Sorry, you need to enable JavaScript to visit this website.

Core skills in data recovery and analysis

Seizure, interrogation and presentation of computer, digital device and electronic storage media.

Computers, digital devices and electronic storage media are present in homes and businesses worldwide.

Evidence of criminality exists on many computers and digital devices which requires sound methods of seizure, interrogation and presentation.

This course provides forensic computer examiners with the skills to unlock this wealth of material and place it in the judicial arena and contains both theory and practical exercises.


To equip digital forensic examiners and investigators with the core skills in data recovery (electronic evidence) necessary to undertake, investigate and prosecute offences involving a high-tech element.


After attending this course, the participant will be able to:

  • identify electronic devices, digital storage media capable of containing electronic evidence and have a better understanding of how these devices function and store information
  • explain and identify evidential artefacts stored on Windows operating systems
  • gain a better understanding of disk geometry and structures where different partitioning schemes namely GPT, dynamic disks and MPT are in use including, file systems namely FAT, NTFS and ExFAT

These will be explained in detail to assist understanding into how data is managed, making data recovery possible.

Methods of delivery

Teaching sessions comprise of theory, demonstrations and hands-on practical exercises for students to contextualise their learning into data recovery, and identifying evidential issues relating to electronic evidence.

Key details


​Individuals should already possess a good understanding of computers and common software applications and have a working knowledge of computer operating systems.

Practitioner group

​This course is designed for individuals who are setting out in the field of forensic computing or network investigation. It should be considered the first step towards developing skills and knowledge required for the role of a digital forensic examiner.


10 days.

Accreditation notes:

The course is assessed with a theory and practical assessment providing evidence of learning, understanding, application and achievement.


Home Office forces (non-residential):

Tuition fee: £2,300.50 (prices valid from 1 October 2019 for courses from 1 April 2020 to 31 March 2021)

Course contact
Was this page useful?

Do not provide personal information such as your name or email address in the feedback form. Read our privacy policy for more information on how we use this data

What is the reason for your answer?
I couldn't find what I was looking for
The information wasn't relevant to me
The information is too complicated