Forensic Evidence & Digital Forensics Course

Lesson 1 • Legal Framework for Evidence

Defines admissibility standards, rules of evidence, and expert witness requirements. Connects legal constraints to practical evidence-handling decisions.

Lesson 2 • Scientific Method in Forensics

Applies hypothesis-driven analysis, peer review, and error-rate awareness to forensic conclusions. Grounds all subsequent technical work in defensible scientific reasoning.

Lesson 3 • Types and Classification of Evidence

Categorises evidence as physical, biological, digital, and testimonial. Enables correct identification and prioritisation of evidence at any scene.

Lesson 4 • Ethics and Professional Standards

Covers codes of conduct, conflicts of interest, and reporting obligations for forensic professionals. Establishes ethical baseline required throughout the course.

Lesson 1 • Evidence Collection and Packaging

Specifies collection sequences, packaging materials, and labelling requirements for diverse evidence types. Prevents cross-contamination and degradation before laboratory analysis.

Lesson 2 • Scene Recognition and Safety

Identifies hazards, establishes perimeters, and prioritises responder safety before evidence collection. Prevents contamination and injury at the outset of any investigation.

Lesson 3 • Sketching and Mapping the Scene

Applies measurement techniques and diagramming tools to create accurate scene sketches. Supplements photography with spatial data for court exhibits.

Lesson 4 • Chain of Custody Principles

Defines continuous accountability for evidence from collection through court presentation. Demonstrates how custody gaps undermine admissibility.

Lesson 1 • Glass and Soil Forensic Analysis

Uses refractive index, elemental analysis, and particle size to characterise glass and soil. Provides associative evidence linking suspects to scenes.

Lesson 2 • Toolmark and Impression Evidence

Examines striated and impressed toolmarks, tyre tracks, and footwear impressions. Links physical marks to specific tools or sources through comparative analysis.

Lesson 3 • Fingerprint Identification Techniques

Covers latent, patent, and plastic print development, lifting, and comparison. Connects fingerprint analysis to individualisation and exclusion conclusions.

Lesson 4 • Questioned Documents Examination

Analyses handwriting, ink, paper, and printing processes to detect forgery and alteration. Produces findings admissible in fraud and identity crime cases.

Lesson 1 • STR Profiling and Interpretation

Generates and interprets short tandem repeat profiles using capillary electrophoresis. Connects allele calls to inclusion, exclusion, and inconclusive conclusions.

Lesson 2 • DNA Databases and Cold Cases

Explains national DNA database structure, upload criteria, and investigative lead generation. Applies database searching to unsolved case scenarios.

Lesson 3 • DNA Extraction and Quantification

Applies organic, Chelex, and differential extraction methods followed by quantitative PCR. Ensures sufficient, high-quality DNA for downstream profiling.

Lesson 4 • Biological Evidence Identification

Identifies blood, semen, saliva, and other biological fluids using presumptive and confirmatory tests. Establishes correct collection protocols to preserve DNA integrity.

Lesson 1 • Hashing and Evidence Verification

Applies MD5, SHA-1, and SHA-256 hashing to verify acquisition integrity. Demonstrates how hash mismatches indicate tampering or acquisition errors.

Lesson 2 • Digital Forensics Lab Setup

Specifies hardware, software, and environmental controls for a compliant forensic laboratory. Prepares students to configure and maintain a functional analysis environment.

Lesson 3 • Digital Evidence Fundamentals

Defines digital evidence, its legal standing, and unique volatility challenges. Establishes why digital evidence requires specialised handling distinct from physical evidence.

Lesson 4 • Forensic Acquisition Methods

Covers physical, logical, and targeted acquisition using write blockers and imaging tools. Ensures bit-for-bit copies that preserve original evidence integrity.

Lesson 1 • Timeline Analysis and Super-Timelines

Aggregates MAC timestamps, log entries, and artifact metadata into unified timelines. Enables chronological reconstruction of user and system activity.

Lesson 2 • macOS and Linux Forensics

Applies platform-specific artifact locations, log formats, and file system structures to non-Windows investigations. Expands examiner capability across operating systems.

Lesson 3 • Browser and Internet Artifact Analysis

Extracts history, cache, cookies, and download records from major browsers. Links online activity to investigation timelines and suspect behaviour.

Lesson 4 • Windows Artifact Analysis

Examines registry hives, prefetch files, event logs, and LNK files for user activity evidence. Connects Windows artifacts to specific user actions and timestamps.

Lesson 1 • Mobile Application and Data Analysis

Examines SMS, call logs, messaging apps, and social media artefacts stored on mobile devices. Recovers deleted messages and interprets application databases.

Lesson 2 • Log Analysis and Network Forensics

Parses firewall, router, DHCP, and DNS logs to reconstruct network-based events. Supports intrusion investigations and data exfiltration cases.

Lesson 3 • Mobile Device Acquisition Methods

Compares manual, logical, file system, and physical extraction techniques for iOS and Android. Selects appropriate method based on device state and encryption status.

Lesson 4 • Network Traffic Capture and Analysis

Captures packets using protocol analysers and filters traffic to identify relevant communications. Connects network activity to specific devices and user actions.

Lesson 1 • Evidence Presentation Techniques

Selects charts, annotated screenshots, and exhibits that communicate findings to non-experts. Aligns visual aids with report conclusions for courtroom clarity.

Lesson 2 • Case Review and Peer Auditing

Applies technical review checklists and peer audit processes to completed case files. Identifies errors before testimony and reinforces quality assurance habits.

Lesson 3 • Qualifying as an Expert Witness

Covers qualification procedures, voir dire preparation, and scope-of-expertise boundaries. Prepares students to establish credibility before judges and juries.

Lesson 4 • Forensic Report Structure and Standards

Defines required report sections, objective language standards, and documentation completeness. Produces reports that withstand legal scrutiny and peer review.