Global Learning for Operational Leaders
Classroom
14 sessions
Scroll for more
Online / Live
14 sessions
Scroll for more
Introduction
Course overview
When cyber incidents, fraud or misconduct occur, organisations need to collect and analyse digital evidence in a way that is reliable and legally defensible. Mistakes in handling evidence can destroy its value.
This Aractech course explains digital forensics principles, evidence identification and acquisition, chain of custody, forensic analysis of computers, mobile devices, email and cloud, log analysis, reporting findings and working with legal teams and law enforcement. Participants conduct a simulated investigation.
The course is an introduction for IT, security, audit and investigation professionals.
What you will achieve
Learning objectives
- Explain digital forensics principles and legal considerations
- Identify and preserve digital evidence
- Maintain chain of custody
- Understand analysis of devices, email, cloud and logs
- Document and report forensic findings
- Work effectively with legal and investigation teams
Who should attend
Target audience
- IT security professionals
- Incident responders
- Fraud investigators
- Internal auditors
- Compliance officers
- IT managers
Methodology
Learning approach
- Technical presentations
- Demonstrations
- Simulated investigation
- Case studies
- Report writing
Complete course outline
Five focused days of learning and application
The timings provided are estimates and may vary depending on the number of participants and the discussions taking place during the sessions. They are indicative only and do not constitute a binding commitment.
Day 1
Digital Forensics Fundamentals
- Purpose and scope
- Legal and privacy considerations
- Forensic principles
- Types of evidence
- Coffee break
- Types of evidence (continued)
- Investigation process
- Exercise: Investigation planning
Day 2
Evidence Acquisition
- Identification
- Preservation
- Imaging
- Volatile data
- Coffee break
- Volatile data (continued)
- Chain of custody
- Demonstration: Evidence acquisition
Day 3
Analysis
- File system analysis
- Email analysis
- Mobile devices
- Cloud evidence
- Coffee break
- Cloud evidence (continued)
- Timelines
- Lab: Analysis exercise
Day 4
Logs and Network Evidence
- Log sources
- Network evidence
- Correlation
- Incident response links
- Coffee break
- Incident response links (continued)
- Case study: Insider data theft
- Exercise: Log review
Day 5
Reporting
- Forensic reports
- Expert testimony basics
- Working with lawyers
- Coffee break
- Working with lawyers (continued)
- Lessons learned
- Readiness
- Capstone: Investigation report
FAQ
Frequently asked questions
What does Digital Forensics and Evidence Handling (IMCS-013) cover?
This course covers IT Management and Cyber Security through a structured five-day outline focused on practical application, discussion, and implementation planning.
When is the next available session?
The next scheduled session starts on 16 - 20 November 2026. See the course schedules section for the available dates and delivery formats.
Who should attend this course?
IT security professionals, Incident responders, Fraud investigators
Is bilingual course delivery available?
Yes. All course materials and presentations are provided in English, while bilingual explanation and discussion support may be available depending on the selected location and trainer availability. For example, when attending a course in Istanbul, you may request a Turkish-speaking trainer to explain the English course content in Turkish. Arabic explanation support may also be requested at this location. Other languages are available in selected cities. You can choose your preferred language support as an optional preference during registration.
How can I register for a session?
Use any Register button next to the available course dates to open the participant registration page and submit your booking request for the selected session.
Is this course available online as well as classroom-based?
Check the course schedules section for currently published classroom and Online / Live sessions.
Where are classroom sessions delivered?
Current classroom venues include Barcelona, Paris, Munich, Amsterdam, London, Istanbul, Cape Town, Vienna.
How long is the training programme?
The programme runs for five days from 09:00 to 14:00, which gives 25 contact hours, including a daily 30-minute break (22.5 hours of instruction).
Quick request
Send quick request
Send a fast enquiry about this course and the academy team will get back to you.
Get a quotation
Request a formal quotation
Choose an available date and venue, add your participants, and we will email a formal quotation for Digital Forensics and Evidence Handling to your business address.