NTISthis.com

Evidence Guide: DEFFOR002 - Conduct initial electronic investigation

Student: __________________________________________________

Signature: _________________________________________________

Tips for gathering evidence to demonstrate your skills

The important thing to remember when gathering evidence is that the more evidence the better - that is, the more evidence you gather to demonstrate your skills, the more confident an assessor can be that you have learned the skills not just at one point in time, but are continuing to apply and develop those skills (as opposed to just learning for the test!). Furthermore, one piece of evidence that you collect will not usualy demonstrate all the required criteria for a unit of competency, whereas multiple overlapping pieces of evidence will usually do the trick!

From the Wiki University

 

DEFFOR002 - Conduct initial electronic investigation

What evidence can you provide to prove your understanding of each of the following citeria?

Conduct initial assessment of scene

  1. Assess the scene.
  2. Establish communication with the senior investigating officer and maintain liaison throughout the investigation.
  3. Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel.
  4. Define/redefine the scene boundaries as required to preserve physical evidence for collection.
  5. Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination.
Assess the scene.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Establish communication with the senior investigating officer and maintain liaison throughout the investigation.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Define/redefine the scene boundaries as required to preserve physical evidence for collection.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Control integrity of scene

  1. Establish and maintain appropriate arrangements for scene access and egress.
  2. Identify and access additional resources required to secure incident scene.
Establish and maintain appropriate arrangements for scene access and egress.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Identify and access additional resources required to secure incident scene.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Examine scene

  1. Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved.
  2. Record details of the scene and types of electronic equipment and media.
  3. Locate, collect, package, label and store electronic evidence to ensure preservation for further examination.
  4. Maintain a log of all evidence.
Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Record details of the scene and types of electronic equipment and media.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Locate, collect, package, label and store electronic evidence to ensure preservation for further examination.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Maintain a log of all evidence.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Identify potential witnesses and record initial statements

  1. Identify and record names and contact details of potential witnesses.
  2. Record initial statement using appropriate recording practices.
Identify and record names and contact details of potential witnesses.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Record initial statement using appropriate recording practices.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Conduct initial assessment of scene

  1. Assess the scene.
  2. Establish communication with the senior investigating officer and maintain liaison throughout the investigation.
  3. Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel.
  4. Define/redefine the scene boundaries as required to preserve physical evidence for collection.
  5. Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination.
Assess the scene.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Establish communication with the senior investigating officer and maintain liaison throughout the investigation.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Define/redefine the scene boundaries as required to preserve physical evidence for collection.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Control integrity of scene

  1. Establish and maintain appropriate arrangements for scene access and egress.
  2. Identify and access additional resources required to secure incident scene.
Establish and maintain appropriate arrangements for scene access and egress.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Identify and access additional resources required to secure incident scene.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Examine scene

  1. Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved.
  2. Record details of the scene and types of electronic equipment and media.
  3. Locate, collect, package, label and store electronic evidence to ensure preservation for further examination.
  4. Maintain a log of all evidence.
Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Record details of the scene and types of electronic equipment and media.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Locate, collect, package, label and store electronic evidence to ensure preservation for further examination.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Maintain a log of all evidence.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Identify potential witnesses and record initial statements

  1. Identify and record names and contact details of potential witnesses.
  2. Record initial statement using appropriate recording practices.
Identify and record names and contact details of potential witnesses.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Record initial statement using appropriate recording practices.

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Assessed

Teacher: ___________________________________ Date: _________

Signature: ________________________________________________

Comments:

 

 

 

 

 

 

 

 

Instructions to Assessors

Evidence Guide

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Conduct initial assessment of scene

1.1 Assess the scene.

1.2 Establish communication with the senior investigating officer and maintain liaison throughout the investigation.

1.3 Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel.

1.4 Define/redefine the scene boundaries as required to preserve physical evidence for collection.

1.5 Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination.

2. Control integrity of scene

2.1 Establish and maintain appropriate arrangements for scene access and egress.

2.2 Identify and access additional resources required to secure incident scene.

3. Examine scene

3.1 Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved.

3.2 Record details of the scene and types of electronic equipment and media.

3.3 Locate, collect, package, label and store electronic evidence to ensure preservation for further examination.

3.4 Maintain a log of all evidence.

4. Identify potential witnesses and record initial statements

4.1 Identify and record names and contact details of potential witnesses.

4.2 Record initial statement using appropriate recording practices.

Required Skills and Knowledge

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Conduct initial assessment of scene

1.1 Assess the scene.

1.2 Establish communication with the senior investigating officer and maintain liaison throughout the investigation.

1.3 Ascertain the circumstances surrounding the scene through visual assessment and reports from other personnel.

1.4 Define/redefine the scene boundaries as required to preserve physical evidence for collection.

1.5 Locate obvious and accessible electronic evidence and, where appropriate, protect from possible contamination.

2. Control integrity of scene

2.1 Establish and maintain appropriate arrangements for scene access and egress.

2.2 Identify and access additional resources required to secure incident scene.

3. Examine scene

3.1 Instigate an appropriate search pattern to ensure all electronic evidence is located and preserved.

3.2 Record details of the scene and types of electronic equipment and media.

3.3 Locate, collect, package, label and store electronic evidence to ensure preservation for further examination.

3.4 Maintain a log of all evidence.

4. Identify potential witnesses and record initial statements

4.1 Identify and record names and contact details of potential witnesses.

4.2 Record initial statement using appropriate recording practices.

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.

conducting the initial assessment of the scene

identifying witnesses

recording and compiling records of interview and statements accurately

maximising the potential evidentiary value of the electronic evidence

paying attention to detail

implementing a methodical and systematic approach

questioning potential witnesses

using recording and specialised evidence collection equipment

working with a variety of professionals

taking and compiling statements

collecting and recording electronic evidence

protecting from contamination evidence including at least one of computer hard drives, recording media, flash drives, and digital and analogue recording and communications equipment

managing access and egress by establishing:

clear brief as to who has control of access

physical barriers

roster guards

limited entry to essential personnel

delegation of authority to control entry

record of all persons who enter or depart the scene

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.

legislative, policy and quality system context and requirements

details of scene features and use of a variety of specialised equipment

functions and roles of other professionals and experts

incident scene protection and preservation

indicators of need for specialised investigations

policies and procedures relating to recording details of persons

public safety and duty of care at incident scene