Overview This standard covers capturing and preserving electronic evidence. It applies to work carried out in a laboratory, but may also be applied to the capturing of electronic evidence at the scene. The standard may relate to a criminal or civil investigation, or to due diligence and maintaining professional standards. The work described in this standard could also be carried out over a network. Performance criteria check that the necessary authorisations are in place You must be able to: conduct a preliminary risk assessment of the evidentially sound and safe capture of data from the source take appropriate action to safeguard the device and relevant information for the application of physical forensic examinations select the process and tools appropriate for the capture of electronic evidence ensure the preservation of third party and volatile data sources preserve the captured data to a suitable medium in line with local protocols keep an accurate contemporaneous record of the capture and preservation of electronic evidence using appropriate methods Knowledge and understanding You need to know and understand: legal and organisational requirements K1.1 relevant legislation, policies, procedures, codes of practice, guidelines and applicable standards for capturing and preserving electronic evidence K1.2 relevant legislation and other organisational requirements K1.3 the limits of your responsibility and level of competence K1.4 the impact of your actions on victims and witnesses capturing and preserving electronic evidence
Overview This standard covers capturing and preserving electronic evidence. It applies to work carried out in a laboratory, but may also be applied to the capturing of electronic evidence at the scene. The standard may relate to a criminal or civil investigation, or to due diligence and maintaining professional standards. The work described in this standard could also be carried out over a network. Performance criteria You must be able to: check that the necessary authorisations are in place conduct a preliminary risk assessment of the evidentially sound and safe capture of data from the source take appropriate action to safeguard the device and relevant information for the application of physical forensic examinations select the process and tools appropriate for the capture of electronic evidence ensure the preservation of third party and volatile data sources preserve the captured data to a suitable medium in line with local protocols keep an accurate contemporaneous record of the capture and preservation of electronic evidence using appropriate methods Knowledge and understanding You need to know and understand: legal and organisational requirements K1.1 relevant legislation, policies, procedures, codes of practice, guidelines and applicable standards for capturing and preserving electronic evidence K1.2 relevant legislation and other organisational requirements K1.3 the limits of your responsibility and level of competence K1.4 the impact of your actions on victims and witnesses capturing and preserving electronic evidence
SFJCO3.docx