How To Become A Forensic Technician

Transcription

1 PERSON SPECIFICATION Area: EMSOU Job Title: Digital Forensic Technician Weekly Hours: Section: CCU Scale: SO2 Version: V1 Post No: HP083 Status: Substantive Version Date: 37 January 2014 Please describe, with example(s) in section 7 of your application form how you feel you meet each of the numbered essential criteria, and where possible the desirable criteria, below. Criteria Justifiable as necessary for safe and effective performance of the job. Education: Essential A clear definition of the necessary criteria. 1. Educated to degree level in a computer forensic discipline or demonstrate equivalent work experience at this level 2. Use and Knowledge of Industry forensic software for example ENCASE, FTK or other forensic tools Desirable Where available, elements that contribute to improved / immediate performance in the job. Accredited certification in forensic software such as EnCE (EnCase) and ACE (FTK)

2 Work Candidates must demonstrate: - Working knowledge of the Computer Experience: Misuse Act, Data Protection Act. 3. Significant experience in the use of a wide range of IT systems gained in support, development or forensics role combined with a good understanding of digital Forensic techniques. 4. Experience of working alone and in a team, within a customer focused environment, whilst utilising ones own initiative with a proven record of discretion and integrity in a confidential environment To have an understanding of operational Police work and to be able to prepare written statements suitable for court purposes. Good working knowledge of Office based software Good understanding of advanced digital forensic recovery techniques

3 Personal / Candidates must demonstrate: - Interpersonal Skills, Aptitudes: 5. The ability to communicate effectively (both written and verbal) technical issues to non technical staff both within the Police Service and to external organisations with the ability to pay attention to detail with a methodical approach to problem solving. Previous experience of the creation and delivery of presentations to varied audiences. Previous experience of presenting evidence in a Court of law. Demonstrate knowledge in covert techniques in relation to digital forensics 6. The ability to be able to deal professionally with images of an unpleasant and/or disturbing nature and produce comprehensive, intelligible reports 7. Apply methodical approach to problem solving and be able to evaluate, prioritise and respond to changing operational situations with the ability to rapidly absorb new technical information as and when required. With The ability to work to strict procedures and protocols, (with confidence), in order to identify and recommend improvements where necessary. 8. Full clean driving licence reasonable adjustments will be considered for candidates who, (because of disabilities), cannot meet this requirement

4 Special Skills: 9. A flexible approach to working hours, willing to react to duty changes at short notice 10. Show initiative and make time available to ensure technical competencies and expertise are kept up to date with industrial developments. 11. The ability to adapt to new emergent technology within the e-forensic arena Experience of working with mobile phone technology. Experience of Web site design and development. Demonstrate specific skills in one or more key technologies (oracle, SQL Server, Linux/Unix, NT4, Windows 2000, Windows XP, Java, HTLM, IIS or Exchange)

5 ROLE DESCRIPTION Job title: Post no: Scale: Responsible to: Responsible for: Contacts: Role: Duties Digital Forensic Technician HP083 SO2 ACCU Supervisor (currently Detective Sergeant) No staff directly supervised Police officers and police staff, Senior officers of the EMSOU and regional forces, outside agencies, CPS, other members of the force, external law enforcement agencies, and force/regional staff. Involving the use of forensic applications to identify and recover evidence held on computer hard drives, mobile telephones and other digital media which have been seized during criminal investigations. Any data recovered, to be forensically analysed using appropriate forensic techniques and finding contemporaneously documented. Provide tactical advice to operational commander during active proactive operations. Responsibilities

6 Operational: Provide a level of expertise in search and crime scenes in respect of the recovery of computer equipment and information. Carry out forensic examination and enhancement of analogue and digital storage media and, (where applicable) secure, retrieve and report on data (audio, video and computer files) in accordance with national guidelines, utilising proprietary and bespoke software. Process the recovered data into a form suitable for investigators to examine for evidential content. Advise and give guidance to interviewers on questions to be asked and the validity of answers given when interviewing suspects, explore potential weaknesses in statements to assist officers in obtaining evidence in their investigations. Participate in interviews as part of interview team as appropriate. Prepare reports and statements of evidence in respect of completed cases and attend court or other statutory hearing as a witness as and when required. Maintain an efficient case management system ensuring that a record of progress is updated at regular intervals. Attend training courses to give instruction on matters related to High Tech Crime Investigations and the recovery of digital evidence. To engage with both internal and external agencies in order to deliver training, awareness and advice as and when required. Liaise with other e-forensic organisations from both police and other agencies to exchange information thereby ensuring best practice and avoiding duplication of effort. Update and maintain knowledge through training, current case law, procedural rulings and developments concerning computer crime activity and computer security issues. Carry out scene deployments as and when required to preserve, record, photograph and recover forensic evidence as designated. Carry out virtual reconstructions of major crime scenes and injuries to further the information using specialist software and tools. Take responsibility for the maintenance of all tools and equipment utilised within the role whilst working within accepted Health and Safety working practices. Undertake any other task which reasonably corresponds to the general nature and character of the post and is commensurate with its level of responsibility Communication: Present evidence in court in a clear and intelligible manner. Produce comprehensive reports both verbal and written relating to data recovered from computers and other digital media investigations.

7 Administration: Develop and maintain specialised and up to date technical knowledge of both general and forensic computer procedures, keeping abreast of developments within the computer industry in order to secure the success of future investigations and the development of the Unit. General Actively promote equality of opportunity, work towards eliminating discrimination and promote good relations between all groups of people Undertake such other duties commensurate with the post as may be required for the safe and effective performance of the job. This role description should develop along with the changing demands of policing reflected in Force Objectives and priorities Be flexible in terms of working location and be prepared to work temporarily at other locations within the Force area, undertaking a similar role Additional Information: Security Check Level: (strikethrough checks NOT required) Additional Information: RV, SC, EV1, DV, NPPV1, NPPV2, NPPV3 Contract Type: Permanent Training Requirements: None Car User: Yes / No.Yes Allowance {per mile / day etc}: Casual Budgetary Management: Yes / No.NO Authority to Value: People Management: Yes / No.NO Total Number & Level: Post Funding Method: Established post Owner/source of Funding: SSU salaries budget IT Systems Required: Windows NT, Microsoft Office, Outlook/ , Internet explorer (external access to WWW)

8 LEICESTERSHIRE POLICE RISK ASSESSMENT FORM HS2 AREA/DEPT.: DATE COMPLETED: REVIEWED LOCATION/WORK ACTIVITY (GROUP OR INDIVIDUAL POST) ASSESSED: SPECIAL GROUPS OF PERSONS CONSIDERED: COMPLETED BY (Risk Assessor): AUTHORISED BY: ASSISTED BY: REMEDIAL ACTION PRIORITY ORDER Date Number Completed Initials No. WORK ACTIVITY HAZARD LIKELIHOOD RISK Description of task Description including potential severity H M L Groups Exposed. Evidence of previous harm. Existing Controls in place? H M L Hazards x Likelihood Form No: RES-5020 Date Created: 05/02/07 Version: 1.0 Leicestershire Police Confidential