Digital Forensics
Recover, preserve, and analyse digital evidence to a forensically sound standard. Disk, memory, and network forensics for investigations, incident response, and legal proceedings.
Digital Forensics is a 42-hour program that teaches you to recover, preserve, and analyse digital evidence to a forensically sound standard. It is the discipline behind investigations, advanced incident response, and any matter that may end up in legal proceedings.
Who this course is for
It suits incident responders, security analysts, IT professionals supporting investigations, and anyone moving into a forensic role. A solid foundation in operating systems and networking is recommended.
What you will be able to do
You will acquire and preserve evidence without altering it, maintain a defensible chain of custody, perform disk and file-system forensics, analyse volatile memory, examine network artefacts, and produce clear, accurate reports suitable for technical and legal audiences. You will understand the legal and procedural requirements that make evidence admissible.
How it is taught
The course is built around realistic forensic scenarios using industry-standard tooling. You practise the methodical, well-documented process that distinguishes sound forensics from guesswork, and the curriculum aligns with recognised forensic certifications such as GCFE.
You leave able to conduct digital investigations that hold up under scrutiny — technical, organisational, and legal.
Curriculum
Forensic principles & chain of custody
Acquiring and preserving evidence to an admissible standard.
Disk & file-system forensics
Recovering and analysing data from storage media.
Memory forensics
Capturing and analysing volatile memory for evidence.
Network forensics
Reconstructing activity from network artefacts.
Reporting & expert testimony
Producing clear reports for technical and legal audiences.
Frequently asked questions
How does this differ from the Incident Response course?
Incident Response covers the full lifecycle of handling an incident, with forensics as one part. Digital Forensics goes much deeper into evidence acquisition, analysis, and the standards needed for investigations and legal proceedings.
Does it prepare me for forensic certifications?
Yes. The curriculum aligns with recognised certifications such as GCFE and emphasises the rigorous, documented methodology they require.