Effective digital forensics begins with capturing the right data, the right way. This topic explores the critical process of acquiring and preserving digital evidence—whether in the field, on-site, or remotely—while maintaining forensic integrity. You’ll learn how to determine the most appropriate data acquisition methods, develop robust contingency plans, and operate essential forensic tools to validate and safeguard collected evidence. The topic also dives into the techniques used by cybercriminals to hide or obscure data, and how forensic specialists can detect and counteract these evasive strategies. This is where technical precision meets investigative insight.

File systems are rich sources of digital evidence—if you know where to look. In this topic, you'll explore how Windows, Linux, and MacOS file systems store, encrypt, and obscure critical data, and how forensic investigators can extract meaningful insights from them. You’ll examine the structure and functionality of various file systems, delve into Windows Registry analysis to uncover user activity, and learn to navigate challenges like full-disk encryption and password-protected startup environments. From boot sequences to hidden artifacts, this topic equips you with the skills to uncover what lies beneath the surface of digital storage.

Behind every successful digital investigation is a powerful toolkit. In this topic, you’ll explore the essential software tools used in computer forensics to locate, extract, and recover evidence from various storage media. You’ll learn how to evaluate and validate forensic tools based on reliability, speed, and investigative needs. Special focus is given to graphics file recovery, including strategies for identifying image formats, reconstructing files from raw data, and dealing with fragmented file recovery when metadata is missing or incomplete. This topic will sharpen your ability to choose the right tools and apply them with precision in complex investigations.

When time is critical and data is volatile, live forensics becomes essential. This topic focuses on how to capture real-time evidence from active systems, including RAM, network traffic, and transient processes, before they disappear. You’ll learn how to perform live acquisitions using specialist tools, understand when and how to apply live forensics techniques, and explore the risks, side effects, and legal considerations involved. Additionally, you’ll gain experience with network forensics methodologies—from identifying intrusions and unauthorised access to monitoring network traffic with minimal disruption. This is where digital forensics meets the urgency of live incident response.

In today’s hyper-connected world, mobile devices hold a wealth of digital evidence—from app activity and location data to communications and network usage. This topic explores the specialised field of mobile forensics, equipping you with the skills to extract, preserve, and analyse data from smartphones, tablets, and IoT devices. You’ll learn industry-standard data acquisition techniques, how to reconstruct a suspect’s activity profile, and the unique challenges posed by modern mobile ecosystems, including encryption, proprietary systems, and distributed data across networks. Whether investigating fraud, cybercrime, or insider threats, this topic prepares you to follow the digital trail through mobile and smart technologies.