Digital Forensic Specialist

Job title: Digital Forensic Specialist
Grade: Grade F
Role code: SSC129
Status: Police Staff

Main purpose of the role:

The Digital Forensic Specialist is responsible for setting strategy for examination, utilising a range of specialised software and other techniques to secure and retrieve data in a legally admissible way from digital devices linked to crime and working in an ISO compliant way, evaluating, interpreting, and analysing, data in order to report results and provide evidential statements to support court proceedings. Provide advice, guidance and assistance to local officers and staff on the proportionate retrieval of data from digital devices, to support appropriate lines of enquiry, and understanding of relevant results for serious and major offences.

Main responsibilities:

• provide early advice to assist in the creation of an investigative strategy when digital devices have been used, challenging where needed on the requests for services required to ensure that the enquiries and work is justified, proportionate and necessary.
• set the digital strategy for the examination of digital devices to secure and retrieve data using a range of specialised software and other techniques in a legally admissible way working to relevant ISO accreditations and ensuring all activities are updated on the Forensic case management system.
• evaluate, interpret, and analyse the recovered data, formatting it in a suitable way for investigators to support to review and establish the evidential value, whilst ensuring that all activity work is in line with the quality management system.
• develop and maintain competence under ISO requirements sustaining an up- to-date technical knowledge of specialised Digital forensic procedures, and advancements within the Digital Forensic field liaising with internal and external colleagues in other specialisms in order to share good practice.
• provide advice and guidance in the suspect interview process for major and serious offences where the line of questioning is of an advanced technical nature, to assist investigating officers to obtain best evidence.
• present evidence in court when required, including the production and presentation of bespoke technical reports relating to digital evidence in support of the criminal justice process.
• accompany police officers when required in the execution of search warrants, linked to major and serious offences, providing specialist advice on correct methods of seizure and removal of equipment, and conducting on site examinations as required.
• utilise coaching methods and provide an environment that is participatory, supportive and provides constructive feedback on performance, assessing the skills, values, and knowledge of Digital Forensic Technicians against the standards that apply to their role to devise individual development plans for staff.

March 2023

Necessary experience:

The post holder will be educated to degree level in a relevant subject or equivalent and / or will be an experienced Digital Forensic Technician with at least 3 years experience gained from working in a policing environment. The post holder must demonstrate the ability to provide digital analytical capability for major and serious offences and experience of investigative strategies. Familiarity with sentencing guidelines for major and serious offences is preferable to devise appropriate digital forensic strategies.

The post holder will have significant knowledge in how digital devices function and how to harvest the data contained within them. They must be able to advise and guide across a range of digital disciplines including but not limited to mobile phones, computer, and CCTV forensics. They will be competent under ISO 17025 and maintain an environment that meets this accreditation standard.

The post holder will have knowledge of relevant legislation including: Regulation od Investigatory Powers Act, Data Protection and Criminal Procedures and Investigations Act (CPIA) legislation to provide the required advice and guidance. They will also need to keep abreast of changing technologies and be prepared to undergo continuous professional development.

This role requires effective problem solving, interpersonal, communication and influencing skills, together with strong customer focus. The post holder will be a self-motivated, and organised individual with the capability of prioritising competing demands with minimal supervision. The post holder will work a 7 day working shift pattern.

Behaviours:

Analyse critically (level 1)

I recognise the need to think critically about issues. I value the use of analysis and testing in policing. I take in information quickly and accurately. I am able to separate information and decide whether it is irrelevant or relevant and its importance. I solve problems proactively by understanding the reasons behind them, using learning from evidence and my experiences to take action. I refer to procedures and precedents as necessary before making decisions. I weigh up the pros and cons of possible actions, thinking about potential risks and using this thinking to inform our decisions. I recognise gaps and inconsistencies in information and think about the potential implications. I make decisions in alignment with our mission, values and the Code of Ethics.

Collaborative (level 1)

I work cooperatively with others to get things done, willingly giving help and support to colleagues. I am approachable, and explain things well so that I generate a common understanding. I take the time to get to know others and their perspective in order to build rapport. I treat people with respect as individuals and address their specific needs and concerns. I am open and transparent in my relationships with others. I ensure I am clear and appropriate in my communications.

Deliver, support and inspire (level 1)

I take on challenging tasks to help to improve the service continuously and support my colleagues. I understand how my work contributes to the wider police service. I understand it is part of my collective responsibility to deliver efficient services. I take personal responsibility for making sure that I am working effectively to deliver the best service, both individually and with others. I am conscientious in my approach, working hard to provide the best service and to overcome any obstacles that could prevent or hinder delivery. I support the efficient use of resources to create the most value and to deliver the right impact. I keep up to date with changes in internal and external environments. I am a role model for the behaviours I expect to see in others and I act in the best interests of the public and the police service.

Emotionally aware (level 1)

I treat others with respect, tolerance and compassion. I acknowledge and respect a range of different perspectives, values and beliefs within the remit of the law. I remain calm and think about how to best manage the situation when faced with provocation. I understand my own emotions and I know which situations might affect my ability to deal with stress and pressure. I ask for help and support when I need it. I understand the value that diversity offers. I communicate in clear and simple language so that I can be easily understood by others. I seek to understand the thoughts and concerns of others even when they are unable to express themselves clearly.

Innovative and open-minded (level 1)

I demonstrate an openness to changing ideas, perceptions and ways of working. I share suggestions with colleagues, speaking up to help improve existing working methods and practices. I constantly reflect on my own way of working and periodically review processes and procedures for continuous improvements. I adapt to change and am flexible as the need arises while encouraging others to do the same. I learn from my experiences and do not let myself be unduly influenced by preconceptions.

Take ownership (level 1)

I actively identify and respond to problems. I approach tasks with enthusiasm, focusing on public service excellence. I regularly seek feedback to understand the quality of my work and the impact of my behaviour. I recognise where I can help others and willingly take on additional tasks to support them, where appropriate. I give feedback to others that I make sure is understandable and constructive. I take responsibility for my own actions, I fulfil my promises and do what I say I will. I will admit if I have made a mistake and take action to rectify this. I demonstrate pride in representing the police service. I understand my own strengths and areas for development and take responsibility for my own learning to address gaps.

Values:

Impartiality (accredited)

I take into account individual needs and requirements in all of my actions. I understand that treating everyone fairly does not mean everyone is treated the same. I always give people an equal opportunity to express their views. I communicate with everyone, making sure the most relevant message is provided to all. I value everyone's views and opinions by actively listening to understand their perspective. I make fair and objective decisions using the best available evidence. I enable everyone to have equal access to services and information, where appropriate.

Integrity (accredited)

I always act in line with the values of the police service and the Code of Ethics for the benefit of the public. I demonstrate courage in doing the right thing, even in challenging situations. I enhance the reputation of my organisation and the wider police service through my actions and behaviours. I challenge colleagues whose behaviour, attitude and language falls below the public's and the service's expectations. I am open and responsive to challenge about my actions and words. I declare any conflicts of interest at the earliest opportunity. I am respectful of the authority and influence my position gives me. I use resources effectively and efficiently and not for personal benefit.

Public service (accredited)

I act in the interest of the public, first and foremost. I am motivated by serving the public, ensuring that I provide the best service possible at all times. I seek to understand the needs of others to act in their best interests. I adapt to address the needs and concerns of different communities. I tailor my communication to be appropriate and respectful to my audience. I take into consideration how others want to be treated when interacting with them. I treat people respectfully regardless of the circumstances. I share credit with everyone involved in delivering services.

Transparency (accredited)

I ensure that my decision-making rationale is clear and considered so that it is easily understood by others. I am clear and comprehensive when communicating with others. I am open and honest about my areas for development and I strive to improve. I give an accurate representation of my actions and records. I recognise the value of feedback and act on it. I give constructive and accurate feedback. I represent the opinions of others accurately and consistently. I am consistent and truthful in my communications. I maintain confidentiality appropriately.

Technical skills:

Computer/Telephone Evidence Recovery (Level 4)

Has a detailed understanding of the examination and analysis of computers and/ or telephone equipment and the procedures to be adopted. Is familiar with operating environments, storage mediums and structures, passwords and encryption, networks (including the Internet), PC's, minis and mainframes and telephone hardware applicable to role. Understands disk geometry and is able to explain evidence found in non technical terminology. Undertakes evidence recovery techniques and is aware of the format that is admissible in court. Gives evidence in court and is aware of how evidence should be presented. Is conversant with the principles and procedures that should be adopted when seizing computer / telephone equipment and is able to give advice to other officers. Has an understanding of the law relative to the role.

Crime Investigation (Level 4)

Able to recognise potential conflicts of interest between solicitors and suspects. Effectively plans and prepares work in order to progress investigations. Analyses results obtained from interviews etc., in order to identify further offences, offenders and lines of enquiry. Has a comprehensive understanding of identification policies, procedures and their applications. Submits high quality reports and case files within time limits. Has an appreciation of the operating practices of the intelligence unit.

Digital Crime (Level 4)

Able to secure digital evidence from devices through application of specialist training. Able to analyse and interpret data and identify ongoing opportunities for further evidence gathering. Has a comprehensive understanding of the way that digital evidence is recorded, stored and processed and how this can be used to identify the user of the data in an evidential format. Understands both policy and law concerning the handling and attribution of digital evidence.

Health & Safety (Level 4)

Has received Supervisor training and takes responsibility for the safety of directly subordinate staff and visitors. Understands the procedures in place for the safe storage of hazardous substances, fire precautions and evacuation. Resolves hazards or problems identified within roles or work environments. Undertakes skills passport assessments for new and existing staff. Re-assesses passport as and when new equipment /technology is introduced.Completes annual reviews of skills passports, training needs analysis.

Information Management & Technology (Level 5)

Can retrieve information from computer searches across data source boundaries e.g. across a number of data sources, across county. Can analyse and compare data from such searches. Understands significance of findings and can provide guidance on the reliability of forecasts resulting from data analysis. Can monitor data quality in the work of others, and may manage the impact of data quality issues.

Internal Consultancy (Level 4)

Demonstrates an in depth knowledge of the relevant specialist area and combines this with high level consultancy skills. Develops collaborative relationships with internal clients and works with them to achieve joint objectives and targets. Maintains an up to date awareness of all developments which may affect Force business and policies and proactively advises clients of all relevant matters.

Knowledge of Police Environment & Policy (Level 4)

Displays a general appreciation of changes affecting the police service. Understands the inter-relationships between the roles of the various Operational and Support activities, and how organisation structures and police systems work. Possesses a detailed understanding of working procedures, practices and policies relevant to the current role and the roles of subordinates and ensures that these are followed at all times. Is clear about Force goals and effectively contributes to local business plan objectives.

Management of Police Information (MOPI) (Level 5)

Has sufficient understanding of the NPCC records management policies be able to offer appropriate guidance and support to staff. Is able to identify the appropriate MOPI group for any record with a policing purpose and ensure that all policing records within the team are retained, reviewed or destroyed in line with the MOPI codes of practice. Quality assures staff to ensure a full understanding and compliance with the APP for Information Management (incorporating MOPI guidance), highlighting failings and taking appropriate action as required. Ensures training and / or refresher training is provided and completed. Ensures that systems are correctly linked together to ensure effective management and recording of information across systems. Appropriately reviews digital information held on system(s) and physical records in storage to ensure that they are retained only where there is a policing purpose. Complies with relevant policies and procedures in respect of prioritisation, sanitisation, dissemination, sharing, relevancy, accuracy, adequacy and timeliness.

Office Technology (Level 4)

Demonstrates advanced skills in the use of one or more office software products Able to use these packages to enhance the quality or presentation of work required within the role. Manages data files and file structures. Provides on the job training and guidance to other staff in the use of specific or specialist software, if required. Familiar with established IT rules and protocols and shows a good understanding of data protection requirements.

Research Techniques (Level 4)

Has a thorough understanding of research methods and is able to fully utilise these for a range of research projects. Able to analyse reports and data produced by other individuals/ organisations and extract relevant details to support the project in hand. Produces a range of options for consideration. Aware of the financial, organisational and service delivery implications of options.

Risk Management (Level 4)

Able to anticipate risks likely to affect the team's ability to execute their function, in terms of likelihood and impact, and assesses how the challenges facing the wider organisation might affect their team and their objectives. Has an understanding of pathways to alert local managers to flawed or ineffective operational control strategies and provide continuity/recovery options. Has an appreciation that seizing opportunities also generates risks.

National Occupational Standards:

AA1 (Level Accredited)

Promote equality and value diversity.