Conduct digital device seizures, extract and analyze information contained therein and report findings in support of investigation cases related to tax fraud

PRINCIPLE ACCOUNTABILITIES

1. Conduct device seizures in order to obtain the sources of digital information to support investigations

a) Lead digital forensic and cybercrime response efforts (seizures).

b) Where equipment is damaged, rebuild the system in order to recover lost data

c) Preserve and process electronic data according to the organisational policies and practices

2.  Extract, process and analyze information to support investigations

a) Recover and examine data from the electronic storage devices in order to use the data as evidence in criminal prosecutions or information purposes

b) Preserve and analyze data from electronic data sources

c) Investigate network intrusions to determine the cause and extent of the breach

3. Report about the findings to guide the investigations against tax fraud    

a)Form and articulate expert opinions based on analysis

b) Produce oral and written reports presenting complex technical matters clearly and concisely

c) Write up technical reports detailing how the computer evidence was discovered and all of the steps taken during the retrieval process

d) Support the on-going investigations by communicating the progress and any issues of all forensic support requests in the laboratory, and support the external referrals from other departments when requested

4. Conduct post forensic investigations activities to support the forensic investigations findings and build capacity among peers

a) Provide expert testimony in depositions, trials and other proceedings  regarding the evidence collected which may include a presentation of visual aids

b) Provide technical insights to fellow investigators on proper procedure

c) Research on new methodologies and digital forensic technology trends in the industry