Modern cybersecurity relies on digital forensics to investigate incidents, identify threats and support legal processes. This unit introduces the fundamental principles and practices used in digital forensic investigations and cyber incident analysis.

The unit begins by exploring the nature of digital evidence and how it is identified, preserved and handled in line with investigative standards. It then examines how computer systems store data from a forensic perspective, along with introductory techniques used in network and email investigations.

Building on this foundation, the course introduces key concepts in incident response, including the processes used to detect, analyse and document cyber incidents. Learners will also gain awareness of legal and procedural considerations in handling digital evidence.

Throughout the unit, learners will combine theoretical understanding with guided practical examples, developing the skills to interpret digital evidence, follow investigative workflows and contribute to basic cyber investigation activities.