The aim of this course is to provide you with a thorough grounding in the fundamentals of common digital systems, the artefacts associated with such systems and techniques to identify, collect and analyse those artefacts. A mixture of theory and practice will facilitate the development of skills and experience across multiple computing platforms, including networking related artefacts. In addition to preparing you for real-world examination of computers, these skills will serve as a foundation for further study, including the Mobile Device Forensics and Internet-Based Investigations courses.

At a glance

  • Dates
    • Please enquire for course dates
  • Duration10 days
  • LocationCranfield campus
  • CostShort course £4,500, accredited short course £4,750

Course structure

Lectures and tutor guide classroom practical exercises followed by self-study

What you will learn

On successful completion of the course you will be able to:

  • Given detailed knowledge of computer hardware, justify appropriate data acquisition strategies.
  • Recover digital evidence at different levels of abstraction from digital systems, both volatile (e.g. network and memory) and non-volatile (e.g. file systems, operating systems, applications)
  • Evaluate the reliability of digital evidence recovered from digital systems
  • Given a set of instructions for a case, construct and carry out an appropriate strategy to recover appropriate and admissible digital evidence.
  • Create appropriate documentation to accompany a digital forensic investigation (e.g. notes and expert reports).

Core content

Week 1:

  • Binary Data Structures and Encoding,
  • File Formats,
  • Disks Basics & Advanced Concepts,
  • FAT & NTFS File Systems,
  • Windows Forensics,
  • Metadata & Carving,
  • Analysis Techniques.

Week 2:

  • Other File Systems,
  • Virtual Machines,
  • Windows Enterprise Systems,
  • Linux Forensics,
  • macOS Forensics,
  • Memory Forensics,
  • OSINT Investigation,
  • Cryptography and Encryption,
  • Cybersecurity & Malware.

Credits towards further study

Important notice

Please note we will not be taking registrations for the below courses (MSc, PgDip and PgCert) from the 2026-2027 academic year onwards:

Forensic Archaeology and Anthropology
Forensic Investigation
Digital Forensics
Counterterrorism, Security and Resilience

This means that we are no longer in a position to transfer credit associated with modules from these courses to Cranfield degree awards. We continue, however, to be able to support credit transfer to other university awards, subject to acceptance by the receiving institution.

This short course forms part of Digital Forensics and when successfully completed as an accredited short course you will gain 10 Cranfield learning credits.

Find out more about accredited short courses.

Speakers

Neil Parry

Read our Professional development (CPD) booking conditions.