Support and manage the processing of digital evidence.
This occupation is found in all organisations that require a digital investigation/analysis of devices. These roles can be found in different public and private sector bodies and organisations that include digital forensics and criminal investigations within their service delivery. There is a significant demand on policing to examine digital devices making this a primary service offered by forensic service providers to policing. Within the public sector across the UK (and international) broader than just policing bodies this role is relevant to Security and Defence teams including the National Crime Agency, Ministry of Defence, Border Force, and other aspects of the Criminal Justice System. Private forensic service providers service all public sector requirements for device examinations as well as other investigation types not just criminal. Including internal corporate and intellectual property theft investigations. These companies vary in size and breadth of digital capability. This role works independently but with the support of other team members within an organisation that will vary in size. They are expected to work with investigators to formulate strategies. Some examiners will work in a police station or other government building, private sector examiners will work in a secure building.
The broad purpose of the occupation is for a Digital Forensic Technician to support the appropriate capture, preservation, and initial processing of digital evidence. They will provide triage and early decision-making for criminal investigations that will ensure the integrity of any digital evidence. This technical knowledge would apply to a range of digital material primarily from mobile devices and computer peripherals. Once experienced they will also apply this knowledge to identifying digital items suitable for further analysis utilising an appropriate technical method providing advice and support about the detection, preservation, seizure, gathering and processing of digital material. This role supports a range of case types that emphasis the need for individuals to have the ability to adapt and conduct dynamic risk assessments. Cases could include ‘live’ incidents, laboratory submissions, and in other proactive and/or reactive investigations where digital technology and data acquisition opportunities exist. The titles of the roles may vary across different organisations including police forces, but the core skills required of the role remain the same. This is an entry level role into Digital Forensics where the role develops the principles of digital device examinations whilst ensuring the data chain of custody for evidential use. Other roles will provide the more complex decision making and problem-solving aspects of the discipline. Individuals will work flexibly within an organisation utilising a range of standard tools and equipment. This maybe office based or more mobile/operational depending on the role/organisation. There is a requirement that this role will always be expected to adhere to relevant Health and Safety, for example wearing personal protective equipment and appropriate handling of electrical equipment. This role introduces a level of autonomy once the initial training is complete, to examine devices, but they would always have associated team support when required. The size of this team can vary depending on the organisation. They could be expected to work with investigators and broader investigation teams especially within an operational setting. The location they work will vary with some expected to work flexibly across several settings including at a crime scene, in a police force building or laboratory whereas commercial providers may offer a more conventional office environment. Some digital forensic departments are accredited laboratories, so individuals will be trained to understand the limitations and expectations of work within an accredited environment. Statement writing is expected of individuals working in the criminal justice system including court room training and report writing included. The role holder will be expected to monitor their own wellbeing with the aid of a range of tools including management support. The nature of digital forensic activities can often focus on high risk and harm cases, as such individuals need to be prepared that inevitably this role could be exposed to potentially distressing or upsetting digital data.
In their daily work, an employee in this occupation interacts with their local forensics team. This will include a clear reporting structure above this role including practitioners, team leaders or manager, and specialists. They will be part of regular conversations with supervisors/managers to identify ways to improve and receive support to achieve internal performance indicators and expectations. The investigative requirements of the role mean that all examiners would interact with a range of roles included in an investigation and/or forensics leads. They will also work with other team members within the department assisting others, sharing ideas, and conveying technical knowledge. Some organisations would also require them to present their findings at court, hearings/ tribunals and/or work with other experts. They may also work with legal teams including solicitors and barristers.
An employee in this occupation will be responsible for their own workload, being expected to technically problem solve and prioritise there time effectively. This would include planning their own working day. Utilising digital forensic capture tools. These are specialist capability tools designed to meet the expectations of processing material whilst ensuring evidential integrity and data management/extraction. Consideration would be given to ensuring all data handling meets the requirements of General Data Protection Regulations, Data protection: The Data Protection Act - GOV.UK (www.gov.uk) and appropriate forensic legislation for example Authorised Professional Practice, Extraction of material from digital devices (college.police.uk). It is a task driven role that will predominantly work to local or national standard operating procedures and quality standards. They are responsible for recognising the limitations of their competence and escalate activity if additional evidence is discovered or expertise is needed. They would need to be able to produce notes to an evidential standard that would support witness statement or report writing, replication by another suitably trained person, and court attendance if necessary. Take all reasonable steps to maintain and develop professional competence, taking account of material research and developments within the relevant field. The role requires security vetting and an expectation to work to an ethical framework, professional policing standards and Forensic Science Regulator Codes of Practice and Conduct. Forensic science providers: codes of practice and conduct - GOV.UK (www.gov.uk).
This is a summary of the key things that you – the apprentice and your employer need to know about your end-point assessment (EPA). You and your employer should read the EPA plan for the full details. It has information on assessment method requirements, roles and responsibilities, and re-sits and re-takes.
An EPA is an assessment at the end of your apprenticeship. It will assess you against the knowledge, skills, and behaviours (KSBs) in the occupational standard. Your training will cover the KSBs. The EPA is your opportunity to show an independent assessor how well you can carry out the occupation you have been trained for.
Your employer will choose an end-point assessment organisation (EPAO) to deliver the EPA. Your employer and training provider should tell you what to expect and how to prepare for your EPA.
The length of the training for this apprenticeship is typically 24 months. The EPA period is typically 3 months.
The overall grades available for this apprenticeship are:
When you pass the EPA, you will be awarded your apprenticeship certificate.
The EPA gateway is when the EPAO checks and confirms that you have met any requirements required before you start the EPA. You will only enter the gateway when your employer says you are ready.
The gateway requirements for your EPA are:
Observation with questions
You will be observed by an independent assessor completing your work. It will last at least 7 hours. They will ask you at least 5 questions.
Professional discussion underpinned by a portfolio of evidence
You will have a professional discussion with an independent assessor. It will last 90 minutes. They will ask you at least 8 questions. The questions will be about certain aspects of your occupation. You need to compile a portfolio of evidence before the EPA gateway. You can use it to help answer the questions.
The EPAO will confirm where and when each assessment method will take place.
You should speak to your employer if you have a query that relates to your job.
You should speak to your training provider if you have any questions about your training or EPA before it starts.
You should receive detailed information and support from the EPAO before the EPA starts. You should speak to them if you have any questions about your EPA once it has started.
If you have a disability, a physical or mental health condition or other special considerations, you may be able to have a reasonable adjustment that takes this into account. You should speak to your employer, training provider and EPAO and ask them what support you can get. The EPAO will decide if an adjustment is appropriate.
This apprenticeship aligns with BCS - Chartered Institute for IT for Professional Registration
Please contact the professional body for more details.
This apprenticeship aligns with Chartered Institute of Information Security for Associate
Please contact the professional body for more details.
This occupation is found in all organisations that require a digital investigation/analysis of devices. These roles can be found in different public and private sector bodies and organisations that include digital forensics and criminal investigations within their service delivery. There is a significant demand on policing to examine digital devices making this a primary service offered by forensic service providers to policing. Within the public sector across the UK (and international) broader than just policing bodies this role is relevant to Security and Defence teams including the National Crime Agency, Ministry of Defence, Border Force, and other aspects of the Criminal Justice System. Private forensic service providers service all public sector requirements for device examinations as well as other investigation types not just criminal. Including internal corporate and intellectual property theft investigations. These companies vary in size and breadth of digital capability. This role works independently but with the support of other team members within an organisation that will vary in size. They are expected to work with investigators to formulate strategies. Some examiners will work in a police station or other government building, private sector examiners will work in a secure building.
The broad purpose of the occupation is for a Digital Forensic Technician to support the appropriate capture, preservation, and initial processing of digital evidence. They will provide triage and early decision-making for criminal investigations that will ensure the integrity of any digital evidence. This technical knowledge would apply to a range of digital material primarily from mobile devices and computer peripherals. Once experienced they will also apply this knowledge to identifying digital items suitable for further analysis utilising an appropriate technical method providing advice and support about the detection, preservation, seizure, gathering and processing of digital material. This role supports a range of case types that emphasis the need for individuals to have the ability to adapt and conduct dynamic risk assessments. Cases could include ‘live’ incidents, laboratory submissions, and in other proactive and/or reactive investigations where digital technology and data acquisition opportunities exist. The titles of the roles may vary across different organisations including police forces, but the core skills required of the role remain the same. This is an entry level role into Digital Forensics where the role develops the principles of digital device examinations whilst ensuring the data chain of custody for evidential use. Other roles will provide the more complex decision making and problem-solving aspects of the discipline. Individuals will work flexibly within an organisation utilising a range of standard tools and equipment. This maybe office based or more mobile/operational depending on the role/organisation. There is a requirement that this role will always be expected to adhere to relevant Health and Safety, for example wearing personal protective equipment and appropriate handling of electrical equipment. This role introduces a level of autonomy once the initial training is complete, to examine devices, but they would always have associated team support when required. The size of this team can vary depending on the organisation. They could be expected to work with investigators and broader investigation teams especially within an operational setting. The location they work will vary with some expected to work flexibly across several settings including at a crime scene, in a police force building or laboratory whereas commercial providers may offer a more conventional office environment. Some digital forensic departments are accredited laboratories, so individuals will be trained to understand the limitations and expectations of work within an accredited environment. Statement writing is expected of individuals working in the criminal justice system including court room training and report writing included. The role holder will be expected to monitor their own wellbeing with the aid of a range of tools including management support. The nature of digital forensic activities can often focus on high risk and harm cases, as such individuals need to be prepared that inevitably this role could be exposed to potentially distressing or upsetting digital data.
In their daily work, an employee in this occupation interacts with their local forensics team. This will include a clear reporting structure above this role including practitioners, team leaders or manager, and specialists. They will be part of regular conversations with supervisors/managers to identify ways to improve and receive support to achieve internal performance indicators and expectations. The investigative requirements of the role mean that all examiners would interact with a range of roles included in an investigation and/or forensics leads. They will also work with other team members within the department assisting others, sharing ideas, and conveying technical knowledge. Some organisations would also require them to present their findings at court, hearings/ tribunals and/or work with other experts. They may also work with legal teams including solicitors and barristers.
An employee in this occupation will be responsible for their own workload, being expected to technically problem solve and prioritise there time effectively. This would include planning their own working day. Utilising digital forensic capture tools. These are specialist capability tools designed to meet the expectations of processing material whilst ensuring evidential integrity and data management/extraction. Consideration would be given to ensuring all data handling meets the requirements of General Data Protection Regulations, Data protection: The Data Protection Act - GOV.UK (www.gov.uk) and appropriate forensic legislation for example Authorised Professional Practice, Extraction of material from digital devices (college.police.uk). It is a task driven role that will predominantly work to local or national standard operating procedures and quality standards. They are responsible for recognising the limitations of their competence and escalate activity if additional evidence is discovered or expertise is needed. They would need to be able to produce notes to an evidential standard that would support witness statement or report writing, replication by another suitably trained person, and court attendance if necessary. Take all reasonable steps to maintain and develop professional competence, taking account of material research and developments within the relevant field. The role requires security vetting and an expectation to work to an ethical framework, professional policing standards and Forensic Science Regulator Codes of Practice and Conduct. Forensic science providers: codes of practice and conduct - GOV.UK (www.gov.uk).
| Duty | KSBs |
|---|---|
|
Duty 1 Apply an understanding of the principles of digital forensics and how they support the criminal justice process. |
|
|
Duty 2 Use approved scientific methodology and rationale to support investigations also providing advice as to whether further specialist digital support may be required. |
|
|
Duty 3 Ensure the appropriate capture and preservation techniques for digital forensic material applying standard methodology and utilising appropriate forensic science technology for digital examinations (specific tool training may be required). |
K2 K3 K5 K6 K7 K8 K9 K12 K17 K20 |
|
Duty 4 Handle exhibits and evidential material in line with agreed protocols to ensure the integrity, continuity, and security of digital evidence for the purpose of investigative processing and court proceedings. |
|
|
Duty 5 Produce evidential contemporaneous notes, reports (including Streamlined Forensic reporting) for disclosure purposes, continuity statements for attending court, tribunals and hearings as required in support of the investigative process. |
|
|
Duty 6 Use specialist technical equipment within a laboratory, at a crime scene or other appropriate location to conduct forensic examination’s. Ensuring handling, transport, storage, and environmental factors are all considered. |
|
|
Duty 7 To work within a quality-controlled environment aligning to standard operating policies and procedures whilst also carrying out technical quality checks, and peer reviews at a comparable competency level. |
|
|
Duty 8 Apply an understanding of other physical forensic evidence whilst conducting digital investigative decisions to ensure the preservation of evidence. |
|
|
Duty 9 Uphold organisational minimum standards with regards to equipment testing, fault finding and maintenance according to agreed schedules and in line with quality standards and investigative needs to ensure appropriate health and safety considerations, the use of PPE and awareness of potential biohazards are all considered as part of the examination process. |
|
|
Duty 10 Operate in a safe, lawful and ethical manner when dealing with digital devices and personal information giving due consideration to wellbeing working practices when processing sensitive or potentially distressing content. |
|
|
Duty 11 Following risk assessments; local, national and on digital forensics and crime scenes activities from multiple agencies to ensure the integrity of digital evidence. |
|
|
Duty 12 Liaison with colleagues from a variety of disciplines both external and internal to the organisation exercising responsibility for work within defined parameters. Acts in a professional and ethical manner, embracing equality, diversity and inclusion in the workplace. |
K1: The DFT role and how it contributes to investigations and the criminal justice process.
Back to Duty
K2: What are the considerations for maximising evidential capture and sequencing.
Back to Duty
K3: Forensic science regulators codes of practice and activities.
Back to Duty
K4: The digital forensics terminology.
Back to Duty
K5: Standard operating procedures to a dynamic operational environment.
Back to Duty
K6: Make appropriate decisions of how to progress devices through the evidential process utilising local procedures.
Back to Duty
K7: The national good practise guidance for the capture and preservation of digital evidence (For example the ACPO principles and NPCC Good Practises Advice manual).
Back to Duty
K8: The workings, principles and relevant use of a range of digital devices, peripherals and associated operating systems relevant to their role in digital forensics.
Back to Duty
K9: Functions, features, and limitations of digital forensics tools, components and software.
Back to Duty
K10: Evidence management, continuity and integrity of evidence and how it relates to investigations.
Back to Duty
K11: Different forensic working environments and understand how to select and utilise forensic tools appropriate to the circumstances.
Back to Duty
K12: What other forensic evidence types can be recovered from devices and the best methods and sequence for evidential capture and preservation.
Back to Duty
K13: Different ways of recording and presenting relevant investigative information (reports, contemporaneous notes/statement writing) and how they should be appropriately used and presented.
Back to Duty
K14: The principles of working in a quality controlled setting. To include; knowledge of appropriate accreditation bodies, the quality management process/system and individual legal entities, individual expectations of working in a quality controlled environment.
Back to Duty
K15: Quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review, and how to navigate this information.
Back to Duty
K16: The health & safety procedures/legislation. Organisational sustainability procedures.
Back to Duty
K17: The risks of processing sensitive or potentially distressing content while understanding the benefits of good wellbeing working practices.
Back to Duty
K18: Awareness of the impact of diversity and inclusion such as on teamwork, client relationships and organisational strategies.
Back to Duty
K19: Understand the requirements for continual professional development within the industry.
Back to Duty
K20: Procedures for capturing and preserving evidence.
Back to Duty
S1: Use appropriate terminology defined by the forensic science regulator and included in standard operating procedures.
Back to Duty
S2: Standard operating procedures for a range of digital forensic capture and preservation processes.
Back to Duty
S3: Apply standard methodology in a safe and effective way while working in operational environments.
Back to Duty
S4: Demonstrate confidentiality, integrity, and availability limitations of secure devices and best practice methods for preserving evidence.
Back to Duty
S5: Implement limitations of competency and authority and escalate when necessary.
Back to Duty
S6: Considered decision making.
Back to Duty
S7: Adhere to powers of seizure/examinations and legislation. Demonstrate compliance with this through the appropriate use of standard forms.
Back to Duty
S8: Adopt communication methods suitable for audience. Using technical language where appropriate.
Back to Duty
S9: Identify, set up and use a range hardware components and devices.
Back to Duty
S10: Demonstrate correct use of write blocking techniques.
Back to Duty
S11: Manage applications software relevant to the role.
Back to Duty
S12: Show an ability to troubleshoot real-world device and network issues effectively and diagnosing and correcting common software, hardware, or connectivity problems.
Back to Duty
S13: Use features and functions of common specialist digital forensic tools and software. Selecting based on suitability.
Back to Duty
S14: Understanding the responsibilities of data management.
Back to Duty
S15: Provide preservation advice for physical evidence (DNA, fingerprints) for new digital exhibits, taking into account anticontamination and cross contamination.
Back to Duty
S16: Apply continuity of evidence and appropriate recording of a chain of evidence or an exhibit for disclosure purposes.
Back to Duty
S17: Produce notes documenting activity undertaken during the capture and preservation processes; including the appropriate use of digital evidence/case management systems.
Back to Duty
S18: Produce evidential continuity witness statements and demonstrate how to present in a courtroom or professional enquiry
Back to Duty
S19: Navigate and inform a quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review.
Back to Duty
S20: Conducting dynamic risk assessments, taking into account the safety of all parties and using PPE.
Back to Duty
S21: Apply strategies to develop personal resilience and maintain welling, know how to access organisational support mechanisms.
Back to Duty
S22: Process technical information effectively and accurately to provide critical thinking to issues and problems.
Back to Duty
B1: Acts in an ethical and professional manner in the workplace.
Back to Duty
B2: Builds and maintains positive relationships with colleagues, customers and suppliers.
Back to Duty
B3: Takes an organised and methodical approach to their work and scrutinises own objectivity.
Back to Duty
B4: Takes personal responsibility for developing knowledge and skills and continually seeks to improve their performance.
Back to Duty
B5: Commitment to develop personal resilience and maintain wellbeing.
Back to Duty
B6: Sustainable practices and challenge unsustainable practices.
Back to Duty
B7: Support an inclusive culture and treat colleagues and external stakeholders fairly and with respect without bias or discrimination.
Back to Duty
Apprentices without level 2 English and maths will need to achieve this level prior to taking the End-Point Assessment. For those with an education, health and care plan or a legacy statement, the apprenticeship’s English and maths minimum requirement is Entry Level 3. A British Sign Language (BSL) qualification is an alternative to the English qualification for those whose primary language is BSL.
This standard aligns with the following professional recognition:
V1.1
This document explains the requirements for end-point assessment (EPA) for the digital forensic technician apprenticeship. End-point assessment organisations (EPAOs) must follow this when designing and delivering the EPA.
Digital forensic technician apprentices, their employers and training providers should read this document.
A full-time digital forensic technician apprentice typically spends 24 months on-programme. The apprentice must spend at least 12 months on-programme and complete the required amount of off-the-job training in line with the apprenticeship funding rules.
The EPA should be completed within an EPA period lasting typically 3 months.
The apprentice must complete their training and meet the gateway requirements before starting their EPA. The EPA will assess occupational competence.
An approved EPAO must conduct the EPA for this apprenticeship. Employers must work with the training provider to select an approved EPAO from the apprenticeship providers and assessment register (APAR).
This EPA has 2 assessment methods.
The grades available for each assessment method are below.
Assessment method 1 - observation :
Assessment method 2 - professional discussion:
The result from each assessment method is combined to decide the overall apprenticeship grade. The following grades are available for the apprenticeship:
|
On-programme - typically 24 months
|
The apprentice must:
|
|---|---|
|
End-point assessment gateway
|
The apprentice’s employer must be content that the apprentice is occupationally competent. The apprentice must:
For the professional discussion, the apprentice must submit a portfolio of evidence.
Gateway evidence must be submitted to the EPAO, along with any organisation specific policies and procedures requested by the EPAO. |
|
End-point assessment - typically 3 months
|
The grades available for each assessment method are below
Observation :
Professional discussion:
Overall EPA and apprenticeship can be graded:
|
|
Professional recognition
|
This apprenticeship aligns with:
This apprenticeship aligns with:
|
|
Re-sits and re-takes
|
|
The EPA is taken in the EPA period. The EPA period starts when the EPAO confirms the gateway requirements have been met and is typically 3 months.
The EPAO should confirm the gateway requirements have been met and start the EPA as quickly as possible.
The apprentice’s employer must be content that the apprentice is occupationally competent. That is, they are deemed to be working at or above the level set out in the apprenticeship standard and ready to undertake the EPA. The employer may take advice from the apprentice's training provider, but the employer must make the decision. The apprentice will then enter the gateway.
The apprentice must meet the gateway requirements before starting their EPA.
They must:
Portfolio of evidence requirements:
The apprentice must compile a portfolio of evidence during the on-programme period of the apprenticeship. It should only contain evidence related to the KSBs that will be assessed by this assessment method. It will typically contain 10 discrete pieces of evidence. Evidence must be mapped against the KSBs. Evidence may be used to demonstrate more than one KSB; a qualitative as opposed to quantitative approach is suggested.
Evidence sources may include:
This is not a definitive list; other evidence sources can be included.
The portfolio of evidence should not include reflective accounts or any methods of self-assessment. Any employer contributions should focus on direct observation of performance (for example, witness statements) rather than opinions. The evidence provided should be valid and attributable to the apprentice; the portfolio of evidence should contain a statement from the employer and apprentice confirming this.
The EPAO should not assess the portfolio of evidence directly as it underpins the discussion. The independent assessor should review the portfolio of evidence to prepare questions for the discussion . They are not required to provide feedback after this review.
Gateway evidence must be submitted to the EPAO, along with any organisation specific policies and procedures requested by the EPAO.
The assessment methods can be delivered in any order.
The result of one assessment method does not need to be known before starting the next.
In the observation with questions, an independent assessor observes the apprentice in their workplace and asks questions. The apprentice completes their day-to-day duties under normal working conditions. Simulation is not allowed. It gives the apprentice the opportunity to demonstrate the KSBs mapped to this assessment method.
The observation method is used due to the practical nature of the occupation. The assessor can witness the apprentice undertaking tasks required for occupational competence. As the apprentice is working on real case work this requires a long duration (7 hours observation) this must allow for operational interruptions as there is an element of unpredictability. The questions that are asked during the observation are to act as clarification.
The observation must be structured to give the apprentice the opportunity to demonstrate the KSBs mapped to this assessment method to the highest available grade.
An independent assessor must conduct and assess the observation .
The independent assessor must only observe one apprentice at a time to ensure quality and rigour. They must be as unobtrusive as possible.
The EPAO must give the apprentice 2 weeks' notice of the observation with questions.
The observation must take 7 hours.
The independent assessor can increase the time of the observation with questions by up to 10%. This time is to allow the apprentice to complete a task or respond to a question if necessary.
The observation with questions may take place in parts but must be completed within 2 working days. A working day is typically 7.5 hours. The reason for this split is To provide flexibility for the assessor, apprentice and employer.
The EPAO must manage invigilation of the apprentice during the assessment, to maintain security of the EPA, in line with their malpractice policy. This includes breaks and moving between locations.
The independent assessor must explain to the apprentice the format and timescales of the observation with questions before it starts. This does not count towards the assessment time.
The independent assessor should observe the following during the observation:
Apprentices must be observed, by an occupationally competent independent assessor. Completing operational casework in which they will demonstrate the KSBs assigned to this assessment. The EPAO will arrange for the observation to take place in consultation with the employer. The employer will make available casework which is at different stages of progression which will enable the apprentice to evidence against the themes of the KSBs;
· Operational delivery
· Theoretical underpinning knowledge
· Personal responsibility
· Technical application
· The legal/ policing context
· Communication
It is expected that the observation would take up to 7 hours to complete. Due to the nature of the practice, some operational examinations will not go as expected and therefore additional questions may be asked to check knowledge, skills, and behaviours of the apprentice.
Comfort breaks are permitted as necessary. The independent assessor has the discretion to increase the time of the observation(s) by up to 10% to allow the apprentice to complete the task that is part of this element of the EPA. The 7 hours allocated to this assessment can be split over 2 days in agreement with the employer and apprentice. The independent assessor may conduct and observe one apprentice during this assessment method.
These activities provide the apprentice with the opportunity to demonstrate the KSBs mapped to this assessment method.
The independent assessor must ask questions. Questioning can occur both during and after the observation.
To explore the breadth of knowledge for example testing what an apprentice would do in the event of a piece of work not going to plan. The questions will also ensure the apprentice is aware of their limitations, when to involve colleagues and refer to more experienced members of the team.
The time for questioning is included in the overall assessment time. The independent assessor must ask at least 5 questions. To remain as unobtrusive as possible, the independent assessor should ask questions during natural stops between tasks and after completion of work rather than disrupting the apprentice’s flow. The independent assessor must use the questions from the EPAO’s question bank or create their own questions in line with the EPAO’s training. Follow-up questions are allowed where clarification is required.
The independent assessor must ask questions about KSBs that were not observed to gather assessment evidence. These questions are in addition to the above set number of questions for the observation with questions and should be kept to a minimum.
The independent assessor must make the grading decision. The independent assessor must assess the observation and responses to questions holistically when deciding the grade.
The independent assessor must keep accurate records of the assessment. They must record:
The observation must take place in the apprentice’s normal place of work for example, their employer’s premises or a customer’s premises. Equipment and resources needed for the observation must be confirmed to be available by the EPAO, who can liaise with the employer to provide these. They must be in good and safe working condition.
Questioning that occurs after the observation should take place in a suitable environment, for example a quiet room, free from distractions and influence.
Additional venue requirements that must be in place include:
The assessor may need to sign a confidentiality agreement and will not be able to remove items from the workplace. Assessors may be required to complete police vetting.
The EPAO must develop a purpose-built assessment specification and question bank. It is recommended this is done in consultation with employers of this occupation. The EPAO must maintain the security and confidentiality of EPA materials when consulting with employers. The assessment specification and question bank must be reviewed at least once a year to ensure they remain fit-for-purpose.
The assessment specification must be relevant to the occupation and demonstrate how to assess the KSBs mapped to this assessment method. The EPAO must ensure that questions are refined and developed to a high standard. The questions must be unpredictable. A question bank of sufficient size will support this.
The EPAO must produce the following materials to support the observation :
The EPAO must ensure that the EPA materials are subject to quality assurance procedures including standardisation and moderation.
In the professional discussion, an independent assessor and apprentice have a formal two-way conversation. It gives the apprentice the opportunity to demonstrate the KSBs mapped to this assessment method.
The apprentice can refer to and illustrate their answers with evidence from their portfolio of evidence.
It provides the opportunity for the apprentice to demonstrate a distinction criterion. To describe previous work using the portfolio to underpin the discussion. The professional discussion provides the opportunity to demonstrate how an apprentice has followed standard operating procedures, worked with others and what they have done when tasks have not gone to plan including when to escalate.
The professional discussion must be structured to give the apprentice the opportunity to demonstrate the KSBs mapped to this assessment method to the highest available grade.
An independent assessor must conduct and assess the professional discussion.
Operational delivery
Theoretical underpinning knowledge
Personal responsibility
Technical application
The legal/ policing context
Communication
The EPAO must give an apprentice 2 weeks' notice of the professional discussion.
The independent assessor must have at least 2 weeks to review the supporting documentation.
The apprentice must have access to their portfolio of evidence during the professional discussion.
The apprentice can refer to and illustrate their answers with evidence from their portfolio of evidence however, the portfolio of evidence is not directly assessed.
The professional discussion must last for 90 minutes. The independent assessor can increase the time of the professional discussion by up to 10%. This time is to allow the apprentice to respond to a question if necessary.
The independent assessor must ask at least 8 questions. The independent assessor must use the questions from the EPAO’s question bank or create their own questions in line with the EPAO’s training. Follow-up questions are allowed where clarification is required.
The apprentice may choose to end the assessment method early. The apprentice must be confident they have demonstrated competence against the assessment requirements for the assessment method. The independent assessor or EPAO must ensure the apprentice is fully aware of all assessment requirements. The independent assessor or EPAO cannot suggest or choose to end the assessment methods early, unless in an emergency. The EPAO is responsible for ensuring the apprentice understands the implications of ending an assessment early if they choose to do so. The independent assessor may suggest the assessment continues. The independent assessor must document the apprentice’s request to end the assessment early.
The independent assessor must make the grading decision.
The independent assessor must keep accurate records of the assessment. They must record:
The professional discussion must take place in a suitable venue selected by the EPAO for example, the EPAO’s or employer’s premises.
The professional discussion can be conducted by video conferencing. The EPAO must have processes in place to verify the identity of the apprentice and ensure the apprentice is not being aided.
The professional discussion should take place in a quiet room, free from distractions and influence.
The EPAO must develop a purpose-built assessment specification and question bank. It is recommended this is done in consultation with employers of this occupation. The EPAO must maintain the security and confidentiality of EPA materials when consulting with employers. The assessment specification and question bank must be reviewed at least once a year to ensure they remain fit-for-purpose.
The assessment specification must be relevant to the occupation and demonstrate how to assess the KSBs mapped to this assessment method. The EPAO must ensure that questions are refined and developed to a high standard. The questions must be unpredictable. A question bank of sufficient size will support this.
The EPAO must ensure that the apprentice has a different set of questions in the case of re-sits or re-takes.
The EPAO must produce the following materials to support the professional discussion:
The EPAO must ensure that the EPA materials are subject to quality assurance procedures including standardisation and moderation.
Fail - does not meet pass criteria
|
Theme
KSBs
|
Pass
Apprentices must demonstrate all the pass descriptors
|
|---|---|
|
Operational Delivery
K5 K6 S2 S3 S4 S14 S16 S22 B3 |
Demonstrates the use of standard operating procedures for a digital forensic capture and preservation processes in a dynamic operational environment. K5,S2. Processes technical information effectively and accurately to provide critical thinking to issues and problems. S22. Applies standard methodologies while working in operational environments ensuring safe handling and storage of physical exhibits and personal or sensitive data'. S3, S14, B3. Follows organisational guidance for secure devices and preserving evidence, maintaining continuity and recording of chain of evidence for exhibits for disclosure purposes. S4, S16. Uses local procedures and decision making to progress devices through the evidential process. K6.
|
|
Theory
K8 |
Selects and applies digital forensic tools and software relevant to their role. K8. |
|
Personal Responsibility
S5 S6 S20 |
Conducts a dynamic risk assessment to ensure the safety of all parties when handling a common biohazard using the appropriate personal protective equipment. S20.
Applies considered decision making when their limits of competence and/or authority have been exceeded, escalating in line with organisational guidance. S5. S6.
|
|
Technical Application
S9 S10 S11 S12 S13 |
Demonstrates the process of effectively troubleshooting, diagnosing and correcting a real-world software, hardware, connectivity or network issue. S12Demonstrate(s) the correct use of write blocking techniques. S10. Identifies, sets up and uses hardware components and devices, managing applications software relevant to their role. S9, S11. Selects and uses digital forensic tools and software appropriate to the task. S13. |
|
Legal Context
S7 B1 |
Records seizures and/or examinations on standard forms in compliance with legislative and organisational ethical and professional guidance and procedures. S7, B1. |
|
Communication
K20 S17 |
|
Fail - does not meet pass criteria
|
Theme
KSBs
|
Pass
Apprentices must demonstrate all the pass descriptors.
|
Distinction
Apprentices must demonstrate all the pass descriptors and all of the distinction descriptors
|
|---|---|---|
|
Operational Delivery
K10 K12 K15 S15 S19 B6 |
Describes how to manage evidence ensuring continuity and integrity of evidence and how evidence relates to investigations. K10. Justifies their choice/selection of methods or tools for recovering digital evidence relevant to context. K12. Produces an example of giving preservation advice for physical evidence for new digital exhibits demonstrating an understanding of anticontamination and cross contamination considerations. S15. Acts in line with sustainable practices sustainable practices, and challenging unsustainable practices. B6. Explains the navigation and use of a quality management system explaining why the quality management system is used in the organisation K15, S19. |
Describes and explain the value of using additional methods or tools. K12.
Describes and explain the value of using additional methods or tools. K12. |
|
Theory
K4 K14 S1 |
Justifies the need for principles of working in relation to a controlled environment. K14. Demonstrates the use of terminology of digital forensic and terminology defined by the forensic science regulator and used in standard operating procedures. K4, S1.
|
N/A |
|
Personal Responsibility
K16 K17 K18 K19 S21 B4 B5 B7 |
Describes the importance of, and ways to keep technical knowledge up to date for different situations. B4, K19. Explains the risks associated with processing sensitive or distressing content and explain one strategy to develop personal resilience and maintain wellbeing. Describing how to access organisational support mechanisms. K17, S21, B5. Describes the health and safety procedures relevant to digital forensic technician role and the relevant legislation. K16. Describes the impact of diversity and inclusion such as on teamwork, client relationships and organisational strategies and how they take a collaborative approach to work with stakeholders and team members. K18, B7. |
N/A |
|
Technical Application
K9 K11 |
Identifies the appropriate forensic tools to be used in different working environments. K11. Describes the functions, features and limitations of at least one forensics tool, component or software. K9.
|
Explains how to appropriately select and utilise primary digital forensic tools in different working environment and describe the challenges of doing this outside of the laboratory environment. K11. Describes and evaluate the functions, features and limitations of the primary digital forensic tools used within your organisation. K9 |
|
Legal Context
K1 K2 K3 K7 |
Explains the application of Forensic Science regulators code of practice and activities on their practice, and the national good practice guidance for the capture and preservation of digital evidence. K3 K7. Describes what forensic science is, discuss roles and services and the considerations for maximising evidential capture and sequencing. K2. Evaluates the digital forensics technician role and how it contributes to investigations and the role they perform in the criminal justice process. K1. Explains the considerations for maximising evidential capture and sequencing across the forensic disciplines. K2.
|
Gives examples where forensic science practitioners consult and interact to maximise evidential capture. K2. |
|
Communication
K13 S8 S18 B2 |
Provides an example of establishing and maintain a positive relationship with a colleague, customer or supplier. B2. Describes evidential witness statements and explain how to present these statements in a courtroom or professional enquiry. S18. Explains at least two different ways of recording and presenting relevant investigative information, their appropriate use and presentation. Evaluate how to adapt communication methods for different audiences and explain where it is appropriate to use technical language. K13, S8.
|
Describes how to adapt communication methods for different audiences and explain where it is appropriate to use technical language. K13, S8. |
Performance in the EPA determines the overall grade of:
An independent assessor must individually grade the observation and professional discussion in line with this EPA plan.
The EPAO must combine the individual assessment method grades to determine the overall EPA grade.
If the apprentice fails one assessment method or more, they will be awarded an overall fail.
To achieve an overall pass, the apprentice must achieve at least a pass in all the assessment methods. To achieve an overall EPA distinction, the apprentice must achieve a distinction in the professional discussion and a pass in the observation.
Grades from individual assessment methods must be combined in the following way to determine the grade of the EPA overall.
| Observation | Professional discussion | Overall Grading |
|---|---|---|
| Fail | Pass | Fail |
| Pass | Fail | Fail |
| Pass | Pass | Pass |
| Pass | Distinction | Distinction |
If the apprentice fails one assessment method or more, they can take a re-sit or a re-take at their employer’s discretion. The apprentice’s employer needs to agree that a re-sit or re-take is appropriate. A re-sit does not need further learning, whereas a re-take does. The apprentice should have a supportive action plan to prepare for a re-sit or a re-take.
The employer and the EPAO should agree the timescale for a re-sit or re-take. A re-sit is typically taken within 1 months of the EPA outcome notification. The timescale for a re-take is dependent on how much re-training is required and is typically taken within 6 months of the EPA outcome notification.
Failed assessment methods must be re-sat or re-taken within a 6-month period from the EPA outcome notification, otherwise the entire EPA will need to be re-sat or re-taken in full.
Re-sits and re-takes are not offered to an apprentice wishing to move from pass to a higher grade.
The apprentice will get a maximum EPA grade ofif pass they need to re-sit or re-take one or more assessment methods, unless the EPAO determines there are exceptional circumstances.
| Roles | Responsibilities |
|---|---|
|
Apprentice |
As a minimum, the apprentice should:
|
|
Employer |
As a minimum, the apprentice's employer must:
|
|
EPAO |
As a minimum, the EPAO must:
|
|
Independent assessor |
As a minimum, an independent assessor must:
|
|
Training provider |
As a minimum, the training provider must:
|
The EPAO must have reasonable adjustments arrangements for the EPA.
This should include:
Adjustments must maintain the validity, reliability and integrity of the EPA as outlined in this EPA plan.
Special considerations
The EPAO must have special consideration arrangements for the EPA.
This should include:
Special considerations must maintain the validity, reliability and integrity of the EPA as outlined in this EPA plan.
Internal quality assurance refers to the strategies, policies and procedures that an EPAO must have in place to ensure valid, consistent and reliable EPA decisions.
EPAOs for this EPA must adhere to the requirements within the roles and responsibilities table.
They must also appoint independent assessors who:
undertaking of policing vetting
signing of confidentiality agreements
Affordability of the EPA will be aided by using at least some of the following:
This apprenticeship aligns with:
This apprenticeship aligns with:
| Knowledge | Assessment methods |
|---|---|
|
K1
The DFT role and how it contributes to investigations and the criminal justice process. Back to Grading |
Professional discussion |
|
K2
What are the considerations for maximising evidential capture and sequencing. Back to Grading |
Professional discussion |
|
K3
Forensic science regulators codes of practice and activities. Back to Grading |
Professional discussion |
|
K4
The digital forensics terminology. Back to Grading |
Professional discussion |
|
K5
Standard operating procedures to a dynamic operational environment. Back to Grading |
Observation |
|
K6
Make appropriate decisions of how to progress devices through the evidential process utilising local procedures. Back to Grading |
Observation |
|
K7
The national good practise guidance for the capture and preservation of digital evidence (For example the ACPO principles and NPCC Good Practises Advice manual). Back to Grading |
Professional discussion |
|
K8
The workings, principles and relevant use of a range of digital devices, peripherals and associated operating systems relevant to their role in digital forensics. Back to Grading |
Observation |
|
K9
Functions, features, and limitations of digital forensics tools, components and software. Back to Grading |
Professional discussion |
|
K10
Evidence management, continuity and integrity of evidence and how it relates to investigations. Back to Grading |
Professional discussion |
|
K11
Different forensic working environments and understand how to select and utilise forensic tools appropriate to the circumstances. Back to Grading |
Professional discussion |
|
K12
What other forensic evidence types can be recovered from devices and the best methods and sequence for evidential capture and preservation. Back to Grading |
Professional discussion |
|
K13
Different ways of recording and presenting relevant investigative information (reports, contemporaneous notes/statement writing) and how they should be appropriately used and presented. Back to Grading |
Professional discussion |
|
K14
The principles of working in a quality controlled setting. To include; knowledge of appropriate accreditation bodies, the quality management process/system and individual legal entities, individual expectations of working in a quality controlled environment. Back to Grading |
Professional discussion |
|
K15
Quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review, and how to navigate this information. Back to Grading |
Professional discussion |
|
K16
The health & safety procedures/legislation. Organisational sustainability procedures. Back to Grading |
Professional discussion |
|
K17
The risks of processing sensitive or potentially distressing content while understanding the benefits of good wellbeing working practices. Back to Grading |
Professional discussion |
|
K18
Awareness of the impact of diversity and inclusion such as on teamwork, client relationships and organisational strategies. Back to Grading |
Professional discussion |
|
K19
Understand the requirements for continual professional development within the industry. Back to Grading |
Professional discussion |
|
K20
Procedures for capturing and preserving evidence. Back to Grading |
Observation |
| Skill | Assessment methods |
|---|---|
|
S1
Use appropriate terminology defined by the forensic science regulator and included in standard operating procedures. Back to Grading |
Professional discussion |
|
S2
Standard operating procedures for a range of digital forensic capture and preservation processes. Back to Grading |
Observation |
|
S3
Apply standard methodology in a safe and effective way while working in operational environments. Back to Grading |
Observation |
|
S4
Demonstrate confidentiality, integrity, and availability limitations of secure devices and best practice methods for preserving evidence. Back to Grading |
Observation |
|
S5
Implement limitations of competency and authority and escalate when necessary. Back to Grading |
Observation |
|
S6
Considered decision making. Back to Grading |
Observation |
|
S7
Adhere to powers of seizure/examinations and legislation. Demonstrate compliance with this through the appropriate use of standard forms. Back to Grading |
Observation |
|
S8
Adopt communication methods suitable for audience. Using technical language where appropriate. Back to Grading |
Professional discussion |
|
S9
Identify, set up and use a range hardware components and devices. Back to Grading |
Observation |
|
S10
Demonstrate correct use of write blocking techniques. Back to Grading |
Observation |
|
S11
Manage applications software relevant to the role. Back to Grading |
Observation |
|
S12
Show an ability to troubleshoot real-world device and network issues effectively and diagnosing and correcting common software, hardware, or connectivity problems. Back to Grading |
Observation |
|
S13
Use features and functions of common specialist digital forensic tools and software. Selecting based on suitability. Back to Grading |
Observation |
|
S14
Understanding the responsibilities of data management. Back to Grading |
Observation |
|
S15
Provide preservation advice for physical evidence (DNA, fingerprints) for new digital exhibits, taking into account anticontamination and cross contamination. Back to Grading |
Professional discussion |
|
S16
Apply continuity of evidence and appropriate recording of a chain of evidence or an exhibit for disclosure purposes. Back to Grading |
Observation |
|
S17
Produce notes documenting activity undertaken during the capture and preservation processes; including the appropriate use of digital evidence/case management systems. Back to Grading |
Observation |
|
S18
Produce evidential continuity witness statements and demonstrate how to present in a courtroom or professional enquiry Back to Grading |
Professional discussion |
|
S19
Navigate and inform a quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review. Back to Grading |
Professional discussion |
|
S20
Conducting dynamic risk assessments, taking into account the safety of all parties and using PPE. Back to Grading |
Observation |
|
S21
Apply strategies to develop personal resilience and maintain welling, know how to access organisational support mechanisms. Back to Grading |
Professional discussion |
|
S22
Process technical information effectively and accurately to provide critical thinking to issues and problems. Back to Grading |
Observation |
| Behaviour | Assessment methods |
|---|---|
|
B1
Acts in an ethical and professional manner in the workplace. Back to Grading |
Observation |
|
B2
Builds and maintains positive relationships with colleagues, customers and suppliers. Back to Grading |
Professional discussion |
|
B3
Takes an organised and methodical approach to their work and scrutinises own objectivity. Back to Grading |
Observation |
|
B4
Takes personal responsibility for developing knowledge and skills and continually seeks to improve their performance. Back to Grading |
Professional discussion |
|
B5
Commitment to develop personal resilience and maintain wellbeing. Back to Grading |
Professional discussion |
|
B6
Sustainable practices and challenge unsustainable practices. Back to Grading |
Professional discussion |
|
B7
Support an inclusive culture and treat colleagues and external stakeholders fairly and with respect without bias or discrimination. Back to Grading |
Professional discussion |
| KSBS GROUPED BY THEME | Knowledge | Skills | Behaviour |
|---|---|---|---|
|
Operational Delivery
K5 K6 S2 S3 S4 S14 S16 S22 B3 |
Standard operating procedures to a dynamic operational environment. (K5) Make appropriate decisions of how to progress devices through the evidential process utilising local procedures. (K6) |
Standard operating procedures for a range of digital forensic capture and preservation processes. (S2) Apply standard methodology in a safe and effective way while working in operational environments. (S3) Demonstrate confidentiality, integrity, and availability limitations of secure devices and best practice methods for preserving evidence. (S4) Understanding the responsibilities of data management. (S14) Apply continuity of evidence and appropriate recording of a chain of evidence or an exhibit for disclosure purposes. (S16) Process technical information effectively and accurately to provide critical thinking to issues and problems. (S22) |
Takes an organised and methodical approach to their work and scrutinises own objectivity. (B3) |
|
Theory
K8 |
The workings, principles and relevant use of a range of digital devices, peripherals and associated operating systems relevant to their role in digital forensics. (K8) |
None |
None |
|
Personal Responsibility
S5 S6 S20 |
None |
Implement limitations of competency and authority and escalate when necessary. (S5) Considered decision making. (S6) Conducting dynamic risk assessments, taking into account the safety of all parties and using PPE. (S20) |
None |
|
Technical Application
S9 S10 S11 S12 S13 |
None |
Identify, set up and use a range hardware components and devices. (S9) Demonstrate correct use of write blocking techniques. (S10) Manage applications software relevant to the role. (S11) Show an ability to troubleshoot real-world device and network issues effectively and diagnosing and correcting common software, hardware, or connectivity problems. (S12) Use features and functions of common specialist digital forensic tools and software. Selecting based on suitability. (S13) |
None |
|
Legal Context
S7 B1 |
None |
Adhere to powers of seizure/examinations and legislation. Demonstrate compliance with this through the appropriate use of standard forms. (S7) |
Acts in an ethical and professional manner in the workplace. (B1) |
|
Communication
K20 S17 |
Procedures for capturing and preserving evidence. (K20) |
Produce notes documenting activity undertaken during the capture and preservation processes; including the appropriate use of digital evidence/case management systems. (S17) |
None |
| KSBS GROUPED BY THEME | Knowledge | Skills | Behaviour |
|---|---|---|---|
|
Operational Delivery
K10 K12 K15 S15 S19 B6 |
Evidence management, continuity and integrity of evidence and how it relates to investigations. (K10) What other forensic evidence types can be recovered from devices and the best methods and sequence for evidential capture and preservation. (K12) Quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review, and how to navigate this information. (K15) |
Provide preservation advice for physical evidence (DNA, fingerprints) for new digital exhibits, taking into account anticontamination and cross contamination. (S15) Navigate and inform a quality management system information associated with reporting, corrective action, validation, verification, individual competency and peer review. (S19) |
Sustainable practices and challenge unsustainable practices. (B6) |
|
Theory
K4 K14 S1 |
The digital forensics terminology. (K4) The principles of working in a quality controlled setting. To include; knowledge of appropriate accreditation bodies, the quality management process/system and individual legal entities, individual expectations of working in a quality controlled environment. (K14) |
Use appropriate terminology defined by the forensic science regulator and included in standard operating procedures. (S1) |
None |
|
Personal Responsibility
K16 K17 K18 K19 S21 B4 B5 B7 |
The health & safety procedures/legislation. Organisational sustainability procedures. (K16) The risks of processing sensitive or potentially distressing content while understanding the benefits of good wellbeing working practices. (K17) Awareness of the impact of diversity and inclusion such as on teamwork, client relationships and organisational strategies. (K18) Understand the requirements for continual professional development within the industry. (K19) |
Apply strategies to develop personal resilience and maintain welling, know how to access organisational support mechanisms. (S21) |
Takes personal responsibility for developing knowledge and skills and continually seeks to improve their performance. (B4) Commitment to develop personal resilience and maintain wellbeing. (B5) Support an inclusive culture and treat colleagues and external stakeholders fairly and with respect without bias or discrimination. (B7) |
|
Technical Application
K9 K11 |
Functions, features, and limitations of digital forensics tools, components and software. (K9) Different forensic working environments and understand how to select and utilise forensic tools appropriate to the circumstances. (K11) |
None |
None |
|
Legal Context
K1 K2 K3 K7 |
The DFT role and how it contributes to investigations and the criminal justice process. (K1) What are the considerations for maximising evidential capture and sequencing. (K2) Forensic science regulators codes of practice and activities. (K3) The national good practise guidance for the capture and preservation of digital evidence (For example the ACPO principles and NPCC Good Practises Advice manual). (K7) |
None |
None |
|
Communication
K13 S8 S18 B2 |
Different ways of recording and presenting relevant investigative information (reports, contemporaneous notes/statement writing) and how they should be appropriately used and presented. (K13) |
Adopt communication methods suitable for audience. Using technical language where appropriate. (S8) Produce evidential continuity witness statements and demonstrate how to present in a courtroom or professional enquiry (S18) |
Builds and maintains positive relationships with colleagues, customers and suppliers. (B2) |
Contact us about this apprenticeship
| Version | Change detail | Earliest start date | Latest start date | Latest end date |
|---|---|---|---|---|
| 1.1 | Occupational standard and end-point assessment plan revised. | 19/03/2024 | Not set | Not set |
| 1.0 | Approved for delivery | 01/03/2023 | 18/03/2024 | Not set |
Crown copyright © 2024. You may re-use this information (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence. Visit www.nationalarchives.gov.uk/doc/open-government-licence