We use cookies to provide social media features and to analyse our traffic. See more about our use of cookies.

Institute for Apprenticeships and Technical Education logo

Digital forensic technician

Key information

  1. Status: Approved for delivery
  2. Reference: ST1343
  3. Version: 1.0
  4. Level: 4
  5. Typical duration to gateway: 24 months
  6. Typical EPA period: 3 months
  7. Maximum funding: £18000
  8. Route: Digital
  9. Date updated: 01/03/2023
  10. Approved for delivery: 1 March 2023
  11. Lars code: 702
  12. EQA provider: Ofqual
  13. Review:

    This apprenticeship standard will be reviewed after three years

Print apprenticeship summary

Apprenticeship summary

Overview of the role

Support the appropriate capture, preservation, and initial processing of digital evidence.

Occupation summary

This occupation is found in all organisations that require a digital investigation/analysis of devices. These roles can be found in different public and private sector bodies and organisations that include digital forensics and criminal investigations within their service delivery. There is a significant demand on policing to examine digital devices making this a primary service offered by forensic service providers to policing. Within the public sector across the UK (and international) broader than just policing bodies this role is relevant to Security and Defence teams including the National Crime Agency, Ministry of Defence, Border Force, and other aspects of the Criminal Justice System. Private forensic service providers service all public sector requirements for device examinations as well as other investigation types not just criminal. Including internal corporate and intellectual property theft investigations. These companies vary in size and breadth of digital capability. This role works independently but with the support of other team members within an organisation that will vary in size. They are expected to work with investigators to formulate strategies. Some examiners will work in a police station or other government building, private sector examiners will work in a secure building.

The broad purpose of the occupation is for a Digital Forensic Technician to support the appropriate capture, preservation, and initial processing of digital evidence. They will provide triage and early decision-making for criminal investigations that will ensure the integrity of any digital evidence. This technical knowledge would apply to a range of digital material primarily from mobile devices and computer peripherals. Once experienced they will also apply this knowledge to identifying digital items suitable for further analysis utilising an appropriate technical method providing advice and support about the detection, preservation, seizure, gathering and processing of digital material. This role supports a range of case types that emphasis the need for individuals to have the ability to adapt and conduct dynamic risk assessments. Cases could include ‘live’ incidents, laboratory submissions, and in other proactive and/or reactive investigations where digital technology and data acquisition opportunities exist. The titles of the roles may vary across different organisations including police forces, but the core skills required of the role remain the same. This is an entry level role into Digital Forensics where the role develops the principles of digital device examinations whilst ensuring the data chain of custody for evidential use. Other roles will provide the more complex decision making and problem-solving aspects of the discipline. Individuals will work flexibly within an organisation utilising a range of standard tools and equipment. This maybe office based or more mobile/operational depending on the role/organisation. There is a requirement that this role will always be expected to adhere to relevant Health and Safety, for example wearing personal protective equipment and appropriate handling of electrical equipment. This role introduces a level of autonomy once the initial training is complete, to examine devices, but they would always have associated team support when required. The size of this team can vary depending on the organisation. They could be expected to work with investigators and broader investigation teams especially within an operational setting. The location they work will vary with some expected to work flexibly across several settings including at a crime scene, in a police force building or laboratory whereas commercial providers may offer a more conventional office environment. Some digital forensic departments are accredited laboratories, so individuals will be trained to understand the limitations and expectations of work within an accredited environment. Statement writing is expected of individuals working in the criminal justice system including court room training and report writing included. The role holder will be expected to monitor their own wellbeing with the aid of a range of tools including management support. The nature of digital forensic activities can often focus on high risk and harm cases, as such individuals need to be prepared that inevitably this role could be exposed to potentially distressing or upsetting digital data.

In their daily work, an employee in this occupation interacts with their local forensics team. This will include a clear reporting structure above this role including practitioners, team leaders or manager, and specialists. They will be part of regular conversations with supervisors/managers to identify ways to improve and receive support to achieve internal performance indicators and expectations. The investigative requirements of the role mean that all examiners would interact with a range of roles included in an investigation and/or forensics leads. They will also work with other team members within the department assisting others, sharing ideas, and conveying technical knowledge. Some organisations would also require them to present their findings at court, hearings/ tribunals and/or work with other experts. They may also work with legal teams including solicitors and barristers.

An employee in this occupation will be responsible for their own workload, being expected to technically problem solve and prioritise there time effectively. This would include planning their own working day. Utilising digital forensic capture tools. These are specialist capability tools designed to meet the expectations of processing material whilst ensuring evidential integrity and data management/extraction. Consideration would be given to ensuring all data handling meets the requirements of General Data Protection Regulations, Data protection: The Data Protection Act - GOV.UK (www.gov.uk) and appropriate forensic legislation for example Authorised Professional Practice, Extraction of material from digital devices (college.police.uk). It is a task driven role that will predominantly work to local or national standard operating procedures and quality standards. They are responsible for recognising the limitations of their competence and escalate activity if additional evidence is discovered or expertise is needed. They would need to be able to produce notes to an evidential standard that would support witness statement or report writing, replication by another suitably trained person, and court attendance if necessary. Take all reasonable steps to maintain and develop professional competence, taking account of material research and developments within the relevant field. The role requires security vetting and an expectation to work to an ethical framework, professional policing standards and Forensic Science Regulator Codes of Practice and Conduct. Forensic science providers: codes of practice and conduct - GOV.UK (www.gov.uk).

Typical job titles include:

Computer examiner Data forensic technician Data forensic technician Digital evidence technician Digital forensic technician Digital investigation technician Mobile device examiner Triage technician

Duties

  • Duty 1 Apply an understanding of the principles of digital forensics and how they support the criminal justice process.
  • Duty 2 Use approved scientific methodology and rationale to support investigations also providing advice as to whether further specialist digital support may be required.
  • Duty 3 Ensure the appropriate capture and preservation techniques for digital forensic material applying standard methodology and utilising appropriate forensic science technology for digital examinations (specific tool training may be required).
  • Duty 4 Handle exhibits and evidential material in line with agreed protocols to ensure the integrity, continuity, and security of digital evidence for the purpose of investigative processing and court proceedings.
  • Duty 5 Produce evidential contemporaneous notes, reports (including Streamlined Forensic reporting) for disclosure purposes, continuity statements for attending court, tribunals and hearings as required in support of the investigative process.
  • Duty 6 Use specialist technical equipment within a laboratory, at a crime scene or other appropriate location to conduct forensic examination’s. Ensuring handling, transport, storage, and environmental factors are all considered.
  • Duty 7 To work within a quality-controlled environment aligning to standard operating policies and procedures whilst also carrying out technical quality checks, and peer reviews at a comparable competency level.
  • Duty 8 Apply an understanding of other physical forensic evidence whilst conducting digital investigative decisions to ensure the preservation of evidence.
  • Duty 9 Uphold organisational minimum standards with regards to equipment testing, fault finding and maintenance according to agreed schedules and in line with quality standards and investigative needs to ensure appropriate health and safety considerations, the use of PPE and awareness of potential biohazards are all considered as part of the examination process.
  • Duty 10 Operate in a safe, lawful and ethical manner when dealing with digital devices and personal information giving due consideration to wellbeing working practices when processing sensitive or potentially distressing content.
  • Duty 11 Following risk assessments; local, national and on digital forensics and crime scenes activities from multiple agencies to ensure the integrity of digital evidence.
  • Duty 12 Liaison with colleagues from a variety of disciplines both external and internal to the organisation exercising responsibility for work within defined parameters. Acts in a professional and ethical manner, embracing equality, diversity and inclusion in the workplace.

Apprenticeship summary

ST1343, digital forensic technician level 4

This is a summary of the key things that you – the apprentice and your employer need to know about your end-point assessment (EPA). You and your employer should read the EPA plan for the full details. It has information on assessment method requirements, roles and responsibilities, and re-sits and re-takes.

What is an end-point assessment and why it happens

An EPA is an assessment at the end of your apprenticeship. It will assess you against the knowledge, skills, and behaviours (KSBs) in the occupational standard. Your training will cover the KSBs. The EPA is your opportunity to show an independent assessor how well you can carry out the occupation you have been trained for.

Your employer will choose an end-point assessment organisation (EPAO) to deliver the EPA. Your employer and training provider should tell you what to expect and how to prepare for your EPA.

The length of the training for this apprenticeship is typically 24 months. The EPA period is typically 3 months.

The overall grades available for this apprenticeship are:

  • fail
  • pass
  • distinction

When you pass the EPA, you will be awarded your apprenticeship certificate.

EPA gateway

The EPA gateway is when the EPAO checks and confirms that you have met any requirements required before you start the EPA. You will only enter the gateway when your employer says you are ready.

The gateway requirements for your EPA are:

  • achieved English and mathematics qualifications in line with the apprenticeship funding rules
  • for the professional discussion, you must submit a portfolio of evidence



Assessment methods


Observation with questions

You will be observed by an independent assessor completing your work. It will last at least 7 hours. They will ask you at least 5 questions.


Professional discussion underpinned by a portfolio of evidence

You will have a professional professional discussion with an independent assessor. It will last 90 minutes. They will ask you at least 8 questions. The questions will be about certain aspects of your occupation. You need to compile a portfolio of evidence before the EPA gateway. You can use it to help answer the questions.

The EPAO will confirm where and when each assessment method will take place.

Who to contact for help or more information

You should speak to your employer if you have a query that relates to your job.

You should speak to your training provider if you have any questions about your training or EPA before it starts.

You should receive detailed information and support from the EPAO before the EPA starts. You should speak to them if you have any questions about your EPA once it has started.


Reasonable adjustments

If you have a disability, a physical or mental health condition or other special considerations, you may be able to have a reasonable adjustment that takes this into account. You should speak to your employer, training provider and EPAO and ask them what support you can get. The EPAO will decide if an adjustment is appropriate.


Professional recognition

This apprenticeship aligns with BCS - Chartered Institute for IT for Professional Registration

Please contact the professional body for more details.

Print occupational standard

Details of the occupational standard

Occupation summary

This occupation is found in all organisations that require a digital investigation/analysis of devices. These roles can be found in different public and private sector bodies and organisations that include digital forensics and criminal investigations within their service delivery. There is a significant demand on policing to examine digital devices making this a primary service offered by forensic service providers to policing. Within the public sector across the UK (and international) broader than just policing bodies this role is relevant to Security and Defence teams including the National Crime Agency, Ministry of Defence, Border Force, and other aspects of the Criminal Justice System. Private forensic service providers service all public sector requirements for device examinations as well as other investigation types not just criminal. Including internal corporate and intellectual property theft investigations. These companies vary in size and breadth of digital capability. This role works independently but with the support of other team members within an organisation that will vary in size. They are expected to work with investigators to formulate strategies. Some examiners will work in a police station or other government building, private sector examiners will work in a secure building.

The broad purpose of the occupation is for a Digital Forensic Technician to support the appropriate capture, preservation, and initial processing of digital evidence. They will provide triage and early decision-making for criminal investigations that will ensure the integrity of any digital evidence. This technical knowledge would apply to a range of digital material primarily from mobile devices and computer peripherals. Once experienced they will also apply this knowledge to identifying digital items suitable for further analysis utilising an appropriate technical method providing advice and support about the detection, preservation, seizure, gathering and processing of digital material. This role supports a range of case types that emphasis the need for individuals to have the ability to adapt and conduct dynamic risk assessments. Cases could include ‘live’ incidents, laboratory submissions, and in other proactive and/or reactive investigations where digital technology and data acquisition opportunities exist. The titles of the roles may vary across different organisations including police forces, but the core skills required of the role remain the same. This is an entry level role into Digital Forensics where the role develops the principles of digital device examinations whilst ensuring the data chain of custody for evidential use. Other roles will provide the more complex decision making and problem-solving aspects of the discipline. Individuals will work flexibly within an organisation utilising a range of standard tools and equipment. This maybe office based or more mobile/operational depending on the role/organisation. There is a requirement that this role will always be expected to adhere to relevant Health and Safety, for example wearing personal protective equipment and appropriate handling of electrical equipment. This role introduces a level of autonomy once the initial training is complete, to examine devices, but they would always have associated team support when required. The size of this team can vary depending on the organisation. They could be expected to work with investigators and broader investigation teams especially within an operational setting. The location they work will vary with some expected to work flexibly across several settings including at a crime scene, in a police force building or laboratory whereas commercial providers may offer a more conventional office environment. Some digital forensic departments are accredited laboratories, so individuals will be trained to understand the limitations and expectations of work within an accredited environment. Statement writing is expected of individuals working in the criminal justice system including court room training and report writing included. The role holder will be expected to monitor their own wellbeing with the aid of a range of tools including management support. The nature of digital forensic activities can often focus on high risk and harm cases, as such individuals need to be prepared that inevitably this role could be exposed to potentially distressing or upsetting digital data.

In their daily work, an employee in this occupation interacts with their local forensics team. This will include a clear reporting structure above this role including practitioners, team leaders or manager, and specialists. They will be part of regular conversations with supervisors/managers to identify ways to improve and receive support to achieve internal performance indicators and expectations. The investigative requirements of the role mean that all examiners would interact with a range of roles included in an investigation and/or forensics leads. They will also work with other team members within the department assisting others, sharing ideas, and conveying technical knowledge. Some organisations would also require them to present their findings at court, hearings/ tribunals and/or work with other experts. They may also work with legal teams including solicitors and barristers.

An employee in this occupation will be responsible for their own workload, being expected to technically problem solve and prioritise there time effectively. This would include planning their own working day. Utilising digital forensic capture tools. These are specialist capability tools designed to meet the expectations of processing material whilst ensuring evidential integrity and data management/extraction. Consideration would be given to ensuring all data handling meets the requirements of General Data Protection Regulations, Data protection: The Data Protection Act - GOV.UK (www.gov.uk) and appropriate forensic legislation for example Authorised Professional Practice, Extraction of material from digital devices (college.police.uk). It is a task driven role that will predominantly work to local or national standard operating procedures and quality standards. They are responsible for recognising the limitations of their competence and escalate activity if additional evidence is discovered or expertise is needed. They would need to be able to produce notes to an evidential standard that would support witness statement or report writing, replication by another suitably trained person, and court attendance if necessary. Take all reasonable steps to maintain and develop professional competence, taking account of material research and developments within the relevant field. The role requires security vetting and an expectation to work to an ethical framework, professional policing standards and Forensic Science Regulator Codes of Practice and Conduct. Forensic science providers: codes of practice and conduct - GOV.UK (www.gov.uk).

Typical job titles include:

Computer examiner Data forensic technician Data forensic technician Digital evidence technician Digital forensic technician Digital investigation technician Mobile device examiner Triage technician

Occupation duties

Duty KSBs

Duty 1 Apply an understanding of the principles of digital forensics and how they support the criminal justice process.

K1 K2 K3 K4 K7

S1 S7 S9

B4 B6

Duty 2 Use approved scientific methodology and rationale to support investigations also providing advice as to whether further specialist digital support may be required.

K1 K3 K4 K5 K6 K8 K14 K15

S2 S3 S5 S9 S22

B1 B3

Duty 3 Ensure the appropriate capture and preservation techniques for digital forensic material applying standard methodology and utilising appropriate forensic science technology for digital examinations (specific tool training may be required).

K2 K3 K5 K6 K7 K8 K9 K12 K17 K20

S2 S3 S4 S5 S6 S7 S9 S10 S11 S12 S13 S17 S22

B1 B3 B7

Duty 4 Handle exhibits and evidential material in line with agreed protocols to ensure the integrity, continuity, and security of digital evidence for the purpose of investigative processing and court proceedings.

K1 K6 K10

S2 S3 S4 S7 S15 S16 S18

B1 B3

Duty 5 Produce evidential contemporaneous notes, reports (including Streamlined Forensic reporting) for disclosure purposes, continuity statements for attending court, tribunals and hearings as required in support of the investigative process.

K1 K4 K6 K10 K13 K20

S1 S2 S3 S7 S8 S17 S18

B1 B2 B3 B7

Duty 6 Use specialist technical equipment within a laboratory, at a crime scene or other appropriate location to conduct forensic examination’s. Ensuring handling, transport, storage, and environmental factors are all considered.

K2 K5 K6 K7 K8 K9 K11

S2 S3 S4 S6 S9 S11 S12 S13 S22

B3

Duty 7 To work within a quality-controlled environment aligning to standard operating policies and procedures whilst also carrying out technical quality checks, and peer reviews at a comparable competency level.

K3 K5 K6 K14 K15

S1 S2 S7

B3

Duty 8 Apply an understanding of other physical forensic evidence whilst conducting digital investigative decisions to ensure the preservation of evidence.

K2 K4 K5 K6 K7 K10 K11 K12

S2 S3 S5 S6 S9 S15 S16

B3 B4

Duty 9 Uphold organisational minimum standards with regards to equipment testing, fault finding and maintenance according to agreed schedules and in line with quality standards and investigative needs to ensure appropriate health and safety considerations, the use of PPE and awareness of potential biohazards are all considered as part of the examination process.

K3 K6 K8 K9 K14 K15 K16

S2 S3 S7 S9 S10 S11 S12 S13 S19

B6

Duty 10 Operate in a safe, lawful and ethical manner when dealing with digital devices and personal information giving due consideration to wellbeing working practices when processing sensitive or potentially distressing content.

K6 K8 K10 K11 K16 K17

S2 S3 S4 S5 S6 S10 S13 S14 S15 S21 S22

B1 B3 B5

Duty 11 Following risk assessments; local, national and on digital forensics and crime scenes activities from multiple agencies to ensure the integrity of digital evidence.

K6 K7 K9 K16

S2 S3 S15 S19 S20

B3 B6

Duty 12 Liaison with colleagues from a variety of disciplines both external and internal to the organisation exercising responsibility for work within defined parameters. Acts in a professional and ethical manner, embracing equality, diversity and inclusion in the workplace.

K1 K3 K13 K18 K19

S2 S5 S6 S8 S21 S22

B1 B2 B5 B7


KSBs

Knowledge

K1: The DFT role and how it contributes to investigations and the criminal justice process. Back to Duty

K2: What are the considerations for maximising evidential capture and sequencing. Back to Duty

K3: Forensic science regulators codes of practice and activities. Back to Duty

K4: The digital forensics terminology. Back to Duty

K5: Standard operating procedures to a dynamic operational environment. Back to Duty

K6: Make appropriate decisions of how to progress devices through the evidential process utilising local procedures. Back to Duty

K7: The national good practise guidance for the capture and preservation of digital evidence (For example the ACPO principles and NPCC Good Practises Advice manual). Back to Duty

K8: The workings, principles and relevant use of a range of digital devices, peripherals and associated operating systems relevant to their role in digital forensics. Back to Duty

K9: Functions, features, and limitations of digital forensics tools, components and software. Back to Duty

K10: Evidence management, continuity and integrity of evidence and how it relates to investigations. Back to Duty

K11: Different forensic working environments and understand how to select and utilise forensic tools appropriate to the circumstances. Back to Duty

K12: What other forensic evidence types can be recovered from devices and the best methods and sequence for evidential capture and preservation. Back to Duty

K13: Different ways of recording and presenting relevant investigative information (reports, contemporaneous notes/statement writing) and how they should be appropriately used and presented. Back to Duty

K14: The principles of working in a quality controlled setting. To include; knowledge of appropriate accreditation bodies, the quality management process/system and individual legal entities, individual expectations of working in a quality controlled environment. Back to Duty

K15: Quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review, and how to navigate this information. Back to Duty

K16: The health & safety procedures/legislation. Organisational sustainability procedures. Back to Duty

K17: The risks of processing sensitive or potentially distressing content while understanding the benefits of good wellbeing working practices. Back to Duty

K18: Awareness of the impact of diversity and inclusion such as on teamwork, client relationships and organisational strategies. Back to Duty

K19: Understand the requirements for continual professional development within the industry. Back to Duty

K20: Procedures for capturing and preserving evidence. Back to Duty

Skills

S1: Use appropriate terminology defined by the forensic science regulator and included in standard operating procedures. Back to Duty

S2: Standard operating procedures for a range of digital forensic capture and preservation processes. Back to Duty

S3: Apply standard methodology in a safe and effective way while working in operational environments. Back to Duty

S4: Demonstrate confidentiality, integrity, and availability limitations of secure devices and best practice methods for preserving evidence. Back to Duty

S5: Implement limitations of competency and authority and escalate when necessary. Back to Duty

S6: Considered decision making. Back to Duty

S7: Adhere to powers of seizure/examinations and legislation. Demonstrate compliance with this through the appropriate use of standard forms. Back to Duty

S8: Adopt communication methods suitable for audience. Using technical language where appropriate. Back to Duty

S9: Identify, set up and use a range hardware components and devices. Back to Duty

S10: Demonstrate correct use of write blocking techniques. Back to Duty

S11: Manage applications software relevant to the role. Back to Duty

S12: Show an ability to troubleshoot real-world device and network issues effectively and diagnosing and correcting common software, hardware, or connectivity problems. Back to Duty

S13: Use features and functions of common specialist digital forensic tools and software. Selecting based on suitability. Back to Duty

S14: Understanding the responsibilities of data management. Back to Duty

S15: Provide preservation advice for physical evidence (DNA, fingerprints) for new digital exhibits, taking into account anticontamination and cross contamination. Back to Duty

S16: Apply continuity of evidence and appropriate recording of a chain of custody for an exhibit for disclosure purposes. Back to Duty

S17: Produce notes documenting activity undertaken during the capture and preservation processes; including the appropriate use of digital evidence/case management systems. Back to Duty

S18: Produce evidential continuity witness statements and demonstrate how to present in a courtroom. Back to Duty

S19: Navigate and inform a quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review. Back to Duty

S20: Conducting dynamic risk assessments, taking into account the safety of all parties and using PPE. Back to Duty

S21: Apply strategies to develop personal resilience and maintain welling, know how to access organisational support mechanisms. Back to Duty

S22: Process technical information effectively and accurately to provide critical thinking to issues and problems. Back to Duty

Behaviours

B1: Acts in an ethical and professional manner in the workplace. Back to Duty

B2: Builds and maintains positive relationships with colleagues, customers and suppliers. Back to Duty

B3: Takes an organised and methodical approach to their work and scrutinises own objectivity. Back to Duty

B4: Takes personal responsibility for developing knowledge and skills and continually seeks to improve their performance. Back to Duty

B5: Commitment to develop personal resilience and maintain wellbeing. Back to Duty

B6: Sustainable practices and challenge unsustainable practices. Back to Duty

B7: Support an inclusive culture and treat colleagues and external stakeholders fairly and with respect without bias or discrimination. Back to Duty


Qualifications

English and Maths

Apprentices without level 2 English and maths will need to achieve this level prior to taking the End-Point Assessment. For those with an education, health and care plan or a legacy statement, the apprenticeship’s English and maths minimum requirement is Entry Level 3. A British Sign Language (BSL) qualification is an alternative to the English qualification for those whose primary language is BSL.

Professional recognition

This standard aligns with the following professional recognition:

  • BCS - Chartered Institute for IT for Professional Registration
Print EPA plan

End-point assessment plan

V1.0

Introduction and overview

This document explains the requirements for end-point assessment (EPA) for the digital forensic technician apprenticeship. End-point assessment organisations (EPAOs) must follow this when designing and delivering the EPA.

Digital forensic technician apprentices, their employers and training providers should read this document.

An approved EPAO must conduct the EPA for this apprenticeship. Employers must select an approved EPAO from the Education and Skills Funding Agency’s Register of end-point assessment organisations (RoEPAO).

A full-time apprentice typically spends 24 months on-programme (this means in training before the gateway) working towards competence as a digital forensic technician. All apprentices must spend at least 12 months on-programme. All apprentices must complete the required amount of off-the-job training specified by the apprenticeship funding rules.

This EPA has 2 assessment methods.

The grades available for each assessment method are:

Assessment method 1 - observation :

  • fail
  • pass

Assessment method 2 - professional discussion:

  • fail
  • pass
  • distinction

The result from each assessment method is combined to decide the overall apprenticeship grade. The following grades are available for the apprenticeship:

  • fail
  • pass
  • distinction

EPA summary table

On-programme (typically 24 months)
The apprentice must complete training to develop the knowledge, skills and behaviours (KSBs) of the occupational standard.

The apprentice must complete training towards English and maths qualifications in line with the apprenticeship funding rules.

The apprentice must compile a portfolio of evidence.

End-point assessment gateway
The employer must be content that the apprentice is working at or above the occupational standard.

The apprentice’s employer must confirm that they think the apprentice:

  • is working at or above the occupational standard as a digital forensic technician
  • has the evidence required to pass the gateway and is ready to take the EPA

The apprentice must have achieved English and maths qualifications in line with the apprenticeship funding rules.

For the professional discussion the apprentice must submit a Portfolio of evidence.

The apprentice must submit any policies and procedures as requested by the EPAO.

End-point assessment (typically 3 months)
Grades available for each assessment method:

Observation

  • fail
  • pass

Professional discussion

  • fail
  • pass
  • distinction

Overall EPA and apprenticeship can be graded:

    • fail
    • pass
    • distinction
Professional recognition
This apprenticeship aligns with BCS - Chartered Institute for IT for Professional Registration

The apprenticeship will either wholly or partially satisfy the requirements for registration at this level.





Re-sits and re-takes



  • Re-take and re-sit grade cap: pass
  • Re-sit timeframe: typically 1 months
  • Re-take timeframe: typically 6 months

Duration of end-point assessment period

The EPA is taken in the EPA period. The EPA period starts when the EPAO confirms the gateway requirements have been met and is typically 3 months.

The EPAO should confirm the gateway requirements have been met and the EPA should start as quickly as possible.

EPA gateway

The apprentice’s employer must confirm that they think their apprentice is working at or above the occupational standard. The apprentice will then enter the gateway. The employer may take advice from the apprentice's training provider(s), but the employer must make the decision.

The apprentice must meet the gateway requirements before starting their EPA.

These are:

  • achieved English and maths qualifications in line with the apprenticeship funding rules.
  • for the professional discussion the apprentice must submit: portfolio of evidence

Portfolio of evidence requirements:

The apprentice must compile a portfolio of evidence during the on-programme period of the apprenticeship. It should only contain evidence related to the KSBs that will be assessed by this assessment method. It will typically contain 10 discrete pieces of evidence. Evidence must be mapped against the KSBs. Evidence may be used to demonstrate more than one KSB; a qualitative as opposed to quantitative approach is suggested.

Evidence sources may include:

  • workplace documentation and records:
  • workplace policies and procedures
  • witness statements
  • annotated photographs
  • video clips (maximum total duration 60 minutes ); the apprentice must be in view and identifiable

This is not a definitive list; other evidence sources can be included.

The portfolio of evidence should not include reflective accounts or any methods of self-assessment. Any employer contributions should focus on direct observation of performance (for example, witness statements) rather than opinions. The evidence provided should be valid and attributable to the apprentice; the portfolio of evidence should contain a statement from the employer and apprentice confirming this.

The EPAO should not assess the portfolio of evidence directly as it underpins the discussion. The independent assessor should review the portfolio of evidence to prepare questions for the discussion . They are not required to provide feedback after this review.

The apprentice must submit any policies and procedures as requested by the EPAO.

Order of assessment methods

The assessment methods can be delivered in any order.

The result of one assessment method does not need to be known before starting the next.

Observation

Overview

In the observation with questions, an independent assessor observes the apprentice in their workplace and asks questions. The apprentice completes their day-to-day duties under normal working conditions. Simulation is not permitted. It gives the apprentice the opportunity to demonstrate the KSBs mapped to this assessment method.

Rationale

The observation method is used due to the practical nature of the occupation. The assessor can witness the apprentice undertaking tasks required for occupational competence. As the apprentice is working on real case work this requires a long duration (7 hours observation) this must allow for operational interruptions as there is an element of unpredictability. The questions that are asked during the observation are to act as clarification.

Delivery

The observation must be structured to give the apprentice the opportunity to demonstrate the KSBs mapped to this assessment method to the highest available grade.

An independent assessor must conduct and assess the observation .

The independent assessor must only observe one apprentice at a time to ensure quality and rigour. They must be as unobtrusive as possible.

The EPAO must give an apprentice 2 weeks notice of the observation with questions.

The observation must take 7 hours.

The independent assessor can increase the time of the observation with questions by up to 10%. This time is to allow the apprentice to complete a task or respond to a question if necessary.

The observation with questions may take place in parts but must be completed within 2 working days. A working day is typically 7.5 hours. The reason for this split is

To provide flexibility for the assessor, apprentice and employer.

The EPAO must manage invigilation of the apprentice during the assessment, to maintain security of the EPA, in line with their malpractice policy. This includes breaks and moving between locations during the working day.

The independent assessor must explain to the apprentice the format and timescales of the observation with questions before it starts. This does not count towards the assessment time.

The independent assessor should observe the following during the observation:

Apprentices must be observed, by an occupationally competent independent assessor. Completing operational casework in which they will demonstrate the KSBs assigned to this assessment. The EPAO will arrange for the observation to take place in consultation with the employer. The employer will make available casework which is at different stages of progression which will enable the apprentice to evidence against the themes of the KSBs;

  • Operational delivery
  • Theoretical underpinning knowledge
  • Personal responsibility
  • Technical application
  • The legal/ policing context
  • Communication

It is expected that the observation would take up to 7 hours to complete. Due to the nature of the practice, some operational examinations will not go as expected and therefore additional questions may be asked to check knowledge, skills, and behaviours of the apprentice.

Comfort breaks are permitted as necessary. The independent assessor has the discretion to increase the time of the observation(s) by up to 10% to allow the apprentice to complete the task that is part of this element of the EPA. The 7 hours allocated to this assessment can be split over 2 days in agreement with the employer and apprentice. The independent assessor may conduct and observe one apprentice during this assessment method.

These activities provide the apprentice with the opportunity to demonstrate the KSBs mapped to this assessment method.

To explore the breadth of knowledge for example testing what an apprentice would do in the event of a piece of work not going to plan. The questions will also ensure the apprentice is aware of their limitations, when to involve colleagues and refer to more experienced members of the team.

The independent assessor must ask questions. Questioning can occur both during and the observation. The time for questioning is included in the overall assessment time. The independent assessor must ask at least 5questions. To remain as unobtrusive as possible, the independent assessor should ask questions during natural stops between tasks and after completion of work rather than disrupting the apprentice’s flow. Follow-up questions are allowed where clarification is required. The independent assessor must use the questions from the EPAO’s question bank or create their own questions in-line with the EPAO’s training.

The independent assessor must ask questions about KSBs that were not observed to gather assessment evidence. These questions are in addition to the above set number of questions for the observation with questions and should be kept to a minimum.

The independent assessor must make the grading decision. The observation and responses to questions must be assessed holistically by the independent assessor when they are deciding the grade.

The independent assessor must keep accurate records of the assessment. They must record:

  • the KSBs observed
  • the apprentice’s answers to questions
  • the KSBs demonstrated in answers to questions
  • the grade achieved 

Assessment location

The observation must take place in the apprentice’s normal place of work (for example their employer’s premises or a customer’s premises). Equipment and resources needed for the observation must be provided by the employer and be in good and safe working condition.   

Questioning that occurs after the observation should take place in a quiet room, free from distractions and influence.

Additional venue requirements that must be in place include:

the assessor may need to sign a confidentiality agreement and will not be able to remove items from the workplace. assessors may be required to complete police vetting.

Question and resource development

The EPAO must develop a purpose-built assessment specification and question bank. It is recommended this is done in consultation with employers of this occupation. The EPAO should maintain the security and confidentiality of EPA materials when consulting employers. The assessment specification and question bank must be reviewed at least once a year to ensure they remain fit-for-purpose.  

The assessment specification must be relevant to the occupation and demonstrate how to assess the KSBs mapped to this assessment method. The EPAO must ensure that questions are refined and developed to a high standard. The questions must be unpredictable. A question bank of sufficient size will support this.

The EPAO must produce the following materials to support the observation :

  • independent assessor assessment materials which include:
    • training materials
    • administration materials
    • moderation and standardisation materials
    • guidance materials
    • grading guidance
    • question bank
  • EPA guidance for the apprentice and the employer

The EPAO must ensure that the EPA materials are subject to quality assurance procedures including standardisation, training, and moderation.

Professional discussion

Overview

In the discussion, an independent assessor and apprentice have a formal two-way conversation.

The apprentice can refer to and illustrate their answers with evidence from their portfolio of evidence. It gives the apprentice the opportunity to demonstrate their competency across the KSBs mapped to this EPA method.

Rationale

It provides the opportunity for the apprentice to demonstrate a distinction criterion. To describe previous work using the portfolio to underpin the discussion. The professional discussion provides the opportunity to demonstrate how an apprentice has followed standard operating procedures, worked with others and what they have done when tasks have not gone to plan including when to escalate.

Delivery

The professional discussion must be structured to give the apprentice the opportunity to demonstrate the KSBs mapped to this assessment method to the highest available grade.

An independent assessor must conduct and assess the professional discussion.

Operational delivery

Theoretical underpinning knowledge

Personal responsibility

Technical application

The legal/ policing context

Communication

The EPAO must give an apprentice 2 weeks notice of the professional discussion.

The independent assessor must have at least 2 week(s) to review the supporting documentation.

The apprentice must have access to their portfolio of evidence during the professional discussion.

The apprentice can refer to and illustrate their answers with evidence from their portfolio of evidence however the portfolio of evidence is not directly assessed.

The professional discussion must last for 90 minutes. The independent assessor can increase the time of the professional discussion by up to 10%. This time is to allow the apprentice to respond to a question if necessary.

The independent assessor must ask at least 8 questions. Follow-up questions are allowed where clarification is required. The independent assessor must use the questions from their EPAO’s question bank or create their own questions in-line with the EPAO’s training.

The independent assessor must make the grading decision. The independent assessor must keep accurate records of the assessment. They must record:

  • the apprentice’s answers to questions
  • the KSBs demonstrated in answers to questions
  • the grade achieved 

Assessment location

The professional discussion must take place in a suitable venue selected by the EPAO (for example the EPAO’s or employer’s premises).

The professional discussion can be conducted by video conferencing. The EPAO must have processes in place to verify the identity of the apprentice and ensure the apprentice is not being aided.

The professional discussion should take place in a quiet room, free from distractions and influence.

Question and resource development

The EPAO must develop a purpose-built assessment specification and question bank. It is recommended this is done in consultation with employers of this occupation. The EPAO should maintain the security and confidentiality of EPA materials when consulting employers. The assessment specification and question bank must be reviewed at least once a year to ensure they remain fit-for-purpose.  

The assessment specification must be relevant to the occupation and demonstrate how to assess the KSBs mapped to this assessment method. The EPAO must ensure that questions are refined and developed to a high standard. The questions must be unpredictable. A question bank of sufficient size will support this.

The EPAO must ensure that apprentice has a different set of questions in the case of re-sits or re-takes.

The EPAO must produce the following materials to support the professional discussion:

  • independent assessor assessment materials which include:
  • training materials
  • administration materials
  • moderation and standardisation materials
  • guidance materials
  • grading guidance
  • question bank
  • EPA guidance for the apprentice and the employer

The EPAO must ensure that the EPA materials are subject to quality assurance procedures including standardisation, training, and moderation.

Grading

Observation

Fail - does not meet pass criteria

Theme
KSBs
Pass
Apprentices must demonstrate all the pass descriptors
Operational Delivery
K5 K6 K15 S2 S3 S4 S14 S16 S19 S22 B3

Demonstrates the use of standard operating procedures for a digital forensic capture and preservation processes in a dynamic operational environment. K5,S2.

Processes technical information effectively and accurately to provide critical thinking to issues and problems. S22.

Applies standard methodologies while working in operational environments ensuring safe handling and storage of physical exhibits and personal or sensitive data'. S3, S14, B3.

Follows organisational guidance for secure devices and preserving evidence, maintaining continuity and recording of chain of custody for exhibits for disclosure purposes. S4, S16.

Uses local procedures and decision making to progress devices through the evidential process. K6.

Demonstrates the navigation and use of a quality management system. Including participating in an example of reporting, corrective action, validation, verification, individual competency and peer review K15, S19.

Theory
K8 S13

Selects and applies digital forensic tools and software relevant to their role. K8, S13.

Personal Responsibility
S5 S6 S20

Conducts a dynamic risk assessment to ensure the safety of all parties when handling a common biohazard using the appropriate personal protective equipment. S20.

 

Applies considered decision making when their limits of competence and/or authority have been exceeded, escalating in line with organisational guidance. S5. S6.

 

 

Technical Application
S9 S10 S11 S12

Demonstrates the process of effectively troubleshooting, diagnosing and correcting a real-world software, hardware, connectivity or network issue. S12Demonstrate(s) the correct use of write blocking techniques. S10.

Identifies, sets up and uses hardware components and devices, managing applications software relevant to their role. S9, S11.

Selects and uses digital forensic tools and software appropriate to the task. S13.

Legal Context
S7 B1

Records seizures and/or examinations on standard forms in compliance with legislative and organisational ethical and professional guidance and procedures. S7, B1.

Communication
K20 S17



Demonstrates appropriate use of digital evidence/case management systems to record the evidence collection. S17, K20.

 

Professional discussion

Fail - does not meet pass criteria

Theme
KSBs
Pass
Apprentices must demonstrate all the pass descriptors.
Distinction
Apprentices must demonstrate all the pass descriptors and all of the distinction descriptors
Operational Delivery
K10 K12 S15 B6

Describes how to manage evidence ensuring continuity and integrity of evidence and how evidence relates to investigations. K10.

Justifies their choice/selection of methods or tools for recovering digital evidence relevant to context. K12.

Produces an example of giving preservation advice for physical evidence for new digital exhibits demonstrating an understanding of anticontamination and cross contamination considerations. S15.

Acts in line with sustainable practices sustainable practices, and  challenging unsustainable practices. B6.

Demonstrates the navigation and use of a quality management system explaining why the quality management system is used in the organisation K15, S19.

Describes and explain the value of using additional methods or tools. K12.

Demonstrates the navigation and use of a quality management system explaining why the quality management system is used in the organisation. K15, S19.

Describes and explain the value of using additional methods or tools. K12.

Theory
K4 K14 S1

Justifies the need for principles of working in relation to a controlled environment. K14.

Demonstrates the use of terminology of digital forensic and terminology defined by the forensic science regulator and used in standard operating procedures. K4, S1.

 

N/A

Personal Responsibility
K16 K17 K18 K19 S21 B4 B5 B7

Describes the importance of, and ways to keep technical knowledge up to date for different situations. B4, K19.

Explains the risks associated with processing sensitive or distressing content and explain one strategy to develop personal resilience and maintain wellbeing. Describing how to access organisational support mechanisms. K17, S21, B5.

Describes the health and safety procedures relevant to digital forensic technician role and the relevant legislation. K16.

Describes the impact of diversity and inclusion such as on teamwork, client relationships and organisational strategies and how they take a collaborative approach to work with stakeholders and team members. K18, B7.

N/A

Technical Application
K9 K11

Identifies the appropriate forensic tools to be used in different working environments. K11.

Describes the functions, features and limitations of at least one forensics tool, component or software. K9.

 

Explains how to appropriately select and utilise primary digital forensic tools in different working environment and describe the challenges of doing this outside of the laboratory environment. K11.

Describes and evaluate the functions, features and limitations of the primary digital forensic tools used within your organisation. K9

Legal Context
K1 K2 K3 K7

Explains the application of Forensic Science regulators code of practice and activities on their practice, and the national good practice guidance for the capture and preservation of digital evidence. K3 K7.

Describes what forensic science is, discuss roles and services and the considerations for maximising evidential capture and sequencing. K2.

Evaluates the digital forensics technician role and how it contributes to investigations and the role they perform in the criminal justice process. K1.

Explains the considerations for maximising evidential capture and sequencing across the forensic disciplines. K2. 

 

Gives examples where forensic science practitioners consult and interact to maximise evidential capture. K2.

Communication
K13 S8 S18 B2

Provides an example of establishing and maintain a positive relationship with a colleague, customer or supplier. B2.

Describes evidential witness statements and explain how to present these statements in a courtroom. S18.

Explains at least two different ways of recording and presenting relevant investigative information, their appropriate use and presentation. Evaluate how to adapt communication methods for different audiences and explain where it is appropriate to use technical language. K13, S8.

 

Describes how to adapt communication methods for different audiences and explain where it is appropriate to use technical language. K13, S8.

Overall EPA grading

Performance in the EPA determines the overall grade of:

  • fail

  • pass

  • distinction

An independent assessor must individually grade the observation and professional discussion in line with this EPA plan.

The EPAO must combine the individual assessment method grades to determine the overall EPA grade.

If the apprentice fails one assessment method or more, they will be awarded an overall fail.

To achieve an overall pass, the apprentice must achieve at least a pass in all the assessment methods. To achieve an overall EPA distinction, the apprentice must achieve a distinction in the professional discussion and a pass in the observation.

Grades from individual assessment methods must be combined in the following way to determine the grade of the EPA overall.

Observation Professional discussion Overall Grading
Fail Pass Fail
Pass Fail Fail
Pass Pass Pass
Pass Distinction Distinction

Re-sits and re-takes

If the apprentice fails one or more assessment methods they can take a re-sit or a re-take at their employer’s discretion. The apprentice’s employer needs to agree that a re-sit or re-take is appropriate. A re-sit does not need further learning, whereas a re-take does.

The apprentice should have a supportive action plan to prepare for a re-sit or a re-take.

The employer and EPAO agree the timescale for a re-sit or re-take. A re-sit is typically taken within 1 months of the EPA outcome notification. The timescale for a re-take is dependent on how much re-training is required and is typically taken within 6 months of the EPA outcome notification.

Failed assessment methods must be re-sat or re-taken within a 6-month period from the EPA outcome notification, otherwise the entire EPA will need to be re-sat or re-taken in full.

Re-sits and re-takes are not offered to an apprentice wishing to move from pass to a higher grade.

The apprentice will get a maximum EPA grade of pass for a re-sit or re-take, unless the EPAO determines there are exceptional circumstances.

Roles and responsibilities

Roles Responsibilities

Apprentice

As a minimum, the apprentice should:

  • participate in and complete on-programme training to meet the KSBs as outlined in the occupational standard for a minimum of 12 months
  • complete the required amount of off-the-job training specified by the apprenticeship funding rules and as arranged by the employer and training provider
  • understand the purpose and importance of EPA
  • meet the gateway requirements 
  • undertake the EPA  

 

Employer

As a minimum, the apprentice's employer must:

  • select the EPAO and training provider 
  • work with the training provider (where applicable) to support the apprentice in the workplace and to provide the opportunities for the apprentice to develop the KSBs
  • arrange and support off-the-job training to be undertaken by the apprentice 
  • decide when the apprentice is working at or above the occupational standard and is ready for EPA 
  • ensure that supporting evidence required at the gateway is submitted in line with this EPA plan 
  • liaise with the training provider and EPAO to ensure the EPA is booked in a timely manner

Post-gateway, the employer must: 

  • confirm arrangements with the EPAO for the EPA (who, when, where) in a timely manner (including providing access to any employer-specific documentation as required, for example company policies)
  • ensure that the EPA is scheduled with the EPAO for a date and time which allows the opportunity for the apprentice to be assessed against the KSBs 
  • remain independent from the delivery of the EPA
  • ensure the apprentice is given sufficient time away from regular duties to prepare for, and complete all post-gateway elements of the EPA, and that any required supervision during this time (as stated within this EPA plan) is in place
  • where the apprentice is assessed in the workplace, ensure that the apprentice has access to the resources used on a regular basis 
  • pass the certificate to the apprentice upon receipt from the EPAO

EPAO

As a minimum, the EPAO must:  

  • conform to the requirements of this EPA plan and deliver its requirements in a timely manner 
  • conform to the requirements of the register of end-point assessment organisations (RoEPAO) 
  • conform to the requirements of the external quality assurance provider (EQAP) for this apprenticeship 
  • understand the occupational standard 
  • make the EPA contractual arrangements, including agreeing the price of the EPA 
  • develop and produce assessment materials as detailed for each assessment method in this EPA plan 
  • appoint qualified and competent independent assessors in line with the requirements of this EPA plan to conduct assessments and oversee their working 
  • appoint administrators (and invigilators where required) to administer the EPA  
  • provide training for independent assessors in terms of good assessment practice, operating the assessment tools and grading 
  • provide information, advice, guidance and documentation to enable apprentices, employers and training providers to prepare for the EPA 
  • confirm all gateway requirements have been met as quickly as possible 
  • arrange for the EPA to take place, in consultation with the employer 
  • ensure that the apprentice has access to the required resources and liaise with the employer to agree this if necessary, where the apprentice is not assessed in the workplace 
  • develop and provide assessment recording documentation to ensure a clear and auditable process is in place for providing assessment decisions and feedback to stakeholders 
  • have no direct connection with the apprentice, their employer or training provider in all instances; there must be no conflict of interest 
  • have policies and procedures for internal quality assurance (IQA), and maintain records of IQA activity and moderation for external quality assurance (EQA) purposes 
  • deliver induction training for independent assessors, and for invigilators and markers (where used) 
  • undertake standardisation activity on this apprenticeship for an independent assessor before they conduct an EPA for the first time, if the EPA is updated and periodically (a minimum of annually) 
  • manage invigilation of the apprentice to maintain security of the assessment in line with the EPAO’s malpractice policy 
  • verify the identity of the apprentice  
  • use language in the development and delivery of the EPA that is appropriate to the level of the occupational standard 

Independent assessor

As a minimum, an independent assessor must: 

  • have the competence to assess the apprentice at the level of this apprenticeship and hold any required qualifications and experience in line with the requirements of the independent assessor as detailed in the IQA section of this EPA plan 
  • understand the occupational standard and the requirements of this EPA 
  • have, maintain and be able to evidence, up-to-date knowledge and expertise of the occupation 
  • deliver the end-point assessment in-line with this EPA plan 
  • comply with the IQA requirements of the EPAO 
  • have no direct connection or conflict of interest with the apprentice, their employer or training provider; in all instances; there must be no conflict of interest 
  • attend induction training 
  • attend standardisation events when they start working for the EPAO, before they conduct an EPA for the first time and a minimum of annually for this apprenticeship  
  • assess each assessment method, as determined by the EPA plan  
  • assess the KSBs assigned to each assessment method, as shown in the mapping of KSBs to assessment methods in this EPA plan  
  • make the grading decisions 
  • record and report assessment outcome decisions, for each apprentice, following instructions and using assessment recording documentation provided by the EPAO, in a timely manner 
  • use language in the development and delivery of the EPA that is appropriate to the level of the occupational standard 
  • mark open (constructed) test answers accurately according to the EPAO’s mark scheme and procedures 

Training provider

As a minimum, the training provider must: 

  • work with the employer and support the apprentice during the off-the-job training to provide the opportunities to develop the KSBs as listed in the occupational standard 
  • conduct training covering the KSBs agreed as part of the Commitment Statement or the Individual Learning Plan 
  • monitor the apprentice’s progress during any training provider led on-programme learning 
  • advise the employer, upon request, on the apprentice’s readiness for EPA 
  • remain independent from the delivery of the EPA 

Reasonable adjustments

The EPAO must have reasonable adjustments arrangements for the EPA.

This should include:

  • how an apprentice qualifies for reasonable adjustment
  • what reasonable adjustments may be made

Adjustments must maintain the validity, reliability and integrity of the EPA as outlined in this EPA plan.

Internal quality assurance

Internal quality assurance refers to how the EPAO ensures valid, consistent and reliable EPA decisions. The EPAO must adhere to the requirements within the roles and responsibilities section:

The EPAO must also:

  • have quality assurance systems and procedures that ensure fair, reliable and consistent EPA regardless of employer, place, time or independent assessor
  • appoint independent assessors who are competent to deliver the EPA and who:
    • have recent relevant experience of the occupation or sector to at least occupational level 5 gained in the last 3 years or significant experience of the occupation or sector
    • meet the following minimum requirements:

      undertaking of policing vetting

      signing of confidentiality agreements

  • operate induction training for anyone involved in the delivery or assessment of the EPA
  • provide training for independent assessors in good assessment practice, operating the assessment tools and making grading decisions
  • provide ongoing training for markers and invigilators
  • provide standardisation activity for this apprenticeship standard for all independent assessors:
    • before they conduct an EPA for the first time
    • if the EPA is updated
    • periodically as appropriate (a minimum of annually)
  • conduct effective moderation of EPA decisions and grades
  • conduct appeals where required, according to the EPAO’s appeals procedure, reviewing and making final decisions on EPA decisions and grades
  • have no direct connection with the apprentice, their employer or training provider.

Value for money

Affordability of the EPA will be aided by using at least some of the following:

  • using the employer’s premises

Professional recognition

This apprenticeship aligns with:

BCS - Chartered Institute for IT for Professional Registration

Mapping of KSBs to assessment methods

Knowledge Assessment methods
K1

The DFT role and how it contributes to investigations and the criminal justice process.

Back to Grading
Professional discussion
K2

What are the considerations for maximising evidential capture and sequencing.

Back to Grading
Professional discussion
K3

Forensic science regulators codes of practice and activities.

Back to Grading
Professional discussion
K4

The digital forensics terminology.

Back to Grading
Professional discussion
K5

Standard operating procedures to a dynamic operational environment.

Back to Grading
Observation
K6

Make appropriate decisions of how to progress devices through the evidential process utilising local procedures.

Back to Grading
Observation
K7

The national good practise guidance for the capture and preservation of digital evidence (For example the ACPO principles and NPCC Good Practises Advice manual).

Back to Grading
Professional discussion
K8

The workings, principles and relevant use of a range of digital devices, peripherals and associated operating systems relevant to their role in digital forensics.

Back to Grading
Observation
K9

Functions, features, and limitations of digital forensics tools, components and software.

Back to Grading
Professional discussion
K10

Evidence management, continuity and integrity of evidence and how it relates to investigations.

Back to Grading
Professional discussion
K11

Different forensic working environments and understand how to select and utilise forensic tools appropriate to the circumstances.

Back to Grading
Professional discussion
K12

What other forensic evidence types can be recovered from devices and the best methods and sequence for evidential capture and preservation.

Back to Grading
Professional discussion
K13

Different ways of recording and presenting relevant investigative information (reports, contemporaneous notes/statement writing) and how they should be appropriately used and presented.

Back to Grading
Professional discussion
K14

The principles of working in a quality controlled setting. To include; knowledge of appropriate accreditation bodies, the quality management process/system and individual legal entities, individual expectations of working in a quality controlled environment.

Back to Grading
Professional discussion
K15

Quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review, and how to navigate this information.

Back to Grading
Observation
K16

The health & safety procedures/legislation. Organisational sustainability procedures.

Back to Grading
Professional discussion
K17

The risks of processing sensitive or potentially distressing content while understanding the benefits of good wellbeing working practices.

Back to Grading
Professional discussion
K18

Awareness of the impact of diversity and inclusion such as on teamwork, client relationships and organisational strategies.

Back to Grading
Professional discussion
K19

Understand the requirements for continual professional development within the industry.

Back to Grading
Professional discussion
K20

Procedures for capturing and preserving evidence.

Back to Grading
Observation
Skill Assessment methods
S1

Use appropriate terminology defined by the forensic science regulator and included in standard operating procedures.

Back to Grading
Professional discussion
S2

Standard operating procedures for a range of digital forensic capture and preservation processes.

Back to Grading
Observation
S3

Apply standard methodology in a safe and effective way while working in operational environments.

Back to Grading
Observation
S4

Demonstrate confidentiality, integrity, and availability limitations of secure devices and best practice methods for preserving evidence.

Back to Grading
Observation
S5

Implement limitations of competency and authority and escalate when necessary.

Back to Grading
Observation
S6

Considered decision making.

Back to Grading
Observation
S7

Adhere to powers of seizure/examinations and legislation. Demonstrate compliance with this through the appropriate use of standard forms.

Back to Grading
Observation
S8

Adopt communication methods suitable for audience. Using technical language where appropriate.

Back to Grading
Professional discussion
S9

Identify, set up and use a range hardware components and devices.

Back to Grading
Observation
S10

Demonstrate correct use of write blocking techniques.

Back to Grading
Observation
S11

Manage applications software relevant to the role.

Back to Grading
Observation
S12

Show an ability to troubleshoot real-world device and network issues effectively and diagnosing and correcting common software, hardware, or connectivity problems.

Back to Grading
Observation
S13

Use features and functions of common specialist digital forensic tools and software. Selecting based on suitability.

Back to Grading
Observation
S14

Understanding the responsibilities of data management.

Back to Grading
Observation
S15

Provide preservation advice for physical evidence (DNA, fingerprints) for new digital exhibits, taking into account anticontamination and cross contamination.

Back to Grading
Professional discussion
S16

Apply continuity of evidence and appropriate recording of a chain of custody for an exhibit for disclosure purposes.

Back to Grading
Observation
S17

Produce notes documenting activity undertaken during the capture and preservation processes; including the appropriate use of digital evidence/case management systems.

Back to Grading
Observation
S18

Produce evidential continuity witness statements and demonstrate how to present in a courtroom.

Back to Grading
Professional discussion
S19

Navigate and inform a quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review.

Back to Grading
Observation
S20

Conducting dynamic risk assessments, taking into account the safety of all parties and using PPE.

Back to Grading
Observation
S21

Apply strategies to develop personal resilience and maintain welling, know how to access organisational support mechanisms.

Back to Grading
Professional discussion
S22

Process technical information effectively and accurately to provide critical thinking to issues and problems.

Back to Grading
Observation
Behaviour Assessment methods
B1

Acts in an ethical and professional manner in the workplace.

Back to Grading
Observation
B2

Builds and maintains positive relationships with colleagues, customers and suppliers.

Back to Grading
Professional discussion
B3

Takes an organised and methodical approach to their work and scrutinises own objectivity.

Back to Grading
Observation
B4

Takes personal responsibility for developing knowledge and skills and continually seeks to improve their performance.

Back to Grading
Professional discussion
B5

Commitment to develop personal resilience and maintain wellbeing.

Back to Grading
Professional discussion
B6

Sustainable practices and challenge unsustainable practices.

Back to Grading
Professional discussion
B7

Support an inclusive culture and treat colleagues and external stakeholders fairly and with respect without bias or discrimination.

Back to Grading
Professional discussion

Mapping of KSBs to grade themes

Observation - Observation

KSBS GROUPED BY THEME Knowledge Skills Behaviour
Operational Delivery
K5 K6 K15
S2 S3 S4 S14 S16 S19 S22
B3

Standard operating procedures to a dynamic operational environment. (K5)

Make appropriate decisions of how to progress devices through the evidential process utilising local procedures. (K6)

Quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review, and how to navigate this information. (K15)

Standard operating procedures for a range of digital forensic capture and preservation processes. (S2)

Apply standard methodology in a safe and effective way while working in operational environments. (S3)

Demonstrate confidentiality, integrity, and availability limitations of secure devices and best practice methods for preserving evidence. (S4)

Understanding the responsibilities of data management. (S14)

Apply continuity of evidence and appropriate recording of a chain of custody for an exhibit for disclosure purposes. (S16)

Navigate and inform a quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review. (S19)

Process technical information effectively and accurately to provide critical thinking to issues and problems. (S22)

Takes an organised and methodical approach to their work and scrutinises own objectivity. (B3)

Theory
K8
S13

The workings, principles and relevant use of a range of digital devices, peripherals and associated operating systems relevant to their role in digital forensics. (K8)

Use features and functions of common specialist digital forensic tools and software. Selecting based on suitability. (S13)

N/A

Personal Responsibility

S5 S6 S20

N/A

Implement limitations of competency and authority and escalate when necessary. (S5)

Considered decision making. (S6)

Conducting dynamic risk assessments, taking into account the safety of all parties and using PPE. (S20)

N/A

Technical Application

S9 S10 S11 S12

N/A

Identify, set up and use a range hardware components and devices. (S9)

Demonstrate correct use of write blocking techniques. (S10)

Manage applications software relevant to the role. (S11)

Show an ability to troubleshoot real-world device and network issues effectively and diagnosing and correcting common software, hardware, or connectivity problems. (S12)

N/A

Legal Context

S7
B1

N/A

Adhere to powers of seizure/examinations and legislation. Demonstrate compliance with this through the appropriate use of standard forms. (S7)

Acts in an ethical and professional manner in the workplace. (B1)

Communication
K20
S17

Procedures for capturing and preserving evidence. (K20)

Produce notes documenting activity undertaken during the capture and preservation processes; including the appropriate use of digital evidence/case management systems. (S17)

N/A

Professional discussion - Discussion

KSBS GROUPED BY THEME Knowledge Skills Behaviour
Operational Delivery
K10 K12
S15
B6

Evidence management, continuity and integrity of evidence and how it relates to investigations. (K10)

What other forensic evidence types can be recovered from devices and the best methods and sequence for evidential capture and preservation. (K12)

Provide preservation advice for physical evidence (DNA, fingerprints) for new digital exhibits, taking into account anticontamination and cross contamination. (S15)

Sustainable practices and challenge unsustainable practices. (B6)

Theory
K4 K14
S1

The digital forensics terminology. (K4)

The principles of working in a quality controlled setting. To include; knowledge of appropriate accreditation bodies, the quality management process/system and individual legal entities, individual expectations of working in a quality controlled environment. (K14)

Use appropriate terminology defined by the forensic science regulator and included in standard operating procedures. (S1)

N/A

Personal Responsibility
K16 K17 K18 K19
S21
B4 B5 B7

The health & safety procedures/legislation. Organisational sustainability procedures. (K16)

The risks of processing sensitive or potentially distressing content while understanding the benefits of good wellbeing working practices. (K17)

Awareness of the impact of diversity and inclusion such as on teamwork, client relationships and organisational strategies. (K18)

Understand the requirements for continual professional development within the industry. (K19)

Apply strategies to develop personal resilience and maintain welling, know how to access organisational support mechanisms. (S21)

Takes personal responsibility for developing knowledge and skills and continually seeks to improve their performance. (B4)

Commitment to develop personal resilience and maintain wellbeing. (B5)

Support an inclusive culture and treat colleagues and external stakeholders fairly and with respect without bias or discrimination. (B7)

Technical Application
K9 K11

Functions, features, and limitations of digital forensics tools, components and software. (K9)

Different forensic working environments and understand how to select and utilise forensic tools appropriate to the circumstances. (K11)

N/A

N/A

Legal Context
K1 K2 K3 K7

The DFT role and how it contributes to investigations and the criminal justice process. (K1)

What are the considerations for maximising evidential capture and sequencing. (K2)

Forensic science regulators codes of practice and activities. (K3)

The national good practise guidance for the capture and preservation of digital evidence (For example the ACPO principles and NPCC Good Practises Advice manual). (K7)

N/A

N/A

Communication
K13
S8 S18
B2

Different ways of recording and presenting relevant investigative information (reports, contemporaneous notes/statement writing) and how they should be appropriately used and presented. (K13)

Adopt communication methods suitable for audience. Using technical language where appropriate. (S8)

Produce evidential continuity witness statements and demonstrate how to present in a courtroom. (S18)

Builds and maintains positive relationships with colleagues, customers and suppliers. (B2)

Find an apprenticeship

Contact us about this apprenticeship

Version log

Version Change detail Earliest start date Latest start date Latest end date
1.0 Approved for delivery 01/03/2023 Not set Not set

Is this page useful?

Tell us about your visit

Help us improve our website