Digital forensics DGFS


Recovering and investigating material found in digital devices.

Guidance notes


Activities may include - but are not limited to...

  • collecting, processing, preserving, analysing, and presenting forensic evidence based on the totality of findings

The scope of digital forensics includes evidence on computers and any device capable of storing digital data. The evidence may be used in support of security vulnerability mitigation, criminal, fraud, counterintelligence, or law enforcement investigations.

Digital forensics: Level 6


Sets policies and standards and guidelines for how the organisation conducts digital forensic investigations. Leads and manages complex investigations engaging additional specialists if required. Authorises the release of formal forensics reports.

Digital forensics: Level 5


Conducts investigations to correctly gather, analyse and present findings including digital evidence to both business and legal audiences. Collates conclusions and recommendations and presents forensics findings to stakeholders. Contributes to the development of policies, standards and guidelines.

Digital forensics: Level 4


Contributes to digital forensic investigations. Processes and analyses evidence in line with policy, standards and guidelines and supports production of forensics findings and reports.