Delivered by the Cranfield Forensic Institute this course focuses on providing the knowledge and skills required to conduct comprehensive forensic examinations of digital devices. Guest lectures are delivered by Digital Forensic practitioners throughout the course, with guest lecturers coming from both law enforcement and private companies.
Please note the MSc is available as a full and part-time option. The PgCert and PgDip are only available as a part-time option.
The Digital Forensic MSc is available both full-time and part-time. Students will complete a number of taught modules each with theoretical and practical elements and, for the MSc, an individual research project.
Individual Project -
The individual project will involve academic research in a specific area of digital forensics. The student will produce a substantial dissertation detailing their investigation and findings. Students are pushed to produce high quality, novel research during this period, and research outcomes are often at the cutting edge of the subject.
The assessments on this course are a mixture of written and practical exams, oral presentations, coursework assignments and (MSc only) a thesis.
The coursework assignments vary, but will include conducting digital forensics examinations of disk images for particular scenarios, conducting research into the artefacts left by applications, and further written assignments on digital forensic processes and theory.
Start date, duration and location
Start date: Full-time: September. Part-time: September
Duration: Full-time MSc - one year, Part-time MSc - up to three years, Full-time PgCert - one year, Part-time PgCert - two years, Full-time PgDip - one year, Part-time PgDip - two years
(For MOD status students the duration may vary, subject to annual review.)
Teaching location: Shrivenham
Facilities and resources
There are comprehensive facilities and resources to support study on the Forensic Computing course.
Digital Forensics Laboratories -
The majority of taught modules will be delivered in a dedicated digital forensics teaching computer laboratory regularly reconfigured for different modules, and equipped with all the necessary hardware and software. For example for the “Mac OS X Forensics” module, the PCs are removed and replaced with Apple Macs, for the “Network” module students build their own network and connect to a domain, and for the “Forensic Computing using Linux” module the standard Windows build is replaced with Linux.
There is also a separate digital forensic student laboratory available for general use by students for coursework and research. This is equipped with the latest digital forensics software including Encase 6 and 7, FTK 5, Blacklight, NetAnalysis and WinHex.
In addition a digital forensics research laboratory is used by staff and by students conducting research projects. This contains mobile phone acquisition equipment, reconfigurable networks and customisable hardware.
A network forensics research laboratory is available for research into network protocols and evidence from servers.
A “Crime Scene Room” is used during search and seizure exercises where students will learn how to identify and secure the physical evidence upon which digital evidence resides. The room is equipped with cameras so actions can be recorded and played back in order to analyse and improve strategy and behaviour. It is reconfigured to simulate a variety of crime scenarios.
Learning resources -
Lectures are delivered almost exclusively in the digital forensics teaching laboratory and these along with the practical sessions are supported using Moodle, an open source Virtual Learning Environment ensuring that notes are available electronically. Exercises and exercise data can be downloaded for later study and interactive digital exercises can be used to support the learning of complex subjects.
The Barrington Library provides resources to support the main teaching material where electronic and physical access is available to the latest digital forensics journals including Digital Investigation. Access to the latest textbooks, digital forensics magazines, and past Cranfield digital forensics theses that date back to 2002 are also accessible. Cranfield University subscribes to the latest library databases so digital forensics papers located in non-specialist journals can also be easily located during research and assignments.
Full-time and part-time students will join together during classroom (residential study school) sessions. This is an ideal opportunity for networking.
Normally a first or second class Honours degree or equivalent in science, engineering or mathematics. Alternatively, a lesser qualification together with appropriate work experience may be acceptable.
The full-time course is ideally suited to recent graduates in a related subject such as Computer Science who wish to specialise in Forensic Computing. It is also suitable for those who have recently completed a BSc in Computer Forensics, Digital Forensics, Cybercrime Forensics or a related subject, who would wish to deepen their knowledge, improve their skills and increase their employability, in what is a very competitive market.
The part-time course is more suited to those already in full-time employment, such as law enforcement officers, government staff, security consultants, accountancy and banking organisations, corporate security personnel and members of associated agencies in both the UK and overseas. This programme could lead to a new career or promotion with an existing employer. Guidance may be sought by those who do not have the formal qualifications necessary to enrol immediately onto the programme, as to the best study route to take. Please contact us ([email protected])
English Language -
Students whose first language is not English must attain an IELTS score of 7