MSc Digital Forensics and Cyber Investigations
With a clear focus on forensics and industry practices, this course equips you with the knowledge and skills to become a professional digital or cyber analyst, or investigator.
- Enrolment date: September and January
- Admission enquiries: 01642 738800
Digital forensics is a key part of your studies, alongside aspects of computer science. You apply core computer science principles within the context of a cyber investigation, considering how they can be used to collect, examine and interpret digital evidence. There is a strong emphasis on interpreting raw digital data and developing reverse engineering skills. In practical sessions, you use industry-standard software and practices, understanding the intelligence aspects of evidence and intelligence acquired from examining material.
Our dedicated digital forensics lab gives you access to forensic software used worldwide by industry practitioners to investigate digital devices, including forms of mobile device (mobile phones, tablets, drones). You also use the vehicle lab to examine Sat Nav and wifi-connected cars. And you use our crime scene house for digital investigations on devices such as smart speakers and smart video doorbells.The regulatory landscape within digital forensics is changing. Working with current professionals within the digital and forensic industries, this course addresses the key competencies you need in the digital forensics industry and exposes you to the range of careers available. We embed knowledge of ISO 17025 within the curriculum, providing you with legal and courtroom training using our replica courtroom facilities. We work closely with local police forces - Durham Constabulary, Cleveland Police and North Yorkshire Police. Durham Constabulary is one of our strategic partners, which offers research project opportunities.The course design also offers a flexible method of studying digital forensics and cyber investigation for existing practitioners to complete alongside their day jobs.
You learn about advanced digital forensic and cyber-investigation techniques. You are exposed to advanced topics, including complex data recovery, and advanced and non-standard data acquisition techniques. You cover threshold concepts in-depth and explore topics relating to current professional practice such as accreditation. You examine advanced topics with a focus on manually interpreting and verifying evidence. You learn through diverse, embedded sessions in the digital forensic laboratory.
In this module you explore advanced internet investigation techniques. You are exposed to advanced topics in computer and digital forensics associated with internet investigations, including browser data investigations, internet history recovery, cache reconstruction and the reverse engineering of browser log data. You are also exposed to privacy enhancing technologies such as in-private browsing and the implications of these technologies on forensic investigations. You learn suitable investigation techniques and methods for analysing and interpreting information related to an investigation where internet technologies are involved.You learn through diverse, embedded sessions in the digital forensic laboratory. Your assessment involves investigating an internet technology - you select an appropriate technology (browser, service, application) and forensically test its usage and document the forensic implications of its simulated use.
This module focuses on advanced mobile investigation techniques within the newly emerging specialist sub-discipline of mobile forensic investigation. You are exposed to topics which include data acquisition methods, advanced techniques such as jailbreaking and rooting, and methods of developer interaction with mobile devices including JTAG and similar techniques. Although you cover fundamental concepts, this is an advanced module. You cover threshold concepts in-depth and explore topics relating to current professional practice such as the challenges relating to acquiring data from handsets. You explore advanced topics with a focus on manually interpreting and verifying evidence. You learn through diverse, embedded sessions in the digital forensic laboratory.
You learn basic coding with teaching geared to providing support to first-time coders. Coding is primarily about data analysis, cleaning and merging data before it’s visualised in charts and tables. Learning some scripts to manipulate tabulated data is a valuable skill – and will become increasingly valuable when dealing with big data. You learn the principles of the programming language Python and how it can be used to change, group and strip out irregularities in data frames. Performing these simple scripts on large datasets makes life easier – it also provides a platform for you to be able to research on your own with publically available data. Cleansing data in this way makes utilising old favourites like Microsoft Excel much easier too.You study SQL (structured query language) to develop the skills to grab data from a database. Today everything from mobile phone data to performance business metrics in policing is packaged ready for extraction, provided the user has the knowledge and understanding to ‘query’ its contents.
You study crime theories, such as rational choice and routine activity packaged up in environmental criminology. You appreciate how the environment has the potential to facilitate or inhibit criminal behaviour. You consider problem-orientated policing and how we can use theoretical models to understand crime and responses to it – along with emerging debates as to whether traditional theories are still relevant with 21st-century online criminal activity. You study intelligence sources and the explosion of openly available material for analysis. You also consider the software and applications available for this research or data capture.
Forensic evidence of all types plays a major role in the detection of crime and the successful investigation of other types of incident such as road traffic collisions and natural disasters. You explore the legal and procedural contexts in which forensic science operates, providing you with opportunities to develop skills and knowledge for the gathering, examination and presentation of evidence in a range of situations.You attend a series of keynote lectures, seminars and a practical session in the University’s replica courtroom. You may have an opportunity to visit a local coroner’s office and/or court. You are assessed by a portfolio (30%) and evidence in the form of a written statement and verbal presentation in a simulated courtroom situation (70%).
On successful completion of the taught modules in Semester 1 and 2, you proceed to a 60-credit research project. This project gives you an opportunity to specialise in an area of your choice. Some of our students have had the opportunity to complete their research project on placement with an employer; in recent years these have included the Home Office Scientific Development Branch (now the Home Office Centre for Applied Science and Technology CAST), Key Forensics Ltd and Forensic Access. The following are some examples of past student project topics:• footwear and finger mark enhancement techniques• body fluid recovery methods and DNA profiling success rates• analysis of toolmarks in bone.
How you learn
Through this course you gain detailed knowledge and understanding of digital forensics, and the skills needed to carry out complex cyber investigations. You study the latest literature and methods in the field. You learn in a variety of ways including lectures, e-learning, seminars, case-based learning and laboratory sessions – you are also expected to study in your own time outside of classes. Reflective practice throughout is a key element of the course and you are encouraged to examine your own work, identify your own learning needs and challenges, whilst providing evidence of what is required to operate confidently, efficiently and ethically in the workplace. In this way, you develop an understanding of good practice and the ability to solve foreseen and unforeseen problems.
How you are assessed
Formative and summative assessments test your knowledge, independent thought and skills. You are assessed through coursework, including technical and laboratory reports, written and practical examinations, and your dissertation/thesis.
Successful graduates are equipped with the knowledge and skills needed to become a professional digital or cyber analyst or investigator. You are highly employable in the computer security and forensic intelligence fields.You also have the appropriate knowledge in advanced technical skills to get a job within a number of other careers such as within a government organisation, security services and the financial sector, forensic science agencies, the police service, Her Majesty’s Revenue and Customs, and trading standards.
Applicants are normally expected to have at least a 2.2 UK honours degree (or equivalent). A first degree in a computer-related subject such as computer science, IT, networks or cybersecurity is ideally suited to this MSc, but any other first degree which includes digital evidence in its syllabus is also acceptable. Please contact our admissions team if you need to discuss your eligibility. Non-UK students must also meet the University's minimum English language requirements.
For additional information please see the entry requirements in our admissions section
International applicants can find out what qualifications they need by visiting Your Country
- Enrolment date: September and January
- Admission enquiries: 01642 738800