Cybercrime Training Competences Framework
Digital Forensics Examiner
Actor Description
These professionals perform detailed forensic examinations of computer based digital evidence. They are the staff with the most advanced skills related to specialised cybercrime investigation. They should display specialised knowledge and expertise that stands out in their forces. It is not necessary that they are multi-domain experts but should be reference points for their own area of specialisation.
They should serve as a source of technical counsel and advice for investigators requiring forensic support. They should be skilled to perform advanced forensic activities and authorised to develop new practices and solutions themselves.
Method : Training requirements
Advanced cybercrime awareness
Advanced knowledge of legal and jurisdiction issues
Processing of digital evidence while maintaining the chain of evidence
Expert knowledge in one or more forensic areas
Familiarity with different operating systems and applications
Knowledge of relevant commercial and open source tools
Knowledge of scripting/programming and database querying (SQL)
Understanding of forensic artifacts and data carving
Knowledge of both post mortem and live data forensics
Report drafting skills
Evidence presentation