NTISthis.com

Evidence Guide: DEFFOR010 - Produce an electronic media image for forensic purposes

Student: __________________________________________________

Signature: _________________________________________________

Tips for gathering evidence to demonstrate your skills

The important thing to remember when gathering evidence is that the more evidence the better - that is, the more evidence you gather to demonstrate your skills, the more confident an assessor can be that you have learned the skills not just at one point in time, but are continuing to apply and develop those skills (as opposed to just learning for the test!). Furthermore, one piece of evidence that you collect will not usualy demonstrate all the required criteria for a unit of competency, whereas multiple overlapping pieces of evidence will usually do the trick!

From the Wiki University

 

DEFFOR010 - Produce an electronic media image for forensic purposes

What evidence can you provide to prove your understanding of each of the following citeria?

Determine job requirements

  1. Detect electronic evidence using observation techniques and appropriate technological methods.
  2. Isolate electronic evidence prior to examination.
  3. Identify recording methods to document the electronic evidence.
  4. Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.
Detect electronic evidence using observation techniques and appropriate technological methods.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Isolate electronic evidence prior to examination.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Identify recording methods to document the electronic evidence.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Image storage device

  1. Prepare storage device for imaging.
  2. Acquire image and check for accuracy by removing internal components from devices if appropriate.
  3. Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.
Prepare storage device for imaging.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Acquire image and check for accuracy by removing internal components from devices if appropriate.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Collect and package electronic evidence

  1. Collect electronic evidence so as to prevent contamination or loss.
  2. Package and store evidence to maintain continuity and prevent degradation or contamination.
  3. Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.
Collect electronic evidence so as to prevent contamination or loss.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Package and store evidence to maintain continuity and prevent degradation or contamination.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Determine job requirements

  1. Detect electronic evidence using observation techniques and appropriate technological methods.
  2. Isolate electronic evidence prior to examination.
  3. Identify recording methods to document the electronic evidence.
  4. Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.
Detect electronic evidence using observation techniques and appropriate technological methods.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Isolate electronic evidence prior to examination.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Identify recording methods to document the electronic evidence.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Image storage device

  1. Prepare storage device for imaging.
  2. Acquire image and check for accuracy by removing internal components from devices if appropriate.
  3. Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.
Prepare storage device for imaging.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Acquire image and check for accuracy by removing internal components from devices if appropriate.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Collect and package electronic evidence

  1. Collect electronic evidence so as to prevent contamination or loss.
  2. Package and store evidence to maintain continuity and prevent degradation or contamination.
  3. Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.
Collect electronic evidence so as to prevent contamination or loss.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Package and store evidence to maintain continuity and prevent degradation or contamination.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.

Completed
Date:

Teacher:
Evidence:

 

 

 

 

 

 

 

Assessed

Teacher: ___________________________________ Date: _________

Signature: ________________________________________________

Comments:

 

 

 

 

 

 

 

 

Instructions to Assessors

Evidence Guide

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Determine job requirements

1.1 Detect electronic evidence using observation techniques and appropriate technological methods.

1.2 Isolate electronic evidence prior to examination.

1.3 Identify recording methods to document the electronic evidence.

1.4 Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.

2. Image storage device

2.1 Prepare storage device for imaging.

2.2 Acquire image and check for accuracy by removing internal components from devices if appropriate.

2.3 Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.

3. Collect and package electronic evidence

3.1 Collect electronic evidence so as to prevent contamination or loss.

3.2 Package and store evidence to maintain continuity and prevent degradation or contamination.

3.3 Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.

Required Skills and Knowledge

ELEMENTS

PERFORMANCE CRITERIA

Elements describe the essential outcomes

Performance criteria describe the performance needed to demonstrate achievement of the element. Where bold italicised text is used, further information is detailed in the range of conditions section.

1. Determine job requirements

1.1 Detect electronic evidence using observation techniques and appropriate technological methods.

1.2 Isolate electronic evidence prior to examination.

1.3 Identify recording methods to document the electronic evidence.

1.4 Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.

2. Image storage device

2.1 Prepare storage device for imaging.

2.2 Acquire image and check for accuracy by removing internal components from devices if appropriate.

2.3 Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.

3. Collect and package electronic evidence

3.1 Collect electronic evidence so as to prevent contamination or loss.

3.2 Package and store evidence to maintain continuity and prevent degradation or contamination.

3.3 Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the candidate must demonstrate evidence of performance of the following on at least one occasion.

using analytical, decision-making and problem-solving skills in response to a range of electronic evidence contexts, including the systematic examination of items of electronic evidence

applying resource management and time management

applying exhibit handling skills

preserving continuity of evidence

using specialised evidence-recording equipment as required

collecting, packaging and preserving specific evidence types

adhering to operational safety

maximising the potential evidentiary value of the electronic evidence

Evidence required to demonstrate competence must satisfy all of the requirements of the elements and performance criteria. If not otherwise specified the depth of knowledge demonstrated must be appropriate to the job context of the candidate.

legislative, policy and quality system context

the range of techniques available for the recording, collection, packaging and preservation of electronic evidence

required forensic documentation for the recording and collection of electronic evidence

application and potential limitations of forensic investigative techniques

roles and functions of other forensic discipline specialists

WHS