Digital Forensic Analyst
Job title: Digital Forensic Analyst
Grade: PO 2
Role code: END0706
Status: Police Staff
Main purpose of the role:
Secure and retrieve data from seized digital devices, producing technical documentation in relation to data retrieved from digital devices, presenting evidence in court as required and advising police officers on all aspects of the forensic analysis of digital devices, in order to assist police officers with the gathering of evidence to support criminal prosecutions.
Main responsibilities:
- Secure and retrieve data from digital devices, including computers, digital cameras and satellite navigation systems, utilising proprietary and bespoke hardware and software, acquisition and processing the recovered data into a form suitable for investigators to examine for evidential content, ensuring that all such work is undertaken in accordance with Force policy, National guidelines, and the ACPO Good Practice Guide for Digital Evidence in relation to continuity and integrity of evidence.
- Present evidence in court, including the production of technical reports relating to information recovered from digital devices and results of internet based investigations, in order to support police officers investigations into crimes where digital devices have been utilised.
- Accompany police officers in the execution of search warrants, providing advice on correct methods of seizure and removal of equipment and conducting on site examinations as required, ensuring that all such activity conforms to Force policy and national legislation and guidelines, providing advice and support on case preparation in order to expertly present the findings obtained as a result of the seizure of a computer.
- Provide advice and guidance to interviewers on questions to be asked and the validity of answers given when interviewing suspects, exploring potential weaknesses in statements and provide technical advice and assistance to officers attempting to trace criminal suspects through digital networks, and in particular the internet, in order to assist investigating officers obtaining evidence.
- Develop and maintain specialised and up to date technical knowledge of both general and forensic procedures relating to digital devices, keeping abreast of developments within the digital industry, in order to secure the success of future investigations and to assist with the development of the forensic analysis service of digital devices for Essex Police.
- Deliver presentations, briefings and training to police officers as appropriate, including providing awareness training to colleagues on matters relating to hi tech crime investigations and the correct procedures for search and seizure of digital devices, in order to fully support investigations and to promote the role of the forensic analysis service.
- Liaise with industry representatives, especially those providing proprietary equipment used by the Unit, internet related organisations, on line merchants and representatives of other law enforcement agencies, in order to both gather information relevant to criminal investigations and to share best practice information.
- Provide a quality assurance role in respect of work provided by other agencies for the Force in relation to forensic evidence for digital devices, interpreting statements given and providing guidance on future actions to enable officers to understand the implications of findings and adjust investigations in the light of the information obtained.
June 2015
Vetting level:
Management Vetting (MV).
Necessary experience:
The post holder should possess at least 3 years digital forensics experience and be able to demonstrate a good knowledge of a range of operating systems, computer hardware/software, computer architecture and an understanding of the principles of data storage. Experience in the use of ENCASE and XRY is essential.
Good analytical skills are essential together with good interpersonal skills and the ability to communicate clearly both verbally and in writing in order to produce technical reports/statements in a clear and concise manner which can be understood by a non-technical audience. Creativity in presenting findings in an appropriate format is key.
The postholder must have confidence and professionalism in their work and be able to justify their investigations and recommendations.
The post holder will be working in a pressurised and highly sensitive environment often dealing with distressing material.
Behaviours:
Analyse Critically (Level 2)
I ensure that the best available evidence from a wide range of sources is taken into account when making decisions. I think about different perspectives and motivations when reviewing information and how this may influence key points. I ask incisive questions to test out facts and assumptions, questioning and challenging the information provided when necessary. I understand when to balance decisive action with due consideration. I recognise patterns, themes and connections between several and diverse sources of information and the best available evidence. I identify when I need to take action on the basis of limited information and think about how to mitigate the risks in doing so. I challenge others to ensure that decisions are made in alignment with our mission, values and the Code of Ethics.
Collaborative (Level 2)
I manage relationships and partnerships for the long term, sharing information and building trust to find the best solutions. I help create joined-up solutions across organisational and geographical boundaries, partner organisations and those the police serve. I understand the local partnership context, helping me to use a range of tailored steps to build support. I work with our partners to decide who is best placed to take the lead on initiatives. I try to anticipate our partners' needs and take action to address these. I do not make assumptions. I check that our partners are getting what they need from the police service. I build commitment from others (including the public) to work together to deliver agreed outcomes.
Deliver, Support and Inspire (Level 2)
I give clear direction and expectations, helping others to understand how their work operates in the wider context. I identify barriers that inhibit performance in my teams and take steps to resolve these, enabling others to perform. I lead the public and / or colleagues, where appropriate, during incidents or through the provision of advice and support. I ensure the efficient use of resources to create the most value and the right impact within my areas. I keep track of changes in the external environment, anticipating both the short and long term potential implications for the Police Service. I motivate and inspire others to achieve their best.
Emotionally Aware (Level 2)
I consider the perspectives of people from a wide range of backgrounds before taking action. I adapt my style and approach according to the needs of the people I am working with, using my own behaviour to achieve the best outcome. I promote a culture that values diversity and encourages challenge. I encourage reflective practice among others and take the time to support others to understand reactions and behaviours. I take responsibility for helping to ensuring the emotional well being of those in my teams. I take the responsibility to deal with any inappropriate behaviours.
Innovative and Open-minded (Level 2)
I explore a number of different sources of information and use a variety of tools when faced with a problem and look for good practice that is not always from policing. I am able to spot opportunities or threats which may influence how I go about my job in the future by using knowledge of trends, new thinking about policing and changing demographics in the population. I am flexible in my approach, changing my plans to make sure that I have the best impact. I encourage others to be creative and take appropriate risks. I share my explorations and understanding of the wider internal and external environment.
Take Ownership (Level 2)
I proactively create a culture of ownership within my areas of work and support others to display personal responsibility. I take responsibility for making improvements to policies, processes and procedures, actively encouraging others to contribute their ideas. I am accountable for the decisions my team make and the activities within our teams. I take personal responsibility for seeing events through to a satisfactory conclusion and for correcting any problems both promptly and openly. I actively encourage and support learning within my teams and colleagues.
Values:
Impartiality (Accredited)
I take into account individual needs and requirements in all of my actions. I understand that treating everyone fairly does not mean everyone is treated the same. I always give people an equal opportunity to express their views. I communicate with everyone, making sure the most relevant message is provided to all. I value everyone's views and opinions by actively listening to understand their perspective. I make fair and objective decisions using the best available evidence. I enable everyone to have equal access to services and information, where appropriate.
Integrity (Accredited)
I always act in line with the values of the police service and the Code of Ethics for the benefit of the public. I demonstrate courage in doing the right thing, even in challenging situations. I enhance the reputation of my organisation and the wider police service through my actions and behaviours. I challenge colleagues whose behaviour, attitude and language falls below the public's and the service's expectations. I am open and responsive to challenge about my actions and words. I declare any conflicts of interest at the earliest opportunity. I am respectful of the authority and influence my position gives me. I use resources effectively and efficiently and not for personal benefit.
Public Service (Accredited)
I act in the interest of the public, first and foremost. I am motivated by serving the public, ensuring that I provide the best service possible at all times. I seek to understand the needs of others to act in their best interests. I adapt to address the needs and concerns of different communities. I tailor my communication to be appropriate and respectful to my audience. I take into consideration how others want to be treated when interacting with them. I treat people respectfully regardless of the circumstances. I share credit with everyone involved in delivering services.
Transparency (Accredited)
I ensure that my decision-making rationale is clear and considered so that it is easily understood by others. I am clear and comprehensive when communicating with others. I am open and honest about my areas for development and I strive to improve. I give an accurate representation of my actions and records. I recognise the value of feedback and act on it. I give constructive and accurate feedback. I represent the opinions of others accurately and consistently. I am consistent and truthful in my communications. I maintain confidentiality appropriately.
Technical skills:
Computer/Telephone Evidence Recovery (Level 5)
Has a thorough understanding of the examination and analysis of computers and/ or telephone equipment and the laws affecting them and is able to apply this knowledge effectively to the role. Able to advise on the content of policy in relation to the seizure and examination of computers / telephone equipment thought to have been used in crime. Is experienced in giving evidence at court in complex cases.
Health and Safety (Level 3)
Has a basic understanding of Health and Safety issues affecting the current role and working environment. Takes responsibility for personal safety and the safety of others. Aware of hazards and reports problems identified to line manager. Understands and minimises the physical risk of injury through the use of proper manual handling procedures.
Information Management and Technology (Level 5)
Can retrieve information from computer searches across data source boundaries e.g. across a number of data sources, across county. Can analyse and compare data from such searches. Understands significance of findings and can provide guidance on the reliability of forecasts resulting from data analysis. Can monitor data quality in the work of others, and may manage the impact of data quality issues.
Interviewing - General (Level 3)
Demonstrates the ability to conduct effective routine interviews for a variety of purposes. Prepares and plans carefully and is clear about the purpose of the interview. Asks relevant questions and is able to obtain the required information. Regularly reviews personal interview performance. Adapts style to suit the needs of the interview.
Knowledge of Police Environment and Policy (Level 5)
Has a thorough understanding of the police service, nationally and locally, and is proactive in developing proposals which affect the way Kent Police and/or Essex Police operates. Possesses a detailed understanding of the inter-relationships between activities, roles, functions, and how organisation structures and police systems work. Understands and impacts on working procedures, practices and policies within areas of responsibility and ensures that these are followed at all times. Contributes to Force goals and is laccountable for delivering local business plan objectives.
Management of Police Information (MOPI) (Level 4)
Full compliance with Level 3. Has successfully completed all standard relevant Information Management and Security training package(s). Accurate use of Government Security Classification (GSC). Ensures physical and digital records are stored with appropriate security relevant to the sensitivity of the documents and has working understanding of appropriate National Retention Schedules. Is able to quality assure own records management processes as well as those of any staff for whom they have supervisory responsibility. Is aware of where to seek further support in relation to Records management within force when necessary. If nominated as an Information Asset Assistant is familiar with the NPCC Information Asset Owners Handbook.
Office Technology (Level 5)
Expert in the use of one or more office software products. Is proficient in the use of these packages to significantly enhance the quality and/or presentation of work required within the role. This is likely to relate to the use of spreadsheet, database or desktop publishing packages and may include the manipulation of reports, moving data between applications, using scanning or optical storage peripherals, etc. to make the best use of information Recognises and makes the best possible use of office systems and/or understands how office systems can be used to improve the way work is undertaken.
Risk Management (Level 5)
Able to anticipate, accurately define and establish the relative level of risk likely to affect their specialist function, in terms of likelihood and impact, together with how the challenges facing the wider organisation might affect their role within the force. Assesses the risks of national initiatives providing feedback at the relevant level. Has an understanding of pathways to alert all appropriate senior managers to flawed or ineffective control strategies and provide continuity/recovery options. Has an appreciation that seizing opportunities also generates risks.