The aim of this course is to provide those attending with the skills to recover forensic evidence from digital devices.

At a glance

  • Dates
    • 23 Oct - 03 Nov 2017
  • Duration10 days
  • LocationCranfield University at Shrivenham
  • Cost£3,500 Concessions available

Course structure

This course contains both theoretical and practical elements

What you will learn

On successful completion of this course those attending should be able to:

  • Construct an overall digital forensic workflow that satisfies the requirements of evidential admissibility
  • Construct, justify, and carry out a forensically sound process for disk imaging
  • Conduct detailed manual forensic reconstruction of stored data (e.g. disk partition, file system, operating system, and application structures) including artefacts that may be unreadable by standard forensic tools
  • Given a set of instructions for a case, construct an examination strategy to recover admissible digital evidence, and given a disk image, carry out that strategy to locate and extract digital evidence
  • Produce appropriate documentation to accompany a digital forensic examination, including notes, statements and reports.

Core content

  • Digital data storage, formats, structures, and interpretation
  • Computer architecture and boot process, including BIOS and UEFI
  • Hard disk structures and data retrieval process
  • Disk partitioning
  • File system analysis, FAT, NTFS and exFAT
  • Microsoft Windows forensic artefacts, e.g. Windows Registry, Link Files, Prefetch Files, Recycle Bin etc
  • An introduction to Mac OS X and Linux operating systems
  • Digital investigation strategies and processes, e.g. keyword searching, file carving etc
  • Writing notes and reports.

Upgrade to a professional qualification

This short course will be taught at Masters standard as it is one of the modules that comprise the postgraduate Forensic Modular Masters Programme. Registering for this accredited short course and successfully passing the associated assessment will gain you 10 Cranfield credits. These could then be used to apply for a transfer towards a PgCert/PgDip or MSc in the Forensic Programme should you wish to complete one of these courses within 5 years.

Who should attend

Prior knowledge of this subject is not required.

Speakers

Concessions


Accommodation options and prices

Please contact us for information regarding accommodation.

Location and travel

Cranfield Defence and Security (CDS) is a Cranfield School based at the Ministry of Defence establishment on the Oxfordshire/Wiltshire borders.

Shrivenham itself lies in the picturesque Vale of the White Horse, close to the M4 motorway which links London and South Wales. It is 7 miles from Swindon, the nearest town, which lies off the M4 at the hub of Britain’s motorway network.

Bath, Cheltenham, Bristol and Oxford are all within an hour’s drive and London less than two hours away by car.

All visitors must be pre-booked in at reception by the person they are visiting on the campus.

For further location and travel details

Read our Professional development (CPD) booking conditions.