Now available - the CCL Future of Digital Forensic Science Scholarship. For full details and how to apply: CCL Future of Digital Forensic Science Scholarship

Digital forensics is a prominent sub-branch of forensic science, where shared investigative skills, scientific fundamentals and inferences are applied to digital evidence. Over 90% of crime is now recognised as having a digital element, meaning digital forensic science sits at the heart of delivering justice in the 21st century, spanning the entire criminal justice system from crime scene to courtroom.

The application of digital forensics can be seen across many fields where technology is in operation (heath care, finance etc.), and subsequently involved in any alleged incident. Organisations are often required to have an incident response strategy in place and where an inquiry is needed, understanding the role that technology may have played requires those with digital forensic skills and knowledge. The forensic examination of digital devices and their data can now reveal important information that describes courses of conduct pertinent to any investigation. 

The MSc in Digital Forensics, offered by Cranfield University in partnership with CCL Solutions Group, (CCL) will seek to address the academically orientated operational needs of policing and serious skills shortage of educated and trained individuals in the field to fill digital forensic positions and support criminal justice systems and private sector.


  • Start dateOctober
  • DurationMSc: 13 months full-time, up to 3 years part-time, PgDip/PgCert: up to 12 months full-time, 2 years part-time
  • DeliveryTraditional lectures, computer-based practical exercises and independent study
  • QualificationMSc, PgDip, PgCert
  • Study typeFull-time / Part-time
  • CampusCranfield campus

Who is it for?

Digital forensics is becoming one of the most critical fields within forensic science.  As such, the Digital Forensics MSc at Cranfield University will help equip students with the necessary understanding of digital forensic science, courtroom skills and research methods to prepare them to practise as digital forensic professionals.

Exposure to up-to-date research targeted at addressing current real-world problems means that students will not just be academically prepared to enter the digital forensics field, but practically prepared for it too.  

Why this course?

The key aims of the course are to:

  • Provide students with an understanding of how digital forensic science can be used to help resolve issues in relation to civil and criminal law
  • Help equip students new to the field with the necessary understanding of digital forensic science, courtroom skills and research methods in order to prepare them to practise as digital forensic professionals
  • Enhance and develop existing practitioners’ knowledge and skills through in-depth academic research guided by acknowledged experts

Course details

Course delivery

Traditional lectures, computer-based practical exercises and independent study


Keeping our courses up-to-date and current requires constant innovation and change. The modules we offer reflect the needs of business and industry and the research interests of our staff and, as a result, may change or be withdrawn due to research developments, legislation changes or for a variety of other reasons. Changes may also be designed to improve the student learning experience or to respond to feedback from students, external examiners, accreditation bodies and industrial advisory panels.

To give you a taster, we have listed the compulsory and elective (where applicable) modules which are currently affiliated with this course. All modules are indicative only, and may be subject to change for your year of entry.

Course modules

Compulsory modules
All the modules in the following list need to be taken as part of this course.

Introductory Studies

Module Leader
  • Dr Graeme Horsman

    This module provides a general introduction to the awards associated with the MSc Digital Forensics, and the principles underpinning the course. It orients students and provides research skills to prepare students for their subsequent programme of study on the assessed modules. The discussion sessions provide students with an opportunity to network and gain confidence in expressing evidenced professional opinions.


    The emphasis in Introductory Studies is on preparing students access and use teaching and University resources. Topics include:

    • Course overview and module details,
    • Introduction to University facilities and using University Library,
    • Student obligations and expectations,
    • Coursework submission process and referencing standards,
    • Use of the Digital Forensic Labs specific resources.
Intended learning outcomes
Introductory Studies is designed to enable students to revise, consolidate and expand their skill and knowledge base so that they can derive maximum benefit from the course. On successful completion of this module you will be able to:
  • Self-evaluate their educational needs and plan remedial action as required,
  • Manage their studies using a range of IT,
  • Prepare coursework without recourse to plagiarism by fully acknowledging the contribution made by the work or ideas of others,
  • Work in accordance with University Health and Safety policy.


Digital Forensic Techniques and Traces

Module Leader
  • Dr Graeme Horsman

    The aim of this module is to provide students a thorough grounding in the fundamentals of common digital systems, the artefacts associated with such systems and techniques to identify, collect and analyse those artefacts. A mixture of theory and practice will facilitate the development of skills and experience across multiple computing platforms, including networking related artefacts. In addition to preparing students for real-world examination of computers, these skills will serve as a foundation for further study, including the Mobile Device Forensics and Internet-Based Investigations modules.


    Week 1:

    • Binary Data Structures and Encoding,
    • File Formats,
    • Disks Basics & Advanced Concepts,
    • FAT & NTFS File Systems,
    • Windows Forensics,
    • Metadata & Carving,
    • Analysis Techniques.

    Week 2:

    • Other File Systems,
    • Virtual Machines,
    • Windows Enterprise Systems,
    • Linux Forensics,
    • macOS Forensics,
    • Memory Forensics,
    • OSINT Investigation,
    • Cryptography and Encryption,
    • Cybersecurity & Malware.
Intended learning outcomes

On successful completion of this module you will be able to:

  • Given detailed knowledge of computer hardware, justify appropriate data acquisition strategies,
  • Recover digital evidence at different levels of abstraction from digital systems, both volatile (e.g. network and memory) and non-volatile (e.g. file systems, operating systems, applications),
  • Evaluate the reliability of digital evidence recovered from digital systems,
  • Given a set of instructions for a case, construct and carry out an appropriate strategy to recover appropriate and admissible digital evidence,
  • Create appropriate documentation to accompany a digital forensic investigation (e.g. notes and expert reports).


Introduction to Digital Crime and Investigation

Module Leader
  • Dr Graeme Horsman

    The aim of this module is to develop knowledge and understanding of the processes involved in the investigation of digital crime. These include the investigation of digital crime, the organization of digital systems, the seizure of digital evidence, the principles of device examination, the value of contemporaneous notes, the construction of reports and knowledge of relevant law.

    • Introduction to Digital Forensics
    • Legislation,
    • Handling Evidence,
    • Quality in Digital Forensics,
    • Digital Forensics Documentation e.g. notes, continuity and statements,
    • Computer Architecture,
    • Mobile Architectures,
    • Other Digital Devices,
    • Forensic Tools,
    • Disk Imaging,
    • Phone Extraction,
    • Hashing Evidence,
    • Analysis Techniques,
    • Live Examination & Triage.
Intended learning outcomes
On successful completion of this module you will be able to:
  • Explain selected fundamental technologies, techniques, processes, standards, and legislation applicable to digital forensics,
  • Construct an effective search and seizure plan for a digital investigation,
  • Perform a forensically sound acquisition of digital evidence,
  • Perform an examination of a digital evidence source using common techniques,
  • Create appropriate documentation to accompany a digital forensic investigation (e.g. notes, continuity, and statements).


Internet Based Investigations

Module Leader
  • Dr Graeme Horsman
    This module addresses various Internet based technologies and services, the artefacts that are associated with them and the analysis of the various parts of such internet/network connected systems, from servers and cloud services to computers and mobile devices.
    • Introduction to Networks & Internet,
    • Internet Services,
    • Web & Web Services,
    • Email Analysis,
    • Web Server Analysis,
    • Web Browser Analysis,
    • Social Media,
    • Dark Web,
    • Chat Services,
    • File Sharing & Peer to Peer.
Intended learning outcomes
On successful completion of this module you will be able to:
  • Construct a clear explanation of the design and implementation of networks, the Internet, and internet-based services,
  • Analyse the digital forensic artefacts left by web browsers, web servers, and other internet-based applications,
  • Interpret the artefacts left by internet-based applications through experimentation.


Programming for Digital Forensics

Module Leader
  • Dr Graeme Horsman
    The tools used in digital forensics may not extract all relevant data or interpret data comprehensively. This module arms students with the understanding and ability to use programming techniques for the identification, extraction and interpretation of data in a digital forensics context.
    • Introduction to Python,
    • The Atoms of Programming,
    • Syntax and Vocabulary,
    • Sequences and Loops,
    • File Handling and File Systems,
    • Text Processing,
    • Binary Processing,
    • SQLite,
    • Timestamps,
    • Dictionaries,
    • JSON,
    • XML,
    • 3rd Party Python Modules.
Intended learning outcomes
On successful completion of this module you will be able to:
  • Apply software development techniques to solve a problem in a digital forensic context,
  • Develop, implement, and document an appropriate test strategy for a programmatic solution to a digital forensics problem,
  • Write appropriate supporting documentation for a program that performs a digital forensics task,
  • Defend design decisions and implementation solutions made during the development of a programmatic solution to a digital forensics problem.


Mobile Device Forensics

Module Leader
  • Dr Graeme Horsman
    This module introduces the techniques and challenges encountered in the forensic examination of mobile devices. Students will learn about various technologies associated with mobile devices, procedures for preserving, collecting and analysing data, as well as related legal and procedural concerns. The module concentrates on the Android and iOS operating systems but includes an overview of other mobile and embedded devices, including non-smart phones and IoT technologies.
    • Legislation and Procedures,
    • Evidence Seizure and Preservation,
    • Network History and Technologies,
    • SIM Cards - Theory and Analysis,
    • Mobile Technologies and Artefacts,
    • iOS and Android - Smart Devices,
    • 'Dumb' Phones,
    • Call Data Records and Cell Site Analysis,
    • Backups and Cloud-based Evidence,
    • Advanced Extraction Techniques,
    • Other Mobile Devices & Trends.
Intended learning outcomes
On successful completion of this module you will be able to:
  • Construct a clear explanation of the technologies involved the result in the creation of mobile device evidence,
  • Select and perform appropriate techniques for the preservation and acquisition of mobile device evidence,
  • Select and perform appropriate techniques for the examination and interpretation of mobile device evidence. 


Investigation and Evidence Collection

Module Leader
  • Dr Hannah Moore
    To understand the core responsibilities of evidence recording and collection at the crime scene, both in general, and specifically related to operational constraints of a UK investigative context. To understand the operation of forensic and police investigators within the context of a major investigation.
    • Role of the CSI,
    • Scene approach,
    • Volume and major crime scenes,
    • Recording the scene,
    • Photography of the crime scene,
    • Search and location of evidence,
    • Evidence recovery techniques,
    • Evidence integrity and contamination issues,
    • Evidence evaluation,
    • Exhibiting and packaging,
    • ISO 17020.

Intended learning outcomes

On successful completion of this module you will be able to:

  • Analyse various different strategies of volume and major scene investigation to consider the effects of different approaches.
  • Compare the range of evidence collection and investigation techniques available to the crime scene investigator.
  • Evaluate the relative merits of the range of systematic crime scene procedures vital to successful investigations.
  • Evaluate which of these procedures are appropriate to a particular crime scene and apply these procedures appropriately during a crime scene exercise.
  • Create a crime scene report which objectively critiques the methodologies used and draws justified conclusions appropriate for the evidence.


Courtroom Skills

Module Leader
  • Roland Wessling
  • Dr Kate Hewins

    The module will provide an understanding of the role and responsibilities of expert witnesses in domestic and international criminal and civil cases and how they can present their evidence to the court effectively. You will also apply knowledge gained in previous modules to strengthen arguments presented in expert witness reports.

    • Role and legal responsibilities of the forensic expert,
    • Civil and criminal procedure rules,
    • Excellence in report and statement writing,
    • Presentation of evidence in court,
    • Preparation for examination-in-chief and cross-examination.
Intended learning outcomes

On successful completion of this module you will be able to:

  • Compare and contrast between the various legal systems and the concepts of criminal prosecution and civil litigation,
  • Evaluate and compose in the role and with the responsibilities of an expert witness,
  • Construct, formulate and appraise an effective expert witness report in compliance to legal requirements for such a document,
  • Construct a case to present oral evidence in court effectively and respond successfully to cross-examination, with an insight into how cross-examination is prepared.


Module Leader
  • Dr Graeme Horsman
    The aim of the project is to give the student an opportunity to solve a practical Digital Forensics problem using appropriate theory, concepts, methods, processes, tools and skills gained during the module study phase.
    • A ‘project skills’ day covering literature reviews, referencing, methodology and experiments in digital forensics, and other related topics,
    • Regular meetings with your project supervisor.
Intended learning outcomes
On successful completion of this module you will be able to:
  • Critically evaluate current existing research in a specific area of digital forensics,
  • Construct and justify an appropriate plan and research methodology for a digital forensics research project,
  • Conduct experiments or apply other digital forensic principles, techniques, or theories in the context of digital forensics research,
  • Evaluate the methods, experiments, techniques, and results in the context of digital forensic science,
  • Produce a dissertation that presents the research in a concise, clear, well-presented manner,
  • Defend the methodology and results in an oral examination.



The Digital Forensics MSc is accredited by BCS, The Chartered Institute for IT for the purposes of partially meeting the academic requirement for registration as a Chartered IT Professional.

BCS logo Chartered Institute for IT

Your career

The programme offers a highly effective springboard into many career opportunities. These include employment routes to Government and non-Governmental bodies, police departments and independent digital forensic consultants. It is also a necessary introduction that leads into conducting research at PhD level in the subject. The Digital Forensics MSc could be an important stepping-stone to an academic career in Digital Forensics.

Popular jobs roles in the digital forensics/cyber security sector include:

  • Junior OSINT Analyst,
  • Forensic eDiscovery Services,
  • Cyber Security Analyst,
  • Expert in Digital Forensics.

Cranfield Careers and Employability Service

Cranfield’s Career Service is dedicated to helping you meet your career aspirations. You will have access to career coaching and advice, CV development, interview practice, access to hundreds of available jobs via our Symplicity platform and opportunities to meet recruiting employers at our careers fairs. Our strong reputation and links with potential employers provide you with outstanding opportunities to secure interesting jobs and develop successful careers. Support continues after graduation and as a Cranfield alumnus, you have free life-long access to a range of career resources to help you continue your education and enhance your career.

How to apply

Click on the ‘Apply now’ button below to start your online application.

See our Application guide for information on our application process and entry requirements.