Cranfield University

What you'll study

The programme combines core technical modules, applied laboratory work and a substantial individual project to give you practical experience of acquiring, analysing and reporting on digital evidence. Teaching emphasises current tools and methods for handling evidence from computers, mobile devices, networks and cloud services, together with the legal, ethical and procedural frameworks that govern forensic practice in the UK and internationally.

• Digital evidence acquisition and imaging — techniques for safe seizure, preservation and forensic imaging of storage media and volatile memory.
• File systems and data recovery — understanding common file systems, carving, deleted data recovery and artefact interpretation.
• Network and log forensics — capture and analysis of network traffic, log correlation, timeline construction and intrusion investigation.
• Malware analysis and reverse engineering — static and dynamic analysis approaches to understand malicious software behaviour and persistence mechanisms.
• Mobile and cloud forensics — specialised techniques for smartphones, tablets, cloud storage and SaaS platforms, and the challenges of remote evidence.
• Forensic programming and automation — scripting, tool development and automation to support repetitive tasks and bespoke investigations.
• Legal, ethical and investigative practice — admissibility of evidence, chain of custody, privacy law, professional standards and report writing for judicial or regulatory contexts.
• Research methods and project — research skills and a supervised dissertation or industry-facing project addressing a practical forensic problem.

Modules are delivered through a mix of lectures, practical laboratory sessions in purpose-equipped facilities, case studies and practitioner-led seminars. The individual project gives you the opportunity to apply skills to a realistic investigation or to explore an area of forensic research under academic supervision.

Entry requirements

Applicants are typically expected to hold a good honours degree (2:1 or 2:2 depending on relevant experience) in a relevant subject such as computer science, information security, forensic science, engineering, or a closely related discipline. Applicants with substantial professional experience in policing, incident response or IT forensics may also be considered. You should demonstrate practical competence in computing fundamentals and a clear interest in digital investigation.

For international applicants, evidence of English language proficiency is required in line with UK university standards (an approved English test at the level normally required for postgraduate study). Additional professional checks or security clearances may be necessary for some project placements or collaboration with government and defence organisations.

Career prospects

Graduates enter a range of roles across public and private sectors. Typical career paths include:

• Digital forensic analyst or examiner in law enforcement agencies and national police forces.
• Incident responder, threat analyst or malware analyst within corporate security teams and CERTs/CSIRTs.
• Forensic consultant or eDiscovery specialist working for consultancies, legal firms and specialist forensic providers.
• Forensic practitioner roles in defence, intelligence and critical infrastructure organisations.
• Further research or academic roles for those progressing to doctoral study in digital forensics and cyber security.

The programme’s industry-relevant curriculum, practical project experience and Cranfield’s links with employers help graduates to build portfolios of case work and contacts valued by recruiters in this field.

Why study at Cranfield University

Cranfield is a specialist postgraduate university with a strong emphasis on applied science, engineering and security. The university offers teaching and research that are closely aligned with industry and government needs, delivered in facilities designed for hands-on training and investigation. Students benefit from access to forensic laboratories, equipment for mobile and network analysis, and opportunities to undertake industry- or research-led projects that mirror real-world investigations.

Additionally, Cranfield’s connections with national agencies, defence organisations and commercial partners create pathways for project collaboration, guest lectures from practitioners and networking opportunities that support employability in the digital forensics sector.