We are widely recognised as the United Kingdom’s unit of excellence for digital forensic education, research and casework. Read more Read less

The Digital Forensics Unit’s clients range from all areas of law enforcement to a wide spectrum of leading commercial organisations.

Since 1990, staff in the Unit have carried out several hundred digital forensic investigations. Traditionally focusing on providing forensic investigation and expert witness services in relation to highly complex specialised and particularly demanding cases, and often being called in to assist the courts where there is a dispute between experts; the Unit remains committed to this high-level service. Alongside the high-level capability, the Unit offers standard forensic computing investigation services, the focus being on providing timely, accurate and insightful reports.

Our courses

We have set the standard for education in digital forensics in the United Kingdom since 1998 when the first course was delivered to the law enforcement community. All courses, which are aimed at the practitioner, are developed and delivered by leading experts in the field; the lectures given are, in the main, derived directly from real-world experiences.

Our students are educated in the correct methodology and practice for digital forensics, equipping them with the ability to think independently and to make informed decisions in relation to the entire range of forensic issues, from appropriate selection of tools, to awareness of broader legislative and corporate issues.

Supporting your business

The majority of the research conducted by the Unit arises directly from current cases. However, there is also an active research team investigating future challenges, approaches and producing cutting edge developments in forensic computing.

The Unit's research in forensic computing focuses on problems where standard methodologies and commercial tools provide limited assistance; for example encrypted or obscured data, deleted and fragmented files, or evidence that exists through the complex internal workings of operating systems.

Also, the computer may have been used in a way that makes evidence extraction difficult; for example, recent cases investigated at the Unit included a system infected with malware, where it was difficult to determine the actual user’s behaviour, and a computer whose data history was masked by the use of anti-forensic utilities.

In addition to standard computers, digital forensic artefacts can be found in every device containing a computer; for example, GPS receivers, telephone answering machines, mobile telephones, games consoles, television receivers and one previous police case which involved a microwave oven. All of these devices may provide critical evidence, and require specialist software and hardware techniques to recover and validate data. Exploitation of such devices has featured in recent criminal investigations carried out by the Unit, as well as in research projects.

This work is complemented by research in closely related security fields, such as network intrusion, incident response and risk management. Current projects include Government, Research Council and industry-sponsored research.

Where appropriate, the findings from research carried out within the Unit are directly integrated into course teaching material, thus giving students access to the most up to date training possible.

Our background and pedigree as one of Europe's leading postgraduate academic institutions ensures that the Unit is able to offer research sponsors an assurance of quality and scientific rigour.