NTISthis.com

Evidence Guide: ICTCYS607 - Acquire digital forensic data

Student: __________________________________________________

Signature: _________________________________________________

Tips for gathering evidence to demonstrate your skills

The important thing to remember when gathering evidence is that the more evidence the better - that is, the more evidence you gather to demonstrate your skills, the more confident an assessor can be that you have learned the skills not just at one point in time, but are continuing to apply and develop those skills (as opposed to just learning for the test!). Furthermore, one piece of evidence that you collect will not usualy demonstrate all the required criteria for a unit of competency, whereas multiple overlapping pieces of evidence will usually do the trick!

From the Wiki University

 

ICTCYS607 - Acquire digital forensic data

What evidence can you provide to prove your understanding of each of the following citeria?

Confirm incident and prepare to acquire data

  1. Confirm and gather initial information on reported incident according to organisational policies and procedures
  2. Research and assess occurrence according to organisational forensic data extraction requirements
  3. Research and identify all laws and legislation required for data extraction tasks
  4. Discuss and confirm if acquisition is required with required personnel
  5. Consult and gather key incident information from required personnel
  6. Identify device and components pertaining to incident according to task requirements
  7. Develop and document data extraction plan and information gathered according to organisational requirements
  8. Submit documentation to required personnel and seek and respond to feedback
  9. Contact and gather information from required personnel
  10. Seize device pertaining to incident according to incident and legislation
  11. Access and open device according to data extraction task requirements
  12. Secure device’s networks, data logs, firewalls and hashing according to task requirements
  13. Initiate data extraction according to task requirements and confirm that no data is tampered or deleted
  14. Confirm completion of retrieval according to task requirements
  15. Verify the hash according to task requirements
  16. Document observations and findings and methodology
  17. Analyse data and verify against incident scope, information, devices and evidence
  18. Document findings and analysis and submit to required personnel
  19. Discuss abnormalities and confirm further evidence, devices and information needed
  20. Make additional extractions according to task and technical requirements
  21. Analyse network conversations according to task requirements
  22. Verify chain of custody according to hash according to task requirements
  23. Update findings and methodology in documentation according to organisational needs
Confirm and gather initial information on reported incident according to organisational policies and procedures

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Research and assess occurrence according to organisational forensic data extraction requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Research and identify all laws and legislation required for data extraction tasks

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Discuss and confirm if acquisition is required with required personnel

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Consult and gather key incident information from required personnel

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Identify device and components pertaining to incident according to task requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Develop and document data extraction plan and information gathered according to organisational requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Submit documentation to required personnel and seek and respond to feedback

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Contact and gather information from required personnel

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Seize device pertaining to incident according to incident and legislation

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Access and open device according to data extraction task requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Secure device’s networks, data logs, firewalls and hashing according to task requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Initiate data extraction according to task requirements and confirm that no data is tampered or deleted

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Confirm completion of retrieval according to task requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Verify the hash according to task requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Document observations and findings and methodology

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Analyse data and verify against incident scope, information, devices and evidence

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Document findings and analysis and submit to required personnel

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Discuss abnormalities and confirm further evidence, devices and information needed

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Make additional extractions according to task and technical requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Analyse network conversations according to task requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Verify chain of custody according to hash according to task requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Update findings and methodology in documentation according to organisational needs

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Finalise data acquisition

  1. Prepare data extracts and documentation for submission according to organisational and legislative requirements
  2. Submit data extracts and analysis according to organisational and legislative requirements
  3. Retrieve sign off from required personnel and gather feedback according to organisational policies and procedures
Prepare data extracts and documentation for submission according to organisational and legislative requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Submit data extracts and analysis according to organisational and legislative requirements

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Retrieve sign off from required personnel and gather feedback according to organisational policies and procedures

Completed
Date:

Teacher:		 Evidence:

 

 

 

 

 

 

 

Assessed

Teacher: ___________________________________ Date: _________

Signature: ________________________________________________

Comments:

 

 

 

 

 

 

 

 

Instructions to Assessors

Required Skills and Knowledge

The candidate must demonstrate the ability to complete the tasks outlined in the elements, performance criteria and foundation skills of this unit, including evidence of the ability to:

identify, acquire and analyse digital forensic data from at least three device types, according to a reported incident.

In the course of the above, the candidate must:

document analysis findings

adhere to required organisational and legislative guidelines.

The candidate must be able to demonstrate knowledge to complete the tasks outlined in the elements, performance criteria and foundation skills of this unit, including knowledge of:

industry standard legislation and organisational procedures relating to acquiring digital forensic data, including

privacy standards and policies

data standards and policies

internet and user identification protocols

mobile technology protocols

data extraction methodologies and seizure techniques on a variety of devices, including how not to damage or destroy digital evidence

features and markers of hashing

communication investigation techniques

functions and features of computer systems and data stores

data logs, including server, network and firewall logs

function and features of system back ups

data extraction and forensic copying techniques

file formats including structures, locations and file systems

data acquisition, identification and extraction methodologies including:

industry standard forensic tools

non-invasive and invasive methodologies.