The course is designed to be a hands-on, practical experience where attendees not only examine the theory and principles behind manual examination practices, but also deploy these throughout the course on a range of test devices to witness first hand the implications of their actions and familiarise themselves with this technology.

In some cases, front line law enforcement staff may find themselves in a scenario that requires them to interrogate the contents of a digital device at the scene of a given incident, without the use of specialist forensic tools - a manual examination. Such instances may include ad hoc inquiries into suspected crimes following any disclosures made when attending an incident, or, where periodic monitoring checks are being carried out on an offenders device following the imposition of a supervisor order which dictates how the device should be used. Those undertaking this task must understand the following:

  • How to approach the manual interrogation of a device.
  • How to plan an effective manual examination of a device and define the remit of their conduct. - How to handle devices effectively.
  •  Where to look on a device for information that is potentially relevant to their inquiry.
  • How to interpret what they see.
  • How to collect such data.
  • The potential benefits, limitations and consequences of their actions on a device.


This course will address these points.

At a glance

  • Dates
    • Please enquire for course dates
  • Duration2 days
  • LocationCranfield campus
  • Cost£770

Course structure

Day 1:


- An introduction to manual device examinations.

  • What are they?

  • Why do we use them?

  • Benefits, limitations and risk of manual examinations.

  • Manual examinations, evidence implications and the ACPO principles.

- Preparing for device/metadata changes and how we can manage this. - A manual examination framework - our published 7 step approach.

- Horsman, G., 2022. Conducting a ‘manual examination’ of a device as part of a digital investigation. Forensic Science International: Digital Investigation, 40, p.301331.

- Planning and deploying a manual examination.



  • Mobile device manual examinations - iOS and Android devices.
  • Device preservation approaches
  • Getting familiar with device settings.
    - General.
    - App specific settings.
  • Understanding device core functions (communication, web browsing etc).
  • Identifying and iterating 3rd party Apps manually.

    Day 2:


  • Computer manual examinations - Windows
  • Device preservation approaches
  • Getting familiar with device settings.
  • Interrogating specific system functions

    - Comms protocols/services - Online behaviour traces.


  • Computer manual examinations - Mac

  • Device preservation approaches
  • Getting familiar with device settings.
  • Interrogating specific system functions

- Comms protocols/services - Online behaviour traces.

What you will learn

On completion of the course, you will be able to:

  • Plan and conduct and effective manual examination of a range of devices
  • Identify digital opportunities that can support your inquiries.

Who should attend

Law enforcement and those in an investigative role that requires the interaction with and interrogation of digital devices.

Accommodation options and prices

This course is non-residential. If you would like to book accommodation on campus, please contact Mitchell Hall or Cranfield Management Development Centre directly. Further information about our on campus accommodation can be found here.  Alternatively you may wish to make your own arrangements at a nearby hotel.

Location and travel

Situated close to Milton Keynes and Bedford, the Cranfield campus is situated in Wharley End, very close to Cranfield village, and is about 10 minutes from the M1 motorway.  There is rail and road access to most major airports as well as coach and train stations. Cranfield campus also has its own airport for private executive business travel.

Download a visitor guide including map, directions and health and safety information.

Campus address

College Road
MK43 0AL

How to apply

To apply for this course please use the online application form.

Read our Professional development (CPD) booking conditions.