This course will enable those who attend to develop the necessary knowledge and skills for the recovery of admissible evidence from computers which have been used to access or exchange data across the Internet.

At a glance

  • Dates
    • 20 - 24 Nov 2017
  • Duration5 days
  • LocationCranfield University at Shrivenham
  • Cost£1,750 Concessions available

Course structure

The course is delivered via practical sessions and lectures in the Centre for Forensic Computing’s dedicated classroom. The course culminates in both theory and practical examinations.

What you will learn

On successful completion of this course those attending will be able to: Explain the function and operation of common Internet protocols Interpret evidence recovered from the use of Web browsers Debate the attribution and reliability issues of Internet-derived evidence Recover evidence from Internet transactions.

Core content

  • Internet history, addressing and services, including the role of Internet authorities and registries
  • Internet architecture and protocols
  • IP addresses and domains
  • Web browser architectures and data
  • SQLite database binary analysis and query structure
  • ESE and index.dat data storage
  • Web server administration forensics
  • Social network artefacts
  • Email
  • Internet-specific crime.

Upgrade to a professional qualification

This short course will be taught at Masters standard as it is one of the modules that comprise the postgraduate Forensic Modular Masters Programme. Registering for this accredited short course and successfully passing the associated assessment will gain you 10 Cranfield credits. These could then be used to apply for a transfer towards a PgCert/PgDip or MSc in the Forensic Programme should you wish to complete one of these courses within 5 years.

Who should attend

This course is suitable for digital forensics investigators from law enforcement, private consultancies and government who wish to expand their knowledge and practical skills in the recovery of evidence relating to Internet use.

The course would also benefit those involved in network security or computer incident response.


£766 - Individual (anyone paying for themselves to attend).

£383 - Student (a current student from any university or a former student of Cranfield University).

Accommodation options and prices

Please contact us for information regarding accommodation.

Location and travel

Cranfield Defence and Security (CDS) is a Cranfield School based at the Ministry of Defence establishment on the Oxfordshire/Wiltshire borders.

Shrivenham itself lies in the picturesque Vale of the White Horse, close to the M4 motorway which links London and South Wales. It is 7 miles from Swindon, the nearest town, which lies off the M4 at the hub of Britain’s motorway network.

Bath, Cheltenham, Bristol and Oxford are all within an hour’s drive and London less than two hours away by car.

All visitors must be pre-booked in at reception by the person they are visiting on the campus.

For further location and travel details

Read our Professional development (CPD) booking conditions.