We are widely recognised as the United Kingdom’s unit of excellence for digital forensic education, research and casework. Read more Read less

The Digital Forensics Unit (previously known as the Centre for Forensic Computing) was established in 1998 to meet a growing industry requirement for Digital Forensic Education. Led by Professor Tony Sammes, the unit was active in research, consultancy and education and led to the development of the MSc in Digital Forensics (previously known as MSc in Forensic Computing).

In December 2015, Dr Sarah Morris took over as Head of the Digital Forensics Unit, leading the MSc in Digital Forensics through a major course review and obtaining the first GCHQ certification for a Digital Forensics master's programme. Since then, with the assistance of Melissa Hadgkiss (Digital Forensics Support Officer), DFU has redeveloped its facilities, consultancy, and educational offerings. The unit has still maintained the same core principle over the past 20 years and focuses on education of digital forensics from first principles. Staff in DFU are case work active and where appropriate this feeds directly into teaching, and research avenues.

Our courses

We have set the standard for education in digital forensics in the United Kingdom since 1998 when the first course was delivered to the law enforcement community. All courses, which are aimed at the practitioner, are developed and delivered by leading experts in the field; the lectures given are, in the main, derived directly from real-world experiences. The majority of content taught on the courses is delivered in the DFU teaching laboratory, with each taught session having a practical exercise directly afterwards. This enables students to actively try the techniques being taught throughout the course.

Our students are educated in the correct methodology and practice for digital forensics, equipping them with the ability to think independently and to make informed decisions in relation to the entire range of forensic issues, from appropriate selection of tools, to awareness of broader legislative and corporate issues.

Supporting your business

The majority of the research conducted by the Unit arises directly from current cases. However, there is also an active research team investigating future challenges, approaches and producing cutting edge developments in Digital Forensics.

The Unit's research in Digital Forensics focuses on problems where standard methodologies and commercial tools provide limited assistance; for example encrypted or obscured data, deleted and fragmented files, or evidence that exists through the complex internal workings of operating systems. Also, the device may be difficult to acquire or have been used in a way that makes evidence extraction difficult; for example, recent cases investigated at the Unit included the investigation of a smart washing machine, and a computer whose data history was masked by the use of anti-forensic utilities.

Where appropriate, the findings from research carried out within the Unit are directly integrated into course teaching material, thus giving students access to the most up to date training possible.

Our background and pedigree as one of Europe's leading postgraduate academic institutions ensures that the Unit is able to offer research sponsors an assurance of quality and scientific rigour.

Our research

Current research projects:

• wireless acquisition of smart watches,
• documenting and standardising non-trivial acquisition approaches,
• game console forensics,
• document forensics,
• smart home forensics,
• identification of digital devices using crime scene dogs,
• volume shadow copy forensics,
• APFS file system forensics.

Research areas:

• digital investigation,
• open source intelligence techniques for digital forensics,
• device acquisition,
• file system forensics,
• data carving, data classification and reassembly,
• operating system forensics,
• document forensics,
• image forensics,
• communication forensics (including gaming, social media, and virtual reality).

Our facilities

Equipment and software:

  • All computers are bespoke and built to DFU specific requirements and we currently have over 100 computers.
  • Industry standard software including FTK, Encase, XRY, X-Ways and Blacklight are available within our laboratories.
  • The DFU uses a significant amount of free and open source software for their digital investigations and teaching.
  • An electronics lab to perform chip off forensic acquisition is also available.

Other facilities:

  • Physical and digital evidence stores;
  • Classroom management software employed throughout the DFU;
  • Virtual reality space is available for both VR forensics and also crime scene activities;
  • The DFU has several separate internal networks managed by DFU staff, this allows a wide range of digital forensic activities to be emulated.