Digital Forensics and Incident Response (DFIR) – Practitioner Programme

A comprehensive, practitioner-level programme in digital forensics and incident response. Learn forensic principles, UK law and evidential standards, evidence acquisition, file system and Windows artefact analysis, memory and malware triage, macOS and Linux, network, cloud and Microsoft 365 investigations, mobile and emerging technologies, ransomware and insider investigations, timeline analysis and expert reporting. Finish with a hands-on capstone in which you analyse real-format artefacts from a fictional data theft case and write findings to an evidential standard.

Who this course is for: SOC analysts, incident responders, IT and security engineers, investigators, auditors, HR and legal professionals who support investigations, and anyone moving into a DFIR career. Familiarity with operating systems, networking and basic security concepts is expected (for example ICCSO's Cyber Security Fundamentals). No prior forensic experience is required.

Self-paced online learning. Earn a Certificate of Completion on passing.

What you will learn

  • Apply core forensic principles – integrity, order of volatility, chain of custody, hashing and documentation – and relevant UK standards and codes
  • Operate lawfully and ethically within the UK legal framework, including evidential, disclosure, privacy, monitoring and expert-witness duties
  • Plan forensic readiness and acquire evidence from live systems, memory, disks, virtual machines, cloud services and mobile devices
  • Analyse file systems, Windows registry, execution, user activity, USB and event log artefacts, and detect anti-forensic techniques
  • Investigate memory, malware, macOS and Linux systems, network evidence, and Microsoft 365, Entra ID, AWS, Azure and Google Cloud environments
  • Conduct ransomware, business email compromise, insider and data theft investigations, including determining whether data was exfiltrated
  • Build defensible timelines and write clear, accurate, reproducible forensic reports suitable for courts, tribunals, regulators and boards

Course modules

  • Foundations of digital forensics
  • Law, ethics and evidence
  • Forensic readiness and evidence acquisition
  • Storage, file systems and data recovery
  • Windows forensics
  • Memory, malware, macOS and Linux
  • Network, cloud and SaaS forensics
  • Mobile, emerging technology and media authenticity
  • Incident and internal investigations
  • Analysis, reporting and capstone