Core Skills in Data Recovery and Analysis


Computers, digital devices and electronic storage media are present in homes and businesses worldwide. Evidence of criminality exists on many computers and digital devices which requires sound methods of seizure, interrogation and presentation. This two-week course provides Forensic Computer Examiners with the skills to unlock this wealth of material and place it in the judicial arena.

Who should attend

​This course is designed for individuals who are setting out in the field of forensic computing or network investigation. This course is recommended and should be considered as the first step towards developing skills and knowledge required for the role of a Digital Forensic Examiner.


To equip Digital Forensic Examiners and investigators with the core skills in data recovery (electronic evidence) necessary to undertake, investigate and prosecute offences involving a high-tech element. This course contains both theory and practical exercises.


After attending this course, the participant will be able to identify electronic devices, digital storage media capable of containing electronic evidence and have a better understanding of how these devices function and store information. Further, gain a better understanding of disk geometry and structures where different partitioning schemes namely GPT, Dynamic Disks and MPT are in use including, File Systems namely FAT, NTFS and ExFAT. These will be explained in detail to assist understanding into how data is managed, making data recovery possible. Explain and identify evidential artefacts stored on Windows operating systems.

Entry requirements

​Individuals should already possess a good understanding of computers and common software applications, and have a working knowledge of computer operating systems.

Course Dates and Venues

Start dateEnd dateVenuePlaces
07/09/202018/09/2020RytonPlease email
28/09/202009/10/2020RytonPlease email
18/01/202129/01/2021RytonPlease email
01/02/202112/02/2021RytonPlease email
01/03/202112/03/2021RytonPlease email

Course duration

​10 days

Methods of delivery

Teaching sessions comprise of theory, demonstrations and hands-on practical exercises for students to contextualise their learning into data recovery, and identifying evidential issues relating to electronic evidence.

Assessment processes / accreditation details

The course is assessed with a theory and practical assessment providing evidence of learning, understanding, application and achievement.

Additional information



Cost to HO forces


£2236.00 Tuition Fee (Prices valid 1 April 2019 to 31 March 2020) £2300.50 Tuition fee (Prices are valid from 1 Oct 2019 for courses from 1 April 2020 to 31 March 2021)

The College of Policing uses cookies to collect and analyse information about the users of this website. We use this information to enhance the content and other services available on the site. By continuing to use our site, you are agreeing for us to set a small number of cookies. You can manage your preferences for Cookies at any time, for more information please see our Cookies Policy.