Unit of competency Outline

Date retreived
23/07/2026 6:30 AM AWST

Whilst all efforts are made to provide accurate and timely information from the relevant source/documentation, please be aware that the information supplied may not be the most current version. The accuracy of the detail has not been confirmed by the Department and therefore should not be relied upon without first confirming the contents.

Produce an electronic media image for forensic purposes

Produce an electronic media image for forensic purposes

Unit of competency
National Code
DEFFOR010
State Code
AVR30
TGA Status
Replaced
DTWD Status
Replaced
Current Release Number
1.00
Current Release Date
22/10/2015
View on TGA
State Implementation and Classification
Approved Date
05/08/2016
Field of Education
019903 - Forensic Science
Original Release Date
05/08/2016
Nominal Hours
0
Description
This unit describes the skills required to employ a range of electronic media forensic methodologies to produce an image of a storage device. Storage devices may include hard disk drives, solid state drives, read-only memory (ROM), random-access memory (RAM), flash drives, tape drives, basic input/output system (BIOS) and USBs. Common objectives may include keyword searches, files recovery, including deleted files, extraction of registry information and metadata. Mobile devices such as mobile phones may afford additional information, including location, but require the use of specific methodologies.This unit applies to those working in the gathering and analysis of electronic information.The skills and knowledge described in this unit must be applied within the legislative, regulatory and policy environment in which they are carried out. Organisational policies and procedures must be consulted and adhered to, particularly those relating to WHS and the search and seizure of electronic evidence.Those undertaking this unit would work independently, with minimum of supervision, while performing complex tasks, including making complex judgements. They would use discretion and judgement and take responsibility for the quality of their outputs.No licensing, legislative or certification requirements apply to this unit at the time of publication.
Notes
Elements and Performance Criteria
1. Determine job requirements
  • 1.1 Detect electronic evidence using observation techniques and appropriate technological methods.
  • 1.2 Isolate electronic evidence prior to examination.
  • 1.3 Identify recording methods to document the electronic evidence.
  • 1.4 Determine most appropriate methodology to image the electronic evidence based on the information being sought and the actual process of analysis of the investigation.
2. Image storage device
  • 2.1 Prepare storage device for imaging.
  • 2.2 Acquire image and check for accuracy by removing internal components from devices if appropriate.
  • 2.3 Ensure image is sufficient in detail to allow all potential examinations and analyses to be carried out.
3. Collect and package electronic evidence
  • 3.1 Collect electronic evidence so as to prevent contamination or loss.
  • 3.2 Package and store evidence to maintain continuity and prevent degradation or contamination.
  • 3.3 Enter details of electronic evidence collected in case notes and, where appropriate, in the exhibit register to maintain the chain of custody.
No information
No information
Replaced By
State Code National Code Title Type
OEF52 DEFFOR021 Produce a digital media image for forensic purposes Unit of competency
State Code National Code Title Type
AXA1 DEF53115 Diploma of Electronic Forensics Qualification