Skip to main content
Postgraduate study
Digital Forensics and Cyber Investigation

Digital Forensics and Cyber Investigation MSc

With a clear focus on forensics and industry practices, this course equips you with the knowledge and skills to become a professional digital or cyber analyst, or investigator.


Course overview

Digital forensics is a key part of your studies, alongside aspects of computer science. You apply core computer science principles within the context of a cyber investigation, considering how they can be used to collect, examine and interpret digital evidence. There is a strong emphasis on interpreting raw digital data and developing reverse engineering skills. In practical sessions, you use industry-standard software and practices, understanding the intelligence aspects of evidence and intelligence acquired from examining material.

Our dedicated digital forensics lab gives you access to forensic software used worldwide by industry practitioners to investigate digital devices, including forms of mobile device (mobile phones, tablets, drones). You also use the vehicle lab to examine Sat Nav and wifi-connected cars. And you use our crime scene house for digital investigations on devices such as smart speakers and smart video doorbells.The regulatory landscape within digital forensics is changing. Working with current professionals within the digital and forensic industries, this course addresses the key competencies you need in the digital forensics industry and exposes you to the range of careers available. We embed knowledge of ISO 17025 within the curriculum, providing you with legal and courtroom training using our replica courtroom facilities. We work closely with local police forces - Durham Constabulary, Cleveland Police and North Yorkshire Police. Durham Constabulary is one of our strategic partners, which offers research project opportunities.The course design also offers a flexible method of studying digital forensics and cyber investigation for existing practitioners to complete alongside their day jobs.

Download pdf Order prospectus


Course details

Course structure

Core modules

Advanced Forensic Computing

You learn about advanced digital forensic and cyber-investigation techniques. You are exposed to advanced topics, including complex data recovery, and advanced and non-standard data acquisition techniques. You cover threshold concepts in-depth and explore topics relating to current professional practice such as accreditation. You examine advanced topics with a focus on manually interpreting and verifying evidence. You learn through diverse, embedded sessions in the digital forensic laboratory.

Advanced Internet Forensics

In this module you explore advanced internet investigation techniques. You are exposed to advanced topics in computer and digital forensics associated with internet investigations, including browser data investigations, internet history recovery, cache reconstruction and the reverse engineering of browser log data. You are also exposed to privacy enhancing technologies such as in-private browsing and the implications of these technologies on forensic investigations. You learn suitable investigation techniques and methods for analysing and interpreting information related to an investigation where internet technologies are involved.

You learn through diverse, embedded sessions in the digital forensic laboratory. Your assessment involves investigating an internet technology - you select an appropriate technology (browser, service, application) and forensically test its usage and document the forensic implications of its simulated use.

Advanced Mobile Forensics

This module focuses on advanced mobile investigation techniques within the newly emerging specialist sub-discipline of mobile forensic investigation. You are exposed to topics which include data acquisition methods, advanced techniques such as jailbreaking and rooting, and methods of developer interaction with mobile devices including JTAG and similar techniques. Although you cover fundamental concepts, this is an advanced module. You cover threshold concepts in-depth and explore topics relating to current professional practice such as the challenges relating to acquiring data from handsets. You explore advanced topics with a focus on manually interpreting and verifying evidence. You learn through diverse, embedded sessions in the digital forensic laboratory.

Coding for Intelligence Analysts

You learn basic coding with teaching geared to providing support to first-time coders. Coding is primarily about data analysis, cleaning, and merging data before it’s visualised in charts and tables. Learning some scripts to manipulate tabulated data is a valuable skill – and will become increasingly valuable when dealing with big data. You learn the principles of the programming language Python and how it can be used to change, group, and strip out irregularities in data frames. Performing these simple scripts on large datasets makes life easier – it also provides a platform for you to be able to research on your own with openly available data. Cleansing data in this way makes utilising old favourites like Microsoft Excel much easier too.

You study SQL (structured query language) to develop the skills to grab data from a database. Today everything from mobile phone data to performance business metrics in policing is packaged ready for extraction, provided the user has the knowledge and understanding to ‘query’ its contents.

Computing Masters Project

You undertake a major, in-depth, individual study in an aspect of your course. Normally computing master’s projects are drawn from commercial, industrial or research-based problem areas. The project involves you in researching and investigating aspects of your area of study and then producing a major deliverable, for example software package or tool, design, web-site and research findings. You also critically evaluate your major deliverable, including obtaining third party evaluation where appropriate.

The major deliverable(s) are presented via a poster display, and also via a product demonstration or a conference-type presentation of the research and findings. The research, project process and evaluation is reported via a paper in the style of a specified academic conference or journal paper. The written report, the major deliverable and your presentation of the product are assessed.

The project management process affords supported opportunities for goal setting, reflection and critical evaluation of achievement.

Crime Science: Theories, Principles and Intelligence Sources

You study crime theories and principles, such as rational choice, routine activity, problem profile models packaged up in environmental criminology. You appreciate how the environment has the potential to facilitate or inhibit criminal behaviour. You consider problem-orientated policing and how we can use theoretical models to understand crime and responses to it – along with emerging debates as to whether traditional theories are still relevant with 21st-century online criminal activity. You study intelligence sources and the explosion of openly available material for analysis. You also consider the software and applications available for this research or data capture.

Legal Issues and Evidence Reporting

Forensic evidence of all types plays a major role in the detection of crime and the successful investigation of other types of incident such as road traffic collisions and natural disasters. You explore the legal and procedural contexts in which forensic science operates, providing you with opportunities to develop skills and knowledge for the gathering, examination and presentation of evidence in a range of situations.

You attend a series of keynote lectures, seminars and a practical session in the University’s replica courtroom. You may have an opportunity to visit a local coroner’s office and/or court. You are assessed by a portfolio (30%) and evidence in the form of a written statement and verbal presentation in a simulated courtroom situation (70%).


Modules offered may vary.


How you learn

Through this course you gain detailed knowledge and understanding of digital forensics, and the skills needed to carry out complex cyber investigations. You study the latest literature and methods in the field. You learn in a variety of ways including lectures, e-learning, seminars, case-based learning and laboratory sessions – you are also expected to study in your own time outside of classes. Reflective practice throughout is a key element of the course and you are encouraged to examine your own work, identify your own learning needs and challenges, whilst providing evidence of what is required to operate confidently, efficiently and ethically in the workplace. In this way, you develop an understanding of good practice and the ability to solve foreseen and unforeseen problems.

How you are assessed

Formative and summative assessments test your knowledge, independent thought and skills. You are assessed through coursework, including technical and laboratory reports, written and practical examinations, and your dissertation/thesis.


Entry requirements

Applicants are normally expected to have at least a 2.2 UK honours degree (or equivalent).

A broad range of first degree subjects are acceptable including sciences, IT, computing, forensics, crime scene science, criminology, law, psychology, policing and engineering.

Please contact our admissions team if you need to discuss your eligibility.

Non-UK students must also meet the University's minimum English language requirements.

For general information please see our overview of entry requirements

International applicants can find out what qualifications they need by visiting Your Country



Career opportunities

Successful graduates are equipped with the knowledge and skills needed to become a professional digital or cyber analyst or investigator. You are highly employable in the computer security and forensic intelligence fields.

You also have the appropriate knowledge in advanced technical skills to get a job within a number of other careers such as within a government organisation, security services and the financial sector, forensic science agencies, the police service, Her Majesty’s Revenue and Customs, and trading standards.


Information for international applicants


International applicants - find out what qualifications you need by selecting your country below.

Select your country:

Useful information

Visit our international pages for useful information for non-UK students and applicants.

Talk to us

Talk to an international student enrolment adviser



2024/25 entry

Fee for UK applicants
£7,365 a year

More details about our fees

Fee for international applicants
£17,000 a year

More details about our fees for international applicants

  • Length: September enrolment: 1 year, January enrolment: 16 months, including a summer break
  • Start date: September or January
  • Semester dates

Apply now (full-time)



2024/25 entry

Fee for UK applicants
£820 for each 20 credits

More details about our fees

  • Length: September enrolment: 2 years, including a summer break, January enrolment: 28 months, including two summer breaks
  • Attendance: Typically one day a week
  • Start date: September or January
  • Semester dates

Apply now (part-time)

Apply now (part-time)


Choose Teesside

  • On video

    Help tackle the worldwide problem of digital crime

    And other reasons to study MSc Digital Forensics and Cyber Investigation according to Dr Graeme Horsman


Get in touch

UK students


Telephone: 01642 738801

Online chat (general enquiries)

International students


Telephone: +44 (0) 1642 738900

More international contacts


Open days and events

Go to top menu