Carry out digital forensic examination activities

Overview & Purpose

What This Standard Covers

The NOS outlines the competencies necessary for conducting digital forensic examinations, aimed at uncovering and interpreting electronic data to assist in information security investigations while preserving evidence in its original form. It focuses on techniques for collecting, validating, and analyzing digital information, primarily for legal and organizational contexts.

Performance Criteria

• Collect and preserve electronic evidence in line with organizational procedures.
• Analyze digital information for legal breaches and security policy violations.
• Critically analyze software for malware following organizational standards.
• Examine monitoring systems for potential information security breaches.
• Report and escalate suspicious activities promptly.
• Secure information assets from threats until they are mitigated.
• Seize digital evidence according to legal and organizational guidelines.
• Present forensic findings clearly to stakeholders.

Knowledge & Understanding Requirements

• Purpose and importance of digital forensic examination.
• Methods, tools, and techniques used in digital forensic examinations.
• Relevant legislation and regulations regarding digital forensic evidence preservation.
• High-risk threats pertinent to digital forensic examinations.
• Accessing and analyzing evidence-based information.
• Value of digital forensic examination in incident identification and evidence retention.
• Importance of system logs, network traffic, and other data types in forensic activities.
• Prioritization and escalation of issues found during examinations.
• Understanding of transient and volatile data analysis.
• Differences between forensic examinations in law enforcement versus business environments.

Relevent Roles

• Information and Communication Technology Professionals
• Information and Communication Technology Officer
• Digital Forensics Analyst
• Cyber Security Specialist