This module addresses the following indicative topics:

Digital Forensics Fundamentals:
Scope and purpose of digital and computer forensics
Role of digital forensics within criminal, civil, and organisational investigations
Simulations of situations with focus on accessibility and inclusion

Forensic Principles, Standards, and Ethics:
Forensic science principles and methodologies
Professional standards, guidelines, and best practice
Legal, ethical, and professional issues
Admissibility of digital evidence

Investigation Planning and Incident Response:
Incident response strategy and forensic readiness
Investigation scoping, planning, and documentation
Working within investigative teams and professional environments

Digital Evidence Acquisition and Preservation:
Evidence identification, acquisition, and preservation
Chain of custody and evidential integrity
Use of forensic equipment (e.g. write-blockers and imaging tools)

Operating Systems and File Systems Analysis:
Windows and macOS operating systems
File system structures and artefact analysis
Event reconstruction and evidential interpretation

Network, Online, and Mobile Forensics:
Network traffic and log analysis
Online investigations and digital traces
Mobile device forensic principles

Specialist and Emerging Forensic Domains:
Image, photograph, and video forensic principles
Vehicle and IoT forensic considerations

Forensic Tools and Systems Evaluation:
Use and evaluation of industry-standard forensic tools
Strengths, limitations, and appropriate tool selection

Professional Reporting and Communication:
Documentation and reporting of forensic findings
Communicating evidence to specialist and non-specialist audiences

BCS / TechSkills / Employability elements:
Legal, social, ethical and professional issues (central theme).
Methods, tools, techniques, and common guidelines used in the process of a formal forensic investigation.
Incident response / system recovery consideration in relation to forensic fundamentals.
Industry / Police standard tools explored, evaluated, and used in scenarios.

REPORT - Written Report – For this assessment you will assume the role of a digital forensic investigator and conduct a structured digital forensic investigation based on a provided case scenario and forensic image. You will be required to plan and justify an appropriate forensic approach, apply recognised acquisition and analysis techniques, and identify, interpret, and contextualise digital artefacts of evidential significance.

The assessment requires you to present your findings in a professionally structured digital forensic report, demonstrating evidential reasoning, ethical awareness, and legal and professional responsibilities when handling and reporting digital evidence.

EXAM - Examination – This assessment will evaluate your individual understanding of core digital forensic principles, theories, and professional standards underpinning forensic investigations. Students will be required to demonstrate knowledge of recognised forensic methodologies and guidelines, and to apply this understanding to reasoned investigative decision-making.

The examination will consist of a combination of multiple-choice questions, short-answer, and scenario-based questions requiring students to justify appropriate evidence acquisition and preservation strategies, and to analyse digital artefacts within investigative contexts in order to support reasoned conclusions. Emphasis will be placed on forensic reasoning, evidential integrity, and the application of forensic science principles rather than the use of specific tools.

Teaching and learning on this module will blend theoretical instruction with practical, applied learning to reflect professional digital forensic practice. Scheduled sessions will include lectures, tutorials, practical exercises, and demonstrations, enabling students to develop both conceptual understanding and hands-on investigative skills.

Lectures will introduce key digital forensic principles, methodologies, standards, and legal and ethical considerations, which will then be reinforced through practical exercises and demonstrations using realistic forensic scenarios and industry-standard tools. Tutorials will be used to re-enforce and apply theory to encourage an analytical and problem-based approach to forensic investigation and reflection on investigative decisions, evidential integrity, and professional practice.

You will be supported through drop-in sessions alongside independent study using case studies, academic literature, and professional guidance. Formative practical exercises will be embedded throughout the module to build confidence and prepare you for summative assessments.

1. Evaluate digital forensic principles, theories, standards, and professional guidelines in relation to computer systems and digital evidence.

Knowledge & Understanding
Reflection

2. Plan and execute digital forensic evidence acquisition.

Application & Problem-Solving

3. Analyse digital evidence, including file systems and operating system artefacts, to reconstruct events and support investigative conclusions.

Application & Problem-Solving
Digital Literacy

4. Produce digital forensic findings through structured documentation and reporting, reflecting on ethical, legal, and professional responsibilities when addressing specialist and non-specialist audiences.

Communication
Reflection

Wireshark
FTK Imager
EnCase
Autopsy
XRY
Machines and Devices for seizing and imaging

Abd El-Latif, A., Tawalbeh, L., Mohanty, M., Gupta, B. & Psannis, K. (Eds.) (2024) Digital Forensics and Cyber Crime Investigation: Recent Advances and Future Directions, CRC Press.

Nelson, B., Phillips, A. & Steuart, C. (2022) Guide to Computer Forensics and Investigations, 6th ed., Cengage Learning.

Kalderich, R. (2025) Practical Digital Forensics: Mastering Evidence Recovery (Practical Digital Forensics: Real-World Case Studies and Tools Book 1), Independently Published.

Holt, T, J et. al. (2022), Cybercrime and Digital Forensics: An Introduction, Routledge; 3rd edition.

Johansen, G, (2022), Digital Forensics and Incident Response: Incident response tools and techniques for effective cyber threat response, 3rd Edition, Packt Publishing; 3rd edition.

Ever wondered what are the key elements in Digital Forensics? Well in this module, you will learn the principles and practice of digital forensic investigation, focusing on how digital evidence is acquired, analysed, and presented in a forensically sound manner. You will explore forensic methods across a range of digital platforms, including computers and mobile devices, and gain practical experience using industry-standard tools and techniques. The module develops both technical and professional skills required for digital forensic investigations in legal and organisational contexts.