Reference and guide to SFIA version 6. Framework status: Canonical.

Digital forensics DGFS

The collection, processing, preserving, analysing, and presenting of computer-related evidence in support of security vulnerability mitigation and/or criminal, fraud, counterintelligence, or law enforcement investigations.

Digital forensics: Level 6

Sets policies and standards and guidelines for how the organisation conducts digital forensic investigations. Leads and manages complex investigations managing specialists if required. Authorises the release of formal forensics reports.

Digital forensics: Level 5

Conducts investigations to correctly gather, analyse and present digital evidence to both business and legal audiences. Collates conclusions and recommendations and presents forensics findings to stakeholders. Contributes to the development of policies, standards and guidelines.

Digital forensics: Level 4

Contributes to digital forensic investigations. Processes and analyses computer evidence in line with policy, standards and guideline and supports production of forensics findings and reports.