The aim of this course is to develop knowledge and understanding of advanced forensic computing techniques and to acquire the skills to apply these successfully. Read more Read less

The course covers a variety of current topics and is taught in a very practical manner. It is updated every year to reflect the constant developments within the field.

At a glance

  • Dates
    • 27 - 31 Mar 2017
    • 05 - 09 Mar 2018
  • DurationFive days
  • LocationCranfield University at Shrivenham
  • Cost£1,750. Concessions available

Course structure

A one week course with a substantial amount of practical sessions in a dedicated forensic computing lab. The sessions will be taught by a variety of lecturing staff with both academic and practitioner based backgrounds.

What you will learn

On successful completion of this course those attending should be able to:

  • Construct an overall digital forensic workflow that satisfies the requirements of evidential admissibility
  • Construct, justify, and carry out a forensically sound process for disk imaging
  • Conduct detailed manual forensic reconstruction of stored data (e.g. disk partition, file system, operating system, and application structures) including artefacts that may be unreadable by standard forensic tools
  • Given a set of instructions for a case, construct an examination strategy to recover admissible digital evidence, and given a disk image, carry out that strategy to locate and extract digital evidence
  • Produce appropriate documentation to accompany a digital forensic examination, including notes, statements and reports.

Core content

  • Forensic Analysis of the Registry and its binary format
  • Structure and Analysis of Optical Media Disk Formats
  • Virtual Machine Forensics
  • Forensic Analysis of Dynamic Disks, Spanned Disks, Striped Volumes
  • Approaches to Anti Forensic Techniques
  • Forensically Exploiting Operating System Indexes
  • Forensic Analysis of Volume Shadow Copies
  • Forensic Analysis of recently introduced features in Windows.

Upgrade to a professional qualification

This short course will be taught at Masters standard as it is one of the modules that comprise the postgraduate Forensic Modular Masters Programme. Registering for this accredited short course and successfully passing the associated assessment will gain you 10 Cranfield credits. These could then be used to apply for a transfer towards a PgCert/PgDip or MSc in the Forensic Programme should you wish to complete one of these courses within five years.

Who should attend

This course is suitable for: 

  • Those involved in forensic computing
  • Those wishing to deepen their understanding of forensic computing
  • Anyone wishing to refresh their forensic computing subject knowledge.

There are no prerequisites for this course.



£766 - Individual (anyone paying for themselves to attend)

£383 - Student (a current student from any university or a former student of Cranfield University)

A limited number of MOD sponsored places are available. 

Accommodation options and prices

Please contact us for information regarding accommodation.

Location and travel

Cranfield Defence and Security (CDS) is a Cranfield School based at the Ministry of Defence establishment on the Oxfordshire/Wiltshire borders.

Shrivenham itself lies in the picturesque Vale of the White Horse, close to the M4 motorway which links London and South Wales. It is 7 miles from Swindon, the nearest town, which lies off the M4 at the hub of Britain’s motorway network.

Bath, Cheltenham, Bristol and Oxford are all within an hour’s drive and London less than two hours away by car.

All visitors must be pre-booked in at reception by the person they are visiting on the campus.

For further location and travel details

Read our Professional development (CPD) booking conditions.