in a simulated environment, with access to equipment and infrastructure appropriate to the outcome. Competency should be demonstrated over time to ensure the candidate is assessed across a variety of situations, with access to electronic devices with content suitable for forensic extraction including mobile devices, computers or communications equipment.
Assessors must satisfy the NVR/AQTF mandatory competency requirements for assessors.
Foundation Skills
The foundation skills demands of this unit have been mapped for alignment with the Australian Core Skills Framework (ACSF). The following tables outline the performance levels indicated for successful attainment of the unit.
ACSF levels indicative of performance:
Further information on ACSF and the foundation skills underpinning this unit can be found in the Foundation Skills Guide on the GSA website.
Competency Field
Electronic Forensics