Effective digital forensics begins with capturing data correctly. This topic covers acquiring and preserving digital evidence, whether in the field, on-site, or remotely, while maintaining forensic integrity. You will learn to determine appropriate data acquisition methods, develop strong contingency plans, and operate key forensic tools to validate and safeguard collected evidence. The topic also covers techniques cybercriminals use to hide data, and how specialists detect and counteract these strategies. This combines technical precision with investigative insight.

File systems are rich sources of digital evidence. This topic shows how Windows, Linux, and MacOS file systems store, encrypt, and obscure data, and how forensic investigators extract insights. You will examine the structure and functionality of various file systems, analyze Windows Registry to uncover user activity, and address challenges like full-disk encryption and password-protected startup environments. From boot sequences to hidden artifacts, this topic provides skills to uncover what lies beneath digital storage.

A powerful toolkit supports every successful digital investigation. This topic covers the key software tools used in computer forensics to locate, extract, and recover evidence from various storage media. You will learn to evaluate and validate forensic tools based on reliability, speed, and investigative needs. Special focus is given to graphics file recovery, including strategies for identifying image formats, reconstructing files from raw data, and handling fragmented file recovery when metadata is missing. This topic sharpens your ability to choose the right tools and apply them with precision in complex investigations.

When time is critical and data is volatile, live forensics is vital. This topic focuses on how to capture real-time evidence from active systems, including RAM, network traffic, and transient processes, before they disappear. You will learn to perform live acquisitions using specialist tools, understand when and how to apply live forensics techniques, and explore the risks, side effects, and legal considerations involved. Additionally, you will gain experience with network forensics methodologies, from identifying intrusions and unauthorized access to monitoring network traffic with minimal disruption. This combines digital forensics with urgent incident response.

In today’s hyper-connected world, mobile devices hold a wealth of digital evidence, from app activity and location data to communications and network usage. This topic explores the specialised field of mobile forensics, equipping you with the skills to extract, preserve, and analyse data from smartphones, tablets, and IoT devices. You’ll learn industry-standard data acquisition techniques, how to reconstruct a suspect’s activity profile, and the unique challenges posed by modern mobile ecosystems, including encryption, proprietary systems, and distributed data across networks. Whether investigating fraud, cybercrime, or insider threats, this topic prepares you to follow the digital trail through mobile and smart technologies.