The aim of this course is to provide those attending with the skills to recover forensic evidence from digital devices.

At a glance

  • Dates
    • 26 Nov - 07 Dec 2018
  • Duration10 days
  • LocationCranfield University at Shrivenham
  • Cost£3,500

Course structure

This course contains both theoretical and practical elements

What you will learn

On successful completion of this course those attending should be able to:

  • Construct an overall digital forensic workflow that satisfies the requirements of evidential admissibility
  • Construct, justify, and carry out a forensically sound process for disk imaging
  • Conduct detailed manual forensic reconstruction of stored data (e.g. disk partition, file system, operating system, and application structures) including artefacts that may be unreadable by standard forensic tools
  • Given a set of instructions for a case, construct an examination strategy to recover admissible digital evidence, and given a disk image, carry out that strategy to locate and extract digital evidence
  • Produce appropriate documentation to accompany a digital forensic examination, including notes, statements and reports.

Core content

  • Digital data storage, formats, structures, and interpretation
  • Computer architecture and boot process, including BIOS and UEFI
  • Hard disk structures and data retrieval process
  • Disk partitioning
  • File system analysis, FAT, NTFS and exFAT
  • Microsoft Windows forensic artefacts, e.g. Windows Registry, Link Files, Prefetch Files, Recycle Bin etc
  • An introduction to Mac OS X and Linux operating systems
  • Digital investigation strategies and processes, e.g. keyword searching, file carving etc
  • Writing notes and reports.

Who should attend

Prior knowledge of this subject is not required.


Cranfield University has become the first university for digital forensics in the UK to receive full certification from the UK Government Communications Headquarters, GCHQ, for the MSc Digital Forensics course. This short course is a module from the Digital Forensics Masters course.


Accommodation options and prices

Please contact us for information regarding accommodation.

Location and travel

Cranfield Defence and Security (CDS) is a Cranfield School based at the Ministry of Defence establishment on the Oxfordshire/Wiltshire borders. Shrivenham itself lies in the picturesque Vale of the White Horse, close to the M4 motorway which links London and South Wales. It is 7 miles from Swindon, the nearest town, which lies off the M4 at the hub of Britain’s motorway network. Bath, Cheltenham, Bristol and Oxford are all within an hour’s drive and London less than two hours away by car.

All visitors must be pre-booked in at reception by the person they are visiting on the campus.

For further location and travel details

Read our Professional development (CPD) booking conditions.