Digital forensics

Introduction to digital forensics

This module introduces digital forensics, its purpose, applications, investigation principles and role in cybersecurity and incident response.

Digital evidence and evidence handling

Learners explore how digital evidence is identified, collected, preserved, documented and handled while maintaining its integrity.

Forensic investigation methodology

This module introduces a structured approach to conducting digital forensic investigations from initial preparation through examination, analysis and reporting.

Forensic imaging and acquisition

Learners learn how forensic copies of storage media are created and verified for examination without unnecessarily altering the original evidence.

File systems and storage analysis

This module teaches learners how to understand and examine file systems and storage structures commonly encountered during forensic investigations.

Deleted data and file recovery Module description: Learners explore techniques for identifying and recovering potentially relevant information from deleted files and unallocated storage areas.

Windows digital forensics

This module focuses on common Windows artefacts that can provide evidence about user activity, system activity and application usage.

Linux digital forensics

Learners explore Linux systems and the types of artefacts that can be examined during a forensic investigation.

Memory forensics

This module introduces the examination of volatile memory to identify processes, network connections, users and other information that may not be available on disk.

Network forensics

Learners learn how network traffic and network artefacts can be examined to understand communications, suspicious activity and security incidents.

Browser and internet forensics

This module examines browser and internet-related artefacts that may provide information about web activity and user interactions.

Mobile device forensics

Learners are introduced to the principles and challenges of investigating smartphones and other mobile devices.

Cloud and remote evidence

This module introduces digital evidence stored in cloud platforms and remote services and explores the challenges involved in obtaining and analysing such evidence.

Malware and suspicious file analysis

Learners are introduced to basic forensic analysis of suspicious files and malware-related artefacts in a controlled laboratory environment.

Forensic tools and laboratory practices

This module introduces common categories of digital forensic tools and teaches learners how to organise a controlled forensic laboratory environment.

Legal, ethical and professional considerations

Learners explore the importance of lawful evidence handling, privacy, professional ethics and proper documentation during digital forensic investigations

Forensic reporting and presentation

This module teaches learners how to transform technical findings into clear, objective and professionally documented forensic reports.

Final digital forensics investigation

The final module combines the knowledge and practical skills developed throughout the course in a complete simulated digital forensic investigation