digital forensics phd

• SHSU Online

Print Options

• Undergraduate
• Programs A-Z
• Courses A-Z
• Colleges and Departments

Catalog Menu

• Academic Policies &​ Procedures
• Financial Information
• Support Services
• College of Arts and Media
• College of Business Administration
• College of Criminal Justice
• College of Education
• College of Health Sciences
• College of Humanities and Social Sciences
• College of Osteopathic Medicine
• School of Agricultural Sciences
• Department of Biological Sciences
• Department of Chemistry
• Digital and Cyber Forensic Science, PhD
• Computing and Data Science, MS
• Digital Forensics, MS
• Information Assurance and Cybersecurity, MS
• Cyber Security, Graduate Certificate
• Data Assurance, Graduate Certificate
• Data Science, Graduate Certificate
• Digital Investigation, Graduate Certificate
• Department of Engineering Technology
• Department of Environmental and Geosciences
• Department of Mathematics and Statistics
• Department of Physics and Astronomy
• Course Descriptions
• Accreditations
• Administrative Officers
• Institutional Mission Statement
• President's Welcome
• La Bienvenida de la Presidenta
• Degrees Offered
• Undergraduate Catalog
• Skip to Content
• Catalog Home
• Institution Home
• Request Info
• Give to SHSU

• Graduate and Professional
• Graduate And Professional |
• Colleges & Departments |
• College of Science and Engineering Technology |
• Department of Computer Science |

Ph.D. in Digital and Cyber Forensic Science

The Doctor of Philosophy in Digital and Cyber Forensic Science is designed to produce students of the digital forensics and cyber-security realms with the technical skills, critical thinking ability, problem-solving skills, and advanced, discipline-specific knowledge to allow them to advance into leadership positions in business and industry as well as academia. This is accomplished by demonstrating the ability to perform independent and collaborative original research, the successful completion of academic coursework, hands-on experience in the laboratory, and collaboration with digital forensics and cyber-security agencies, institutes, and partners. The program will provide students with the theoretical, conceptual, methodological, and computational skills needed to understand the role of digital and cyber forensic science in post technological societies. The program will allow students to explore the potential for forensically sound digital data capture and analysis and to develop new tools and methods for handling digital and cyber forensic evidence. In doing so, this program has, as its primary focus, research into the computational and scientific basis for forensic and cyber technologies. 

Additional information : Reference the Program Landing Page for additional information, such as cost, delivery format, contact information, or to schedule a visit.

The Ph.D. in Digital and Cyber Forensic Science is a full-time, on campus program.  Admission to the program requires devoting a significant amount of time to the program. Students are admitted as part of an annual cohort and have a fixed program of study in the first two years of the program.  

Applicants seeking admission to the doctoral program in forensic science must submit the following directly to the Office of Graduate Admissions :

• Graduate Admissions Application
• Application Fee
• Bachelor's degree conferred by a regionally accredited institution in computer science, digital forensics, or a closely related field
• Official transcript(s) from degree granting institution(s)
• Official transcripts from all colleges/universities attended
• GPA of 3.5 or higher
• Program Application
• Personal statement , not to exceed 1000 words
• Three letters of recommendation. A minimum of two letters must be from faculty who are sufficiently acquainted with the student to comment on potential for success in the doctoral program
• Current resume or vita
• In some instances, a personal interview may be requested.

The program requires the completion of a minimum of eighty-five hours of graduate credit, as prescribed in the degree plan.

Students must register full-time and maintain a 3.0 grade point average in all courses. In order to advance to candidacy, students must have successfully completed forty-six graduate credit hours of coursework and internship, submit a portfolio for review, and pass Comprehensive Examinations. Once the doctoral program committee determines that the portfolio, proposal, and comprehensive examinations are satisfactory, the student may enroll in dissertation credits.

A minimum of fifteen hours of dissertation credits are required, and students must maintain continuous enrollment in DFSC 8370 Dissertation until they graduate. Students must complete and defend a doctoral dissertation, which is the product of original scholarly research and is of sufficient publishable quality to represent a meaningful contribution to knowledge in the field of digital and cyber forensic science.

The Ph.D. in Digital and Cyber Forensic Science requires the completion of 85 credit hours beyond the bachelor's degree. Students complete:

​The curriculum is designed to deliver an essential core curriculum in digital and cyber forensic science, together with specialized electives and intensive research in the area of interest. Students are expected to fulfill the requirements during four to five years of full-time study.

  DFSC 7106 must be taken for a total of four credit hours.

Once enrolled in DFSC 8370 , students must enroll in this course every semester until graduation.

The Texas Higher Education Coordinating Board (THECB) marketable skills initiative is part of the state’s 60x30TX plan and was designed to help students articulate their skills to employers.  Marketable skills are those skills valued by employers and/or graduate programs that can be applied in a variety of work or education settings and may include interpersonal, cognitive, and applied skill areas.

The  Ph.D. in Digital and Cyber Forensic Science is designed to provide graduates with the following marketable skills:

• Solve complex cybersecurity-related problems.
• Apply theoretical principles to the development of digital forensics tools and techniques.
• Post-secondary teaching capability.
• Technical communication ability.
• Strong research-oriented capabilities.
• Academic Calendar
• Academic Policies & Procedures
• The Woodlands Center

Sam Houston State University

Huntsville, Texas 77341 (936) 294-1111 | (866) BEARKAT

© Copyright Sam Houston State University. All rights reserved.

Maps & Contacts

• University Contacts
• Personnel & Department Search
• Contact the Web Editor
• Office of the President
• Administration
• Faculty & Staff
• State of Texas
• Open Records
• Emergency Policies & Procedures
• Texas Homeland Security
• Texas Veterans Portal
• Report Fraud and Abuse
• The Texas State Auditor's Office Hotline
• Online Institutional Resumes
• Governor's Committee on People with Disabilities
• Where the Money Goes
• Compact with Texans
• College Portrait
• HB 2504 Compliance
• Web Site Accessibility

Print this page.

The PDF will include all information unique to this page.

A PDF of the 2023-2024 catalog.

Purdue Polytechnic Institute

Global mobile menu.

• Departments
• Statewide Locations

Ph.D. in Technology

• Graduate Faculty

Specialization in Cyber Forensics

The Purdue Polytechnic offers a Ph.D. in Technology with a specialization in cyber forensics. All details about the degree including the admission procedures, course structure, faculty and other resources can be found  here . Additional details of the Ph.D. specific to the cyber forensics area of specialization are mentioned below.

Curriculum requirements for the cyber forensics specialization includes all the  requirements of the Ph.D. in Technology degree with the added constraint that students need to complete 15 credit hours in core cyber forensics courses. The requirements are explained below.

Core Courses

CNIT 55600 - Basic Computer Forensics - 13485 Covers the fundamentals of the maturing discipline of computer forensics. The focus of the course is on gaining a broad understanding of the field of study and how technology and law interact to form this forensic science. Emerging standards and current and future issues related to the field are also explored. Examines law and public policy, the computer forensic methodology, report presentation, and expert witness testimony, as well as anti-forensic techniques that can be used to obfuscate evidence. Students are exposed to theory and practice with lab exercises, thought and term papers, and a practical, as well as written, final exam.

CNIT 55700 - Advanced Research Topics In Cyber Forensics - 45535 Provides students at the advanced degree level the opportunity to expand their knowledge of cyber forensics. Students are expected to have fundamental understanding of cyber forensics and digital forensic science. The emphasis is on directed learning and scholarly inquiry. Possible research topics range from law and public policy to software and/or hardware development. Permission of instructor required.

CNIT 58100 - Cyber Frn Cloud/Virtual Enviro - 69894 There are various architectures of virtual and cloud technology environments placing different emphasis on storage, transmission, and processing of information. The student will develop skills and abilities in evaluating the patterns of evidence within this domain. This course examines the identification and acquisition of digital evidence, residing on hosts or in transmission between hosts, from different network topologies, and protocols. This course will also examine the techniques or processes by which information can be hidden, exposed, examined, and processed in a forensics manner. The fundamental principles of forensics are applied to virtual operating environment and networks.

CNIT 58100 - Cyber Forensics Of File Sys - 69783 The plethora of strategies to store information in different formats continues to expand. This course examines the various media and strategies of storing information and the processes of documenting the collection, imaging, and processing of forensic evidence. Topics include file formats, file systems, hardware, and software involved in forensic investigation. The overall pattern of forensic evidence in file systems will be examine along with the acquisition, analysis, and reporting of evidence artifacts found in file systems. Permission of instructor or graduate standing required.

CNIT 58100 - Cyberforensics Of Malware - 69893 Consumer technologies are rapidly moving forward with items integrating processing, storage, and transmission into their base functionality. The enterprise issues with bring your own device has rapidly expanded requirements on forensics investigators to address a plethora of mobile device types. Whether it is the automobile black box or a home thermostat there are various elements of interesting evidence possible to be gained. As a simplistic example the wireless home thermostat tracks when there is activity in a house. The forensic possibilities of being able to attribute presence via the thermostat or geo-location by a cellphone are of interest to forensics investigators. This is a classic example of a device as a witness. The embedded and consumer device pantheon is developing as an important area of forensic science.

Specialization Requirements

Digital Forensics Association

• DFA Discussion Board
• Volunteering
• Start a Chapter
• A word on Education
• Certificates
• Free Training
• Vendor Training
• Open Source
• Case Studies
• Presentations
• Professional Journals
• Publications
• Articles & Papers
• Community Sites
• Discussion Groups
• Forensic Blogs
• Resource Sites
• Evidence Files
• Forensic Challenges
• Common Body of Knowledge
• Testimony Archive
• Tools Research
• DFA Research Publications
• Contact the DFA
• Connect with Us

Doctoral Programs

• California Sciences Institute offers a Ph.D. in Digital Forensics.
• University of Rhode Island offers a PhD in Computer Science with Digital Forensics research. The Digital Forensics classes are taken online, other classes may require residency.
• Purdue (CERIAS) offers an Interdisciplinary PhD degree with a specialization in Information Security, and many excellent projects to research on digital forensics. They also offer standard graduate degrees with the same specialization.

• Aviation and Astronautical Sciences
• Computer Science, Artificial Intelligence and Data Science
• Construction and Facilities
• Critical Infrastructure
• Cyber & Information Security
• Cyberpsychology
• Engineering
• Engineering Technologies
• Intelligence and Global Security Studies
• Management of Technology
• Occupational Safety and Health
• Uncrewed Systems
• Doctoral Degrees
• Master's Degrees
• Bachelor's Degrees
• Online Programs
• Associate Degrees
• Certificates
• Minor Degrees
• Summer Programs
• STEM Events
• Webinars and Podcasts
• Master's
• Undergraduate
• Transfer Students
• Military and Veterans
• International Students
• Admissions Counselor
• Capitol Connections
• Accepted Students
• Project Lead the Way
• Builder Culture
• Campus Life
• Clubs and Organizations
• Centers and Labs
• Online Classes
• The Capitol Commitment
• Top Employers
• Co-ops and Internships
• Professional Education
• Find a Mentor
• Career Services
• Capitol Online Job Board
• Recruiters and Employers
• Why Capitol Tech
• At a Glance
• Mission, Vision and Goals
• Diversity, Equity and Inclusion
• Washington, D.C.
• Capitol History
• Capitol Partners
• News and Events
• Visitors/Campus
• Accreditation
• Recognitions & Awards
• Current Students
• Faculty & Staff
• Alumni & Giving
• News & Events
• Capitology Blog
• Maps / Directions

• Degrees and Programs

Doctor of Philosophy (PhD) in Forensic Cyberpsychology

• Request Information

Starting Summer 2023

Earn a Ph.D. in Forensic Cyberpsychology and learn all about the psychology of cybercriminal behavior.

Forensic cyberpsychology is a cutting-edge emerging discipline which presents students with an exciting opportunity to engage with this new scientific frontier and help to develop new scientific theories and protocols, or adapt existing psychological and criminological theories with a view to staging cybercrime intervention and/or prevention.

The Doctor of Philosophy (Ph.D.) in Forensic Cyberpsychology degree is a unique online program designed to broaden scientific investigation, and one of the first at a Doctoral level worldwide.  Scholars from computer science to the social and behavioral sciences who join the new field of Forensic Cyberpsychology will undoubtedly contribute to crystallizing new ideas and conquering an emerging scientific frontier.

Cybercrime describes crimes carried out by both individuals and groups against computing devices, operational technology systems, or networks, as well as traditional crimes facilitated by the use of the Internet and/or information technology. Cyberpsychology focuses on the study of the impact of technology on human behavior. Cyberpsychologists study Internet psychology, virtual environments, artificial intelligence, intelligence amplification, gaming, digital convergence, social media, mobile and networking devices.   

The emerging subdiscipline of Forensic Cyberpsychology focuses on the study of criminal behavior online and was first highlighted by Professor Mary Aiken almost a decade ago in the Europol 'Internet Organised Crime Threat Assessment Report' , in an appendix titled "the Cyberpsychology of Internet Facilitated Organised Crime" she outlined "the critical task for cyberpsychology as a discipline is to build up a body of established findings of how human beings experience technology, the critical task in forensic cyberpsychology is to focus on how criminal populations present in cyber environments". 

In Forensic Cyberpsychology, the focus is on human factors behind cybercrime, studying offender profiling, behaviors, and what motivates criminals to act as they do, along with gaining insights and understanding into cyber deviancy, juvenile cyber delinquency, risk-taking/harmful behaviors online, and online victimology, as well as developing methods for online investigative procedures that help to mitigate and/or prevent cybercrime. 

Capitol Tech has the unique resources and partnerships for students to progress in this field. In addition to learning from the world-leading expert in Cyberpsychology, Dr. Mary Aiken and other award-winning faculty, students may have opportunities for research collaborations with the National Security Agency (NSA), the Department of Defense (DoD) and other related agencies and organizations. The university’s proximity to the nation’s technology hub of Washington, D.C. and the DMV ensures prospective students will find many internships and job opportunities available to them with leaders of the industry.  

The Ph.D. in Forensic Cyberpsychology program is structured for experienced professionals in this field with an appropriate graduate degree. Within the program, students will conduct original research in an approved area of Forensic Cyberpsychology.  

As your Ph.D. progresses, you will move through a series of progression points and review stages by your academic supervisor. This ensures that you are engaged in research that will lead to the production of a high-quality thesis and/or publications, and that you are on track to complete this in the time available. Following submission of your Ph.D. Thesis or accepted three academic journal articles, you will have an oral presentation assessed by an external expert in your field. 

Why Capitol?

Expert guidance in doctoral research

Capitol’s doctoral programs are supervised by faculty with extensive experience in chairing doctoral dissertations and mentoring students as they launch their academic careers. You’ll receive the guidance you need to successfully complete your doctoral research project and build knowledge in the field.  

Proven academic excellence

Study at a university that specializes in industry-focused education in cyber and technology-based fields, nationally recognized for our academic excellence in our programs.

Program is 100% online

Our PhD in Forensic Cyberpsychology is offered 100% online.

Dr. Mary Aiken

Dr. Mary Aiken serves as Chair and Professor of the  Cyberpsychology Department. She holds a Ph.D. in Forensic Cyberpsychology. Professor Mary Aiken is a world leading expert in Cyberpsychology – the study of the impact of technology on human behaviour and is a Professor of Forensic Cyberpsychology in the Department of Law and Criminology at the University of East London. Dr. Aiken is a member of INTERPOL's Global Cybercrime Expert Group and an Academic Advisor to Europol’s European Cybercrime Centre (EC3). She is a Fellow of The Royal Society of Medicine, Global Fellow at the Washington DC Wilson Center, a member of the Medico-Legal Society, an International Affiliate Member of the American Psychological Association (APA) and a Fellow of the Society for Chartered IT Professionals.

Dr. Ian McAndrew

An internationally recognized leader in research and expert on low-speed flight, Dr. McAndrew has five degrees: a PhD, two master’s degrees and two bachelor’s degrees. He is a Fellow of the Royal Aeronautical Society. Dr. McAndrew chairs several international conferences and journals and is invited to give keynote speeches all over the world. He started his career in the automotive industry as an engine designer, and has worked at several universities across the globe. Dr. McAndrew is Dean of doctoral programs at Capitol Technology University. An external examiner on the world wide stage (UK USA, Germany, Italy, Jordan, Japan, Australia, Greece and Kenya) his experience includes over 115 successful Doctorate successes.

Dr. Richard Baker

Dissertation Chair

Dr. Richard Baker is Dissertation Chair of Graduate Programs at Capitol Technology University. He previously served as associate professor in Indiana State University’s Department of Aviation Technology, and as executive director of the Center for Unmanned Systems and Human Capital Development.  Richard holds a BS in mathematics and an MS in computer science from Indiana State University. He received his doctorate in information systems from Nova Southeastern University.  

Dr. William Butler

Vice President

Dr. William (Bill) Butler is currently the Vice President of Academic Affairs at Capitol Technology University. Prior to this appointment in 2021, Dr. Butler served as Cybersecurity Chair for 8 years at Capitol Tech. Earlier in his career, he worked in the networking and IT industries as a network engineer and consultant for over 20 years. He also served as a joint qualified communications information systems officer in the U.S. Marine Corps and retired as a Colonel with 30 years of service (active and reserve). Dr. Butler holds a Doctorate in cybersecurity earned from Capitol focusing on preserving cellphone privacy and countering illegal cell towers (IMSI catchers).

Dr. Kellep Charles

Dr. Kellep Charles is Chair of Cybersecurity programs at Capitol Technology University. He completed his Doctorate in Cybersecurity at Capitol Technology University.  He also holds a Master of Science in Telecommunication Management from the University of Maryland University College and a Bachelor of Science in Computer Science from North Carolina Agricultural and Technical State University.

Career Opportunities

A degree in a cutting-edge, emerging discipline

Graduates will contribute significantly to the emerging Forensic Cyberpsychology field through the creation of new knowledge and ideas. Get the necessary credentials to take on a leadership role; work in industry, become a researcher, advisor or trusted expert.

Resources and Partnerships

Capitol Tech has the unique resources and partnerships for students to progress in this field and provides opportunities for finding internships and employment with leaders of relevant industries.

Degree Details

This program may be completed with a minimum of 60 credit hours, but may require additional credit hours, depending on the time required to complete the dissertation/publication research. Students who are not prepared to defend after completion of the 60 credits will be required to enroll in RSC-899, a one-credit, eight-week continuation course. Students are required to be continuously enrolled/registered in the RSC-899 course until they successfully complete their dissertation defense/exegesis.

The PhD program offers 2-degree completion requirement options:  

• Dissertation Option : the student will produce, present, and defend a doctoral dissertation after receiving the required approvals from the student’s Committee and the PhD Review Boards.
• Publication Option: the student will produce, present, and defend doctoral research that is published as articles (3 required) in peer reviewed journals identified by the university and the student’s Committee. Students must receive the required approvals from the student’s Committee and the PhD Review Board prior to publication.

Prior Achieved Credits May Be Accepted 

Doctor of Philosophy in Forensic Cyberpsychology Courses Total Credits: 60 

FORENSIC CYBERPSYCHOLOGY DOCTORAL CORE: 30 CREDITS 

FORENSIC CYBERPSYCHOLOGY DOCTORAL RESEARCH AND WRITING: 30 CREDITS 

Educational Objectives:  

1. Students will evaluate the need for Forensic Cyberpsychology. 

2. Students will demonstrate advanced knowledge and competencies needed for the future in the human aspects of Forensic Cyberpsychology. 

3. Students will analyze theories, tools, and frameworks used in Forensic Cyberpsychology. 

4. Students will execute a plan to complete a significant piece of scholarly work. 

5. Students will develop skills to implement theories into practice. 

Learning Outcomes: 

Upon graduation... 

1. Graduates will incorporate the theoretical basis and practical applications of Forensic Cyberpsychology into their professional work.  

2. Graduates will demonstrate the highest mastery the needs of Forensic Cyberpsychology. 

3. Graduates will evaluate complex problems, synthesize divergent, alternative, and contradictory perspectives and ideas fully, and develop advanced solutions to Forensic Cyberpsychology challenges. 

4. Graduates will contribute to the body of knowledge in the study of Forensic Cyberpsychology. 

Tuition & Fees

Tuition rates are subject to change.

The following rates are in effect for the 2024-2025 academic year, beginning in Fall 2024 and continuing through Summer 2025:

• The application fee is $100
• The per-credit charge for doctorate courses is $950. This is the same for in-state and out-of-state students.
• Retired military receive a $50 per credit hour tuition discount
• Active duty military receive a $100 per credit hour tuition discount for doctorate level coursework.
• Information technology fee $40 per credit hour.
• High School and Community College full-time faculty and full-time staff receive a 20% discount on tuition for doctoral programs.

Find additional information for 2024-2025 doctorate tuition and fees.

Need more info, or ready to apply?

• Current Students
• U.S. Locations
• UMGC Europe
• Learn Online
• Find Answers
• 855-655-8682

Online Master's Degree

Digital forensics & cyber investigation, degree at a glance.

• Transfer exactly 6 credits
• All courses available online
• Select hybrid courses available

TUITION RATES

• $694 per credit (in-state)
• $694 per credit (out-of-state)
• $480 per credit (military)
• Other fees may apply

Next Session Starts

Develop the cutting-edge skills and knowledge you need to become a digital forensics expert..

The online master’s degree in digital forensics and cyber investigation from University of Maryland Global Campus is designed to prepare you to meet the growing demand for investigative, leadership, and executive skills in analyzing and mitigating cyber crime. Learn how to determine whether a digital system has been attacked or compromised, and master reliable methods to identify, preserve, analyze, and present evidence for legal prosecution and administrative proceedings.

• Requirements

Total Credits Required: 36

Take the following courses in the order listed:

Foundation Course

Core courses.

• Cyberspace and Cybersecurity Foundations (6 Credits, DFC 610)
• Digital Forensics Technology and Practices (6 Credits, DFC 620)
• Digital Forensic Response and Analysis (6 Credits, DFC 630)
• Advanced Forensics (6 Credits, DFC 640)

Capstone Course

• Cybersecurity Capstone (6 Credits, CYB 670)

General Master's Degree Requirements

• You must maintain a GPA of 3.0 or higher at all times.
• All degree requirements must be fulfilled within five consecutive years.
• Any transfer credits must have been earned within the five-year time frame to be applied toward a graduate degree.
• Please review the  overall master’s degree requirements  for additional considerations.

Additional Program-Specific Requirements

• All courses must be taken in the order listed.
• You must complete each course with a grade of B or better to advance to the next course.
• The grade of C is not available for these courses.
• The courses in this program will have seven-day and 60-day options for the grade of Incomplete.

Accelerated Pathway

If you completed your undergraduate degree at UMGC with a major in cybersecurity technology, an  accelerated pathway between UMGC's graduate and undergraduate degree programs in this field may allow you to reduce your total coursework for this program by up to 6 credits .

Explore the MARS Program in Your Courses

Some of UMGC's online cyber graduate courses utilize the Multi-Dimensional Applied Relevant System (MARS), an AI-driven virtual learning platform that allows students to demonstrate their abilities and apply their cyber skills in a practical, immersive environment.

Search Course Catalog

These requirements are for students who enroll in the  2023–2024 academic year . For prior year requirements, visit our catalog archive.

Master’s Degree Requirements

Program highlights.

Develop skills and gain knowledge through coursework that draws from the expertise and experience of our respected faculty.

Industry Snapshot

This program is designed to help prepare you for work in government organizations, the private sector, and law enforcement agencies in the areas of computer and digital crime.

You might be interested in similar programs

Compare All Programs

Industry Certification Exams

This program is designed to help prepare you for the following certification exams:

• EC-Council Certified Incident Handler
• EnCase Certified Examiner (EnCE)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Network Forensic Analyst (GNFA)

Additional Program Information

• Experience Recommended for Success
• Technology Requirements
• Student Organizations

We recommend having a background in computing and programming for this program. Strong writing skills are also encouraged.

For some of the upper-level cybersecurity and IT courses in this program, you will need equipment that meets the following specifications. Courses in graphics- or computing-intensive disciplines may require a higher processing speed, more RAM, and/or better screen resolution.

Hardware Requirements

• 64-bit processor, Intel Core i5 (7th generation or higher), or equivalent (e.g., AMD, M1) 
• Processor speed: 1.5 GHz or higher (2 GHz recommended) 
• Storage: At least 250 GB (SSD [preferred] or HD), with at least 30 percent free space 
• RAM: At least 4 GB (8 GB recommended) 
• Display/monitor: Minimum 13” 
• Screen resolution: Minimum 1280 px x 1024 px 
• Keyboard and mouse/trackpad 
• High-speed Internet connection (Ethernet or Wi-Fi) 
• 32-bit video card

Operating System

Choose one of the following:

• Windows 10 (recommended; version 1909 or higher required for any course using Adobe Creative Cloud) 
• Mac OS X 10.15 or higher 
• Ubuntu 18.04+ (or other Linux LTS) 
• Microsoft Office 2019 or later (Office 365 Education is available for free with your student email address.) 
• Most recent version/update of a web browser (Firefox, Safari, or Chrome) 
• Antivirus software 
• Adobe Acrobat PDF Reader 

Additional Recommendations

• Built-in camera (or USB port for a webcam)
• Built-in microphone and speakers (or USB ports for external audio devices)

Computing Club

The Computing Club provides a dynamic environment where members can work collaboratively, share innovative ideas, enhance their career-readiness, and gain marketable experience in their respective fields. It is available to graduate or undergraduate students, alumni, faculty, and staff members. Students and alumni can join the Computing Club group on CareerQuest .

Cyber Competition Team

The Cyber Competition Team represents UMGC at various cybersecurity events and tournaments nationwide. Being a member of the team gives students an opportunity to develop their cybersecurity skills and network with other students. The team is open to undergraduate and graduate students and alumni through a tryout process. Email jesse.varsalone@umgc.edu or visit the team webpage to learn more.

Upsilon Pi Epsilon (Computing & Technology Disciplines)

Upsilon Pi Epsilon, the international honor society for the computing and IT disciplines, is designed to promote the computing and information sciences and to encourage the enhancement of knowledge in the field. Upsilon Pi Epsilon is open to both undergraduate and graduate students who are pursuing a degree in the computing and information science disciplines. Membership is by invitation only.

Undergraduate membership is open to students majoring in one of the computing disciplines who have completed at least 45 credit hours towards their degree, including 30 or more credits at UMGC (in graded coursework) and at least 15 credits from information technology and computer science courses. Undergraduate students need to have a cumulative GPA of a 3.5 or higher and a GPA of 3.5 or higher in all coursework taken from the information technology and computer science courses.

Graduate student membership is open to students pursuing a master's degree in cloud computing systems, cyber operations, cybersecurity management and policy, cybersecurity technology, data analytics, or digital forensics and cyber investigation; a master's degree in information technology with a specialization in database systems technology, informatics, information assurance, software engineering, or systems engineering; or a legacy master's degree in cybersecurity. Graduate students must have completed at least 18 resident credits towards their degree at UMGC, with a cumulative GPA of a 3.5 or higher.

For more information, please email upe@umgc.edu .

What is a master's in digital forensics and cyber investigation?

A master's in digital forensics and cyber investigation is a graduate-level program that focuses on the identification, preservation, analysis, and presentation of digital evidence in a legal context. UMGC's online Master of Science in Digital Forensics and Cyber Investigation degree is a 36-credit program that covers topics like forensic examination tools and technologies, best practices in forensic examinations, artifact reconstruction and recovery, evidentiary volume and encryption, and more. Graduates of the program are prepared for careers as digital forensic analysts, forensic examiners, forensic consultants, and information security managers.

Is a master's degree in digital forensics and cyber investigation worth it?

At UMGC, we want you to be happy with the investment you make in your education, and we work hard to keep our programs affordable . When you choose to pursue your master's in digital forensics and cyber investigation at UMGC, you can rest assured that the quality of our curriculum is backed by the reputation of an accredited state university and a member institution of the University System of Maryland . Deciding whether an online master's degree in digital forensics and cyber investigation is worth it for you ultimately depends on your individual needs and goals. If you're not sure whether this is the right program for you or need help figuring out how to fit the program into your life, don't hesitate to reach out to us —our advisors and success coaches are happy to help.

How long does it take to get a master's in digital forensics and cyber investigation?

UMGC's online master's degree in digital forensics and cyber investigation is a 36-credit program with courses offered year-round. Each course is 6 credits, and students typically take them one at a time, which means they can finish the program in as little as 18 months. If you recently completed an undergraduate degree in cybersecurity technology at UMGC, you may be able to apply 6 credits toward your graduate degree and shorten your time to completion by one term.

How much does a master's in digital forensics and cyber investigation cost?

UMGC is committed to keeping our tuition and fees as affordable as possible. The master's degree in digital forensics and cyber investigation follows the specialty graduate program tuition rates, which appear at the top of this webpage. We also offer scholarships , an interest-free monthly payment plan , and no-cost digital materials in place of most textbooks to help make your education more affordable.

What background do I need to get a master's in digital forensics and cyber investigation?

You don't need to have majored in any specific area to be successful in the master's in digital forensics and cyber investigation at UMGC. However, we do recommend you have a background in computing and programming. Strong writing skills are also encouraged.

Whom is the Master of Science in Digital Forensics and Cyber Investigation geared toward?

This program is designed for those who want to develop skills and competencies in the analysis of digital evidence. This may lead to positions tracking cyber intruders or digital evidence within government and private organizations as well as law enforcement.

What will I get from the Master of Science in digital forensics and cyber investigation?

This program focuses on the investigation area of a cyber attack and collecting evidence from digital assets of other specific activity. It will help you develop your competencies in finding, accessing and analyzing digital evidence left on a variety of devices from computers to smartphones and tablets. The program will require that you become adept with network, computer, and digital analysis technologies at an intermediate level.

Suzan L., Guam MS in Digital Forensics & Cyber Investigation

Our helpful admissions advisors can help you choose an academic program to fit your career goals, estimate your transfer credits, and develop a plan for your education costs that fits your budget. If you’re a current UMGC student, please visit the Help Center .

Personal Information

Contact information, additional information.

By submitting this form, you acknowledge that you intend to sign this form electronically and that your electronic signature is the equivalent of a handwritten signature, with all the same legal and binding effect. You are giving your express written consent without obligation for UMGC to contact you regarding our educational programs and services using e-mail, phone, or text, including automated technology for calls and/or texts to the mobile number(s) provided. For more details, including how to opt out, read our privacy policy or contact an admissions advisor .

Please wait, your form is being submitted.

By using our website you agree to our use of cookies. Learn more about how we use cookies by reading our  Privacy Policy .

No Application Fee

Apply by May 31, and we'll waive your application fee.

• Forensics Colleges » Programs » Forensic Science » PhD in Forensic Science

Search For Schools

When you click on a sponsoring school or program advertised on our site, or fill out a form to request information from a sponsoring school, we may earn a commission. View our advertising disclosure for more details.

PhD Programs in Forensic Science – Accredited Doctoral Programs

There are various doctoral programs in forensic science for forensics professionals with niche research interests, several years of experience, and an unbreakable work ethic. While most of the programs at this level fall into one of the discipline’s subfields, such as chemistry, clinical psychology, or anthropology, there are a few terminal degree options in forensic science.

Preparation at the PhD level is crucial to furthering the discipline of forensic science for several reasons. First, graduate students and professors are typically responsible for revolutionizing the technologies and methods behind forensic technologies. By illustration, Discover Magazine published a piece on Dr. Robert Hare—one of the pioneers in forensic psychology—and explained that in the 1950s, he was working in uncharted waters. Dr. Hare is well-known for his Psychopathy Checklist (PCL), which he developed in 1980 to identify psychopathic tendencies. While forensic psychology was still in its infancy, this groundbreaking researcher pinpointed 20 items associated with psychopathy, including exhibiting a lack of empathy, impulsivity, a tendency toward short-term relationships, and a failure to take responsibility for one’s actions.

Dr. Hare was also one of the first researchers to use physiological arousal studies to study the disease. People with mental illness generally do not show the same arousal in response to stressful stimuli as control subjects. Dr. Hare is one example of a forensic scientist who pioneered new methods in the subfield of clinical psychology to measure mental illness.

Second, achieving a terminal degree in forensic science may require employment at the highest levels of universities, forensic laboratories, research organizations, and other institutions. Having a PhD can enhance one’s candidacy for leadership and teaching positions and may also increase one’s salary potential.

Lastly, it may be wise to pursue a PhD in forensic science or a subfield to prepare oneself for professional certification. In fact, several credentialing boards of the discipline require applicants to have a doctoral degree, including the American Board of Forensic Anthropology (ABFA), the American Board of Forensic Odontology (ABFO), and the American Board of Forensic Toxicologists (ABFT), specifically for credentialing at the Fellow level. In addition, please visit the forensic science careers page to learn more about the credentialing organizations accredited by the esteemed Forensic Specialties Accreditation Board (FSAB).

Read on to learn about the wealth of accredited PhD programs in forensic science and the relevant psychology, chemistry, and anthropology subfields.

THANK YOU FOR YOUR INTEREST IN Southern New Hampshire University Online MS - Construction Management

Doctoral degree programs in forensics.

While few doctoral programs focus exclusively on forensic science, there are many PhD options in the varied subfields. Prospective students in forensics are urged to verify the accreditation status of their institutions and programs. To learn more about accreditation, please read the section at the end.

Doctoral Degree Program Requirements

To gain entry into a PhD program, admissions committees typically call for the following from students:

• Official transcripts from all undergraduate (and graduate) institutions with a stellar GPA (e.g., >3.5)
• Proof of having completed specific coursework in a relevant major (e.g., forensic science, natural science, chemistry, biology)
• A resume with one to two years of professional experience in forensic science
• Letters of recommendation
• A personal statement (typically 1,000 words or less)
• Interview (in-person, phone, or web-based)
• Competitive Graduate Record Examination (GRE) scores
• GRE Subject Test scores (generally optional)
• TOEFL scores (for non-native speakers of English only)
• Proof of professional publications (recommended, but not always required)
• A background check (especially for competitive internships for program credit)
• Application fee

Doctoral Programs in Forensic Science

There are currently limited options at the PhD level for forensic science programs, but they are on the rise.

Sam Houston State University

At Sam Houston State University in Huntsville, Texas, students can pursue a doctor of philosophy (PhD) in forensic science. As one of the only programs in the US, this 86-credit-hour program generally takes four to five years of full-time study to complete. Sam Houston’s curriculum comprises core coursework, electives, and dissertation research.

In addition, the degree plan includes classes such as forensic instrumental analysis; trace and microscopical analysis; forensic toxicology; research methods; and forensic laboratory management.

Notably, Sam Houston State University has a master’s degree in forensic science that is FEPAC-accredited.

• Location: Huntsville, TX
• Accreditation: Southern Association of Colleges and Schools Commission on Colleges (SACSCOC)
• Expected Time to Completion: Four to five years

West Virginia University

West Virginia University (WVU), based in Morgantown, is another program that offers a PhD specifically focused on forensic science. According to the school, the program “is strongly science-based and prepares students to work across the foundations of criminalistics.”

WVU is the only school in the nation boasting forensics programs at the undergraduate, graduate, and doctoral levels. WVU’s bachelor’s and master’s programs are accredited by the prestigious Forensic Science Education Programs Accreditation Commission (FEPAC). FEPAC is the gold standard in program approvals for forensic science at the bachelor’s and master’s degrees.

Applicants to the PhD program should possess a bachelor’s or research-based master’s degree from an accredited university or college which includes at least one year of the following courses: fundamentals of chemistry, biology, organic chemistry, physics, or calculus. They should have a minimum cumulative GPA of 3.0 and GRE scores of 300 or better.

Students in this program must successfully complete a minimum of 71 credits. Each student may apply a maximum of 31 credits of research toward the 71-credit requirement and the remaining 40 credits must be earned in graduate-level courses in forensic science. The program also includes a dissertation proposal presentation, an oral defense of the dissertation, and an oral qualifying examination.

The curriculum includes courses such as foundations of criminalistics; forensic informatics; forensic laboratory management; trace evidence examination; research design in forensic science; arson and explosives analysis; analysis of seized drugs; and analytical forensic toxicology.

• Location: Morgantown, WV
• Accreditation: Higher Learning Commission (HLC)

Doctoral Programs in Forensic Psychology

The American Psychological Association’s (APA) American Psychology-Law Society maintains a detailed guide to legal and forensic psychology programs. In addition, there are PhD programs and PsyD and PhD/JD combined options.

Palo Alto University

Palo Alto University (PAU) in California provides a four-year PhD in clinical psychology with a forensic area of emphasis. Core coursework for this specialized PhD includes forensic assessment, an advanced forensic psychology seminar, assessment and treatment of trauma in adults, child and adolescent development, biological psychology, psychopharmacology, adult development and aging, neuropsychological assessment, and cross-cultural issues in psychology.

In addition, by dividing students into small, faculty-guided research groups, PAU ensures that students get empirical instruction in research methods and proper leadership through all phases of developing their dissertations.

• Location: Palo Alto, CA
• Accreditation: WASC Senior College and University Commission (WSCUC); American Psychological Association (APA)
• Expected Time to Completion: Three years

Sam Houston University

Sam Houston University provides a 108-credit PhD program in clinical psychology with a forensic emphasis. In addition to clinical training and coursework, the forensic track helps students specialize in applying psychology to legal issues by learning how to perform court evaluations, mental health assessments, court consultations, and more.

The program’s coursework includes classes related to profession-wide competencies, discipline-specific knowledge, and forensic psychology as well as dissertation, thesis, practicum, and internship credits.

Sam Houston’s forensic psychology classes include psychopathology; assessment of personality and psychopathology; assessment of intelligence and achievement; cognitive and affective bases of behavior; law and social psychology; forensic assessment; and mental health law.

• Accreditation: Southern Association of Colleges and Schools Commission on Colleges (SACSCOC); American Psychological Association (APA)

Doctoral Programs in Forensic Chemistry

Forensic chemistry specializes in forensic science and can provide many career avenues. For example, forensic chemists holding PhDs can go on to work at a university in academia or may end up heading a forensic research lab.

Florida International University

Florida International University (FIU) in Miami is one of the top 25 largest universities in the nation and provides a PhD program in chemistry, forensic sciences, and biochemistry. With over 100 graduate students and a $4 million annual research budget, FIU’s Department of Chemistry and Biochemistry has a multidisciplinary approach to the forensic science field.

For example, the forensic science track focuses on the environmental impact of trace elements (e.g., mercury and arsenic), an essential line of work primarily in the wake of the Flint, Michigan water crisis. Other projects involve the study of hydrocarbons, airborne particulate matter, free radicals, and organophosphates. The forensic track also focuses on advanced aspects of biomedical research, such as the synthesis of essential molecules, protease enzymes, and how macular pigments are impacted by diet and nutrition.

Notably, Florida International University has a bachelor’s as well as a master’s degree in forensic science that is FEPAC-accredited.

• Location: Miami, FL

University at Albany

The University at Albany in Albany, New York, offers a PhD in analytical and forensic chemistry. This program is committed to advancing the techniques in forensic analysis at a molecular level and features classes such as advanced forensic chemistry, pharmacology, toxicology, analytical methods, comprehensive biochemistry, experimental methods of organic structure determination, and a forensic drug chemistry internship.

Finally, all students must pass the American Chemical Society graduate exams in organic and physical chemistry and inorganic or biological chemistry.

• Location: Albany, NY
• Accreditation: Middle States Commission on Higher Education (MSCHE)
• Expected Time to Completion: Three to five years

University of Central Florida

The University of Central Florida (UCF) in Orlando offers a PhD in chemistry and four concentration areas: materials chemistry; environmental chemistry; biochemistry; and forensic science.

The 72-credit forensic science program requires coursework in forensic analysis of explosives; forensic molecular biology; forensic analysis of ignitable liquids; forensic analysis of biological materials; population genetics and genetic data; frontiers in chemistry; radiochemistry; advanced instrumental analysis; and directed research in forensic science. Students at UCF will also have access to the National Center for Forensic Science (NCFS), a highly regarded research center.

• Location: Orlando, FL

Doctoral Programs in Forensic Anthropology

Forensic anthropology is an essential part of the crime-solving goals of all forensic sciences. PhD programs in forensic anthropology will allow students to deepen their understanding of how human remains and other evidence can help in the legal process.

University of Florida

The University of Florida (UF) in Gainesville provides a PhD program in biological anthropology focusing on forensic science. Students receive advanced instruction in recovering human remains and analyzing trauma. Classes include evolutionary biology; human gross anatomy; biostatistics; forensic pathology; biomechanics; archaeology; human development; and radiology and osteology.

UF also boasts a state-of-the-art forensics lab: the C.A. Pound Human Identification Laboratory (CAPHIL), which services other agencies around the state. This school’s multidisciplinary approach to forensic anthropology involves collaboration with departments in entomology, laboratory medicine, and soil and water analyses. Please note that this program is highly competitive, with fewer than 3 percent of applicants gaining admission. Typical admittees have high GPAs (>3.5) and GRE scores are not required for admission.

• Location: Gainesville, FL

The University of South Florida

University of South Florida (USF) in Tampa offers a doctoral program in applied anthropology. In addition, students may choose a concentration in archeological and forensic sciences (AFS). The program requires 42 credits beyond the master’s degree. The concentration in archeological and forensic sciences includes courses such as seminars in archaeology; forensic anthropology; advanced methods in forensic anthropology; introduction to forensic sciences; and bioarchaeology.

As the first institution in the US to offer a doctoral-level degree in applied anthropology, USF helps forensic anthropology students prepare for careers in the public and private sectors.

• Location: Tampa, FL

International PhD Programs in Forensic Sciences

For forensic science professionals seeking to advance their knowledge while living abroad, there are some PhD programs in forensic science in other countries.

Deakin University

Among them is a doctoral program at Australia’s Deakin University. Deakin, based in Geelong in the state of Victoria, provides a PhD program in chemistry, biotechnology, and forensic sciences.

Key research emphases at Deakin include forensic chemistry, forensic biology, forensic entomology, materials chemistry, and agricultural biotechnology, to name a few.

• Location: Geelong, Victoria, AUS
• Accreditation: N/A

Hybrid and Online Graduate Programs in Forensic Science

The American Academy of Forensic Science (AAFS) recognizes several online graduate programs related to forensic science. Still, there are no PhDs in forensic science that students can complete 100 percent online. This is mainly due to the importance of being present in a lab to analyze research findings and learn the empirical techniques of forensic science in a clinical context.

Oklahoma State University offers a notable PhD in forensic science program in a hybrid format.

Oklahoma State University

Oklahoma State University offers a PhD in forensic science program which is a highly interdisciplinary research degree involving advanced coursework in several forensic disciplines. Graduates of this PhD will have advanced knowledge conversant in a broader range of forensic disciplines than one with a master’s degree.

Applicants to the program must have a master’s degree. The curriculum includes courses such as survey of forensic sciences; technical aspects of forensic document examination; quality assurance in forensic science; ethics in forensic leadership; fire dynamics in forensic investigations; population genetics for the forensic scientist; advanced forensic laboratory experience; and forensic osteology and anthropology.

• Location: Tulsa, OK
• Expected Time to Completion: Four years

That said, there are some online programs related to forensic science, including:

University of Massachusetts

University of Massachusetts offers a graduate certificate in forensic criminology that can be completed entirely online. Courses completed in this certificate can be applied toward UMass Lowell’s online master’s degree in criminal justice.

The program’s 12-credit curriculum includes courses such as criminal profiling; forensic psychology; victimology; and sex crimes and offenders.

• Location: Lowell, MA
• Accreditation: New England Commission of Higher Education (NECHE)
• Expected Time to Completion: Nine months

University of North Dakota

The University of North Dakota offers an online master’s degree in forensic psychology preparing students for a variety of psychology-related careers in the criminal justice and legal systems. This top-ranked online program is offered entirely online on a part-time basis and can be completed in about two years.

Applicants to the program must have a baccalaureate degree from an accredited college or university with a behavioral or social science major allied with psychology and a cumulative undergraduate grade point average of 3.0 or above. There are no residency requirements or GRE requirements.

Made up of 30 credits, the program includes courses such as psychology and law; research methods in forensic psychology; cognitive psychology; eyewitness testimony memory; diversity psychology; and behavior pathology, among others.

• Location: Grand Forks, ND
• Expected Time to Completion: Two years

The University of Florida (UF) UF offers four online master’s programs related to forensics which can also be completed as web-based, 12 to 15-credit graduate certificates. These may be ideal for master’s-prepared forensic scientists seeking to enhance their knowledge in a subfield before committing to a PhD program. The four featured subfields at UF include forensic drug chemistry, forensic death investigation, forensic DNA and serology, and forensic toxicology.

While there are limited distance-based options for PhD programs in forensic science, some advanced programs in the subfield of digital forensics offer web-based coursework.

For example, Sam Houston State University offers a PhD in digital and cyber forensic science. This program is intended for students who have a bachelor’s degree in computer engineering, digital forensics, or computing science, and provides students with the conceptual, theoretical, computational, and methodological skills needed to understand the role of cyber and digital forensic science in post-technological societies.

Students in this program must complete 85 credits beyond the bachelor’s degree. Courses include file system forensics; cyber forensics principles; ethics for digital forensics; operating system forensics; network forensic analysis; mobile device forensics; live system & memory forensics; and computational forensics, among others.

Purdue Polytechnic Institute

The Purdue Polytechnic offers a PhD in technology with a specialization in cyber forensics. Students in this specialization will complete all the requirements of the PhD in technology degree along with 15 credits in core cyber forensics courses. Courses include basic computer forensics; advanced research topics in cyber forensics; cyber forensics of file systems; and cyber forensics of malware.

• Location: West Lafayette, IN

Please visit the online forensic science programs page to learn more about distance-based options in this field.

Common Courses and Requirements for Forensic Science PhD Programs

To complete a PhD program in forensic science, students typically need to complete the following:

• Advanced didactic coursework (generally 60-85 credit-hours)
• Internships, externships, or clinical practicums
• A dissertation on original scientific research
• Oral examination (i.e., oral defense of one’s thesis or dissertation to a program committee)
• Other exams (e.g., American Chemical Society graduate-level exams for forensic chemists)

These programs generally take four to six years to complete.

Organized by the popular subfields of forensic science, here are typical classes within each of the doctoral programs discussed above:

PhD in forensic science: forensic instrumental analysis, law and forensic sciences, forensic toxicology, controlled substance analysis, trace and microscopical analysis, ethical conduct, scientific communications, research methods, forensic lab management, forensic analysis of ignitable liquids, population genetics and genetic data analysis, forensic analysis of explosives

PhD in forensic psychology: mental health law, developmental psychopathology, psychological assessment, research methodology, psychometrics, multicultural psychology, effective intervention, theories and methods of diagnosis, experimental design, advanced statistics, consultation and supervision

PhD in forensic chemistry: microscopy, DNA in forensics, applied organic synthesis, chemical thermodynamics, kinetics and catalysis, drug chemistry, computer-assisted data analysis, questioned documents, toxicology, comprehensive biochemistry, advanced synthesis laboratory, toolmark and ballistics analysis, infrared spectroscopy, chromatography, solid phase extraction, medicinal chemistry and pharmacology, techniques in polymer science

PhD in forensic anthropology: forensic entomology, human growth and development, comparative analysis, archaeological methods and techniques, human variation, evolutionary medicine, anthropology of genocide, biophotography

Forensic Science Programmatic and Institutional Accreditation

Aspiring PhD candidates are encouraged to verify the accreditation status of their schools and programs. This program approval process is essential for several reasons. It helps establish a requisite quality level in the faculty, curricula, student outcomes, program resources, and other aspects that can impact a student’s education and experience. Also, graduating from an accredited institution may be a prerequisite to professional credentialing for some organizations.

There are two main types of accreditation: programmatic and institutional.

Programmatic Accreditation

The Forensic Science Education Programs Accreditation Commission (FEPAC) is the gold standard for programmatic accreditation. As of early 2024, FEPAC has not accredited any PhD programs. However, it is worthy of note that West Virginia University (WVU) has both FEPAC-accredited bachelor’s and master’s programs. Since WVU’s new PhD in forensic science program will share facilities and faculty with these FEPAC-accredited offerings, prospective students can presume that the doctoral program may also reflect this tradition of excellence.

Also, additional programmatic accreditation agencies may exist depending on one’s intended subfield of forensic science. For example, the American Psychological Association (APA) accredits forensic psychology programs at the doctoral level. Likewise, the Association to Advance Collegiate Schools of Business (AACSB) accredits graduate programs in forensic accounting.

Institutional Accreditation

There are six leading institutional accreditation agencies, which are organized according to region. They have been recognized by the US Department of Education’s Council of Higher Education Agencies (CHEA). These include:

• Accrediting Commission for Community and Junior Colleges (ACCJC) Western Association of Schools and Colleges
• Higher Learning Commission (HLC)
• New England Commission of Higher Education (NECHE)
• Northwest Commission on Colleges and Universities (NWCCU)
• Southern Association of Colleges and Schools Commission on Colleges (SACSCOC)
• WASC Senior College and University Commission (WSCUC)

Jocelyn Blore

Jocelyn Blore is the chief content officer of Sechel Ventures and the co-author of the Women Breaking Barriers series. She graduated summa cum laude from UC Berkeley and traveled the world for five years. She also worked as an addiction specialist for two years in San Francisco. She’s interested in how culture shapes individuals and systems within societies—one of the many themes she writes about in her blog, Blore’s Razor (Instagram: @bloresrazor). She has served as managing editor for several healthcare websites since 2015.

• Pathologists’ Assistant
• DNA Analyst
• Forensic Scientist
• Forensic Technician
• Forensic Autopsy Technician
• Forensic Investigator
• Forensic Toxicologist
• Forensic Science
• Forensic Engineering
• Pathologists' Assistant
• Forensic Tech
• Master's in Forensic Science

The Evolution of Touch DNA: Invisible Traces at Crime Scenes

In the landscape of forensic science, one of the most transformative developments has been the advent and refinement of touch DNA analysis.

How Portable Instruments are Changing Forensic Investigations

Handheld devices are not new to investigations—consider the magnifying glass or the breathalyzer test—but their growing complexity and efficacy are changing the way modern investigations are conducted.

Modern Forensic Science Technologies (2024)

As technology infiltrates every aspect of our lives, it is no wonder that solving crimes has become almost futuristic in its advances.

How To Become a Forensic Scientist

Forensic scientists have very interesting jobs that can take them from crime scenes to labs and to courtrooms.

15 Top Forensic Biology Programs (2024)

Those educated in forensic biology can seek out careers as biologists, DNA biologists, biologist forensic examiners, biology DNA program specialists, and more.

Top Forensic Chemistry Programs

Forensic chemistry attracts curious problem-solvers who can collect evidence with precision and remain objective in their observations.

Back to Top

School of Engineering, Computing and Mathematics

Phd cyber security.

Cyber security is a fundamental requirement for all users of technology – helping to protect organisations and people from a significant, wide variety and constantly evolving threat. This ever-changing threat landscape requires constant innovation in the technologies that provide protection.

Course details

Programme overview.

• This full time or part time doctoral programme is suitable for people who have a particular research question or topic in mind, and wish to explore this through independent study in order to produce an original contribution to the subject. If you aspire to a research career this is the most appropriate research degree to undertake. You will be guided by a small supervisory team of academic experts under the direction of a Director of Studies. You will be expected to fully engage with skills development and training and to present your research in a range of scholarly contexts. Your PhD will be assessed via submission of either a written thesis (up to 80,000 words), or one that combines critical writing with artistic, creative and/or professional practice, and a viva voce (an oral examination). For full details of what doing a PhD entails at the University of Plymouth, please visit our postgraduate research degrees pages . 

Entry requirements

Fees, costs and funding, how to apply.

• ) Apply online
• / Contact us
• ; Info for applicants
• 6 Studentships

The Doctoral College is able to answer any questions you may have about applying for or undertaking a postgraduate research degree at the University of Plymouth: [email protected] or +44 1752 587640 . For initial enquires or questions, please contact Professor Nathan Clarke who will liaise with you and the appropriate member of academic staff to discuss your background and work towards producing the prima facia case.

The PhD Cyber Security programme is an opportunity to immerse yourself in a programme of study that will lead you to making a significant novel contribution to knowledge. Supported by the Centre for Cyber Security, Communications and Network Research (CSCAN) and our internationally recognised academics, candidates will undertake a body of research focused upon a targeted area of cyber security, publish papers and contribute to the wider community and body of knowledge.

Cyber security news

• University and International Maritime Organization hold annual cyber symposium 9 November 2023
• University strengthens cyber security links across Australia 5 October 2023
• University and BMT join forces to improve cyber security in the maritime sector 2 August 2022
• First real-world study shows the potential of gait authentication to enhance smartphone security 10 December 2021
• Maritime cyber innovation wins at UK government’s cyber security event 19 May 2021

More related news

Dr Abdulrahman Alruban

Assistant Professor at Majmaah University, Saudi Arabia Artificial intelligence consultant at MMG labs, Spain (part-time)

My PhD research was about developing a pioneering algorithm able to link individuals with digital objects that they interact with (e.g. images/documents) leveraging biometric features. The project resulted in five scientific publications and granted a patent to protect the novelty of the developed system. 

My experience at the University of Plymouth is unforgettable, as having an excellent supervision team led by Professor Nathan Clarke has dramatically developed my knowledge and research skills in the domain of cybersecurity and biometrics. The University gave me the opportunity not only success in my research but also participating in teaching, training activities. Resulted in getting a teaching certificate and become a module leader. Not only I who loved living in Plymouth city but my family also loved it! From nice public schools to sports centres, national reserves with beautiful rivers made my family loved it.

Dr Shahlaa Mashhadani 

PhD: Image Analysis in Digital Forensics  

Shahlaa Mashhadani graduated with a PhD in Cyber Security and is now working for Baghdad University as an academic lecturer in a computer science department in Iraq. 

“My project automated the identification and extraction evidence from multimedia content to reduce the time and investigator’s cognitive load to solve a crime. Studying PhD in the University of Plymouth has helped me improve my academic skills and knowledge in my field. Without this experience, I would have not been at this stage right now. Moving to Plymouth has really improved my English language and I got to see a whole different life. The people over there were very welcoming, kind and supportive”.

"I was working as a Lecturer at School of Computing and Mathematics at University of Kufa (Iraq). I moved to Plymouth to study a PhD that concentrated on securing smartphones by using the rich sensing capabilities of the wearable devices. There is a potential invention to use these devices for designing a novel health care model that provides comprehensive and continuous medical care to patients with a goal to obtain maximal health outcome using the patient’s biometric information (e.g. skin temperature, heartrate, and acceleration).

The starting of my academic was very difficult and I decided to suspend my study and back home. Then everything was fine as my supervision team were very patient, kindness, supportive and have a great impact on my career. I had the opportunity to improve my skills (English, academic writing, presentation skills). Plymouth is a nice place to live and being able to network with others."

Dr Neamah Al-Naffakh

PhD: Activity-Based User Authentication Using Smartwatches

Centre for Cyber Security, Communication and Network Research (CSCAN)

Improving emergency service incident responses. Sharing space-data. Fighting cybercrime. The Centre for Cyber Security, Communication and Network Research (CSCAN) is driving technological advances that are changing our world for the better.

Dedicated laboratory facilities

As well as accessing our standard computing facilities , you’ll be able to make extensive use of a 42-seat dedicated security and digital forensics laboratory, purpose-built to represent a range of network topologies and monitoring conditions.

Professor Nathan Clarke

Professor in cyber security and digital forensics.

Professor Kevin Jones

Deputy vice-chancellor - research and innovation.

Dr Bogdan Ghita

Associate professor.

Dr Ji-Jian Chin

Lecturer in computer science.

Dr Hai-Van Dang

Lecturer in cyber security.

Dr Kimberly Tam

Associate professor in cybersecurity.

Dr Rory Hopcraft

Meet our school technical staff  , funding for postgraduate research students.

Doctoral College

Find out more about the Doctoral College and the support it offers students, supervisors and examiners of postgraduate research at the University of Plymouth.

Department of Information Security and Communication Technology

• Master's programmes in English
• For exchange students
• PhD opportunities
• All programmes of study
• Language requirements
• Application process
• Academic calendar
• NTNU research
• Research excellence
• Strategic research areas
• Innovation resources
• Student in Trondheim
• Student in Gjøvik
• Student in Ålesund
• For researchers
• Life and housing
• Faculties and departments
• International researcher support

Språkvelger

Ntnu digital forensics.

The research group focuses on research and development of advanced computational methods to establish and prove the scientific basis of forensic investigative procedures, with the objective to support forensic examiners in their daily casework. 

About our Research Group

We conduct fundamental and applied research to enhance prevention, investigation and prosecution of cybercrime, cyber-enabled fraud, and high technology crime.

We also contribute to advisory services, forensic casework, and expert witness in cooperation with partners from national, European and international law enforcement agencies (LEA), academia and the private sector.

Learn more about our research

• Research in the area of large-scale investigations; automatic search through terabytes of electronic data storage within closed systems and the Internet,
• Research and development for the rapid acquisition, correlation and analysis of Internet-related evidence,
• Technologies for cross-media search and data integration to access diverse sources of information, in particular data enrichment from Internet sources,
• Algorithms for the analysis of encrypted evidence and cryptographic credentials,
• Design of advanced computing technologies to achieve more objective evidence analysis and final decision making by implementing computational intelligence.
• Development of methods and tools for digital penetrator attribution and profiling, visualization of serious criminal relationships and associations, and geographical mapping of digital and physical evidence.

Mission statement

Teaching on Bachelor, Master , and PhD Level

• Postgraduate Education and Training
• Curiosity-driven, fundamental research and publications 
• Applied Research and Development on behalf of Industrial and Governmental Entities
• Forensic Casework, Expert Witnesses, and Advisory Services in Cooperation with Partners
• Networking and Community-building Activities, e.g., Workshops, Tutorials, Competitions,…
• Assist in basic and applied forensic research, e.g. to establish or prove the scientific basis of a particular forensic investigative procedure,
• Support the forensic examiner in their daily casework.
• Modern crime investigation, prosecution and prevention shall profit from the joint intelligence of humans and machines.

Research activity

Vacant positions, key academic staff, key academic staff, person-portlet, katrin franke professor of computer science, jan william johnsen researcher, carl stuart leichter adjunct associate professor, kyle andrew porter researcher, andrii shalaginov associate professor, part-time academic staff, part-time academic staff, stefan axelsson associate professor, geir olav dyrkolbotn associate professor, hanno langweg associate professor, thomas walmann, part-time without person portlet.

André Årnes , Adjunct Associate Professor

Jefferey D. Hamm , Lecturer, Mandiant/FireEye

Affiliated Academic Staff

Christoffer vargtass hallstensen head of soc, anna maria henningsson adviser, basel katt head of department and professor, mariusz nowostawski associate professor, affiliated without person portlet.

Inger Marie Sunde , Professor, The Norwegian Police University College (PHS)

Hallstein A. Hansen , PhD, Oslo Police District (OPD)

Jul Fredrik Kaltenborn , PhD Research Fellow, Department of Information Security and Communication Technology

News and events

News and events, digital forensics map.

Teknologivegen 22 Gjøvik

Phd research fellows

Ph.d. research fellows, jens-petter sandvik, academic partners.

• United Nations Interregional Crime and Justice Research Institute
• University California Santa Cruz, USA
• Kyushu Institute of Technology, Japan
• University of Groningen, The Netherlands
• Norwegian Computing Centre (NR) , Norway
• Norwegian Police University College (PHS), Norway
• University in Oslo, Norway
• University of Malta, Malta
• National Research Council of Italy, Italy
• National Intelligence Academy, Romania
• Edith Cowan University, Australia
• Fraunhofer Society, Germany
• Hitachi Central Research Laboratory, Japan
• École Polytechnique Fédérale de Lausanne, Switzerland
• Ellinki Aeroporiki Viomichania Anonymi Etairei, Greece
• National Institute of Standards and Technology (NIST), USA
• Universität Stuttgart, Germany

User partners from public sector

• Norwegian National Police Directorate (POD), Norway
• Kripos, Norway
• Økokrim, Norway
• Oslo Police District (OPD), Norway
• Netherlands Forensics Institute (NFI), Netherlands
• Advance Technology Institute, Romania
• NorSIS – Norsk Senter for Informasjonssikring, Norway
• Misa SA, Norway
• Raufoss Technology AS, Norway
• SINTEF Raufoss Manufacturing, Norway

Security-service providers

• FinansCERT, Norway
• mnemonic AS, Norway
• Synergetics N.V. Group, Belgium
• Xensics, USA
• KraftCERT AS, Norway
• National Sikkerhetsmyndighet (NSM), Norway
• REALITY NET System Solutions, Italy
• Ericsson AB, Sweden
• C 3 M d.o.o., Slovenia
• Promon, Norway
• RD&T Technology AB, Sweden

Digital Forensics Degrees

Cybersecurity Degrees » Cybersecurity Programs » Digital Forensics Degrees

Wendy Wittmer , MBA. Specializes in cybersecurity planning and strategy for small businesses. Training from the Department of Homeland Security, CISA, NIST, FTC, FCC, SBA, more.

Consider a sponsored online program currently accepting applicants.

Click to see sponsored 100% online cybersecurity programs currently taking applicants for 2024 .

A digital forensics degree will often teach various aspects of the law and teach high-level communication. These individuals will be required to work with a variety of other criminal professionals, such as police, social services, attorneys and judges. This degree might even teach students to be able to recreate criminal activities.

Digital forensics can also be referred to as cyber forensics in some cases. It is a field of increasing importance given the state of cybercrime in today's world. Graduates can work in nearly any field or industry. Careers are not limited to the justice system. This degree can be used in incident and response, as well. Many corporations, insurance companies and others also hire digital forensics. Each degree will offer a unique specialization to meet specific career aspirations.

Are There Online Digital Forensics Programs?

Yes, online Digital Forensics programs are widely available today. It is possible to find them at nearly any degree level. Prospective students can find them mostly at the bachelor's degree and master's degree levels . Digital Forensics bachelor's degrees will often be a generalized degree in cyber security and digital forensics. However, a master's degree in Digital Forensics typically offers a specialization combined with other areas of IT, IS, law or management. The following are a few types of Digital Forensic degree offerings:

• Computer ForensicsComputer Forensics degrees
• Cyber Investigation degrees
• Forensic Computing
• Forensics and Incident Response
• Criminal Justice and Cybercrime Investigation
• Digital Investigations

Digital Forensics degrees vs. forensic science and computer forensics

Some people are familiar with forensic science due to crime scene investigation tv shows. Digital Forensics is similar yet quite different at the same time. With a degree in digital forensics, individuals will recover, process and investigate material from digital devices and electronic sources. These degree holders will also identify, analyze, interpret, document and preserve digital evidence. As a result, this evidence is then presented in a court of law.

Review of some of the best digital forensics degrees

Champlain college, bs computer forensics and digital investigations.

Champlain College has a BS in Computer Forensics and Digital Investigations. It is 100% online with 24/7 access to coursework. The program estimates students will require between 10 and 17 hours of time each week for each course. This program is a bit different from traditional formats. Each semester has two separate seven-week terms and three semesters per year. However, some courses will be 15 weeks.

The program will accept up to 90 transfer credits. And students can complete the program as part-time or full-time students. Students who have completed certain certifications can apply them toward transfer credits.

This program is recognized by the Department of Homeland Security, the NSA and DC3. It has a CAE designation. Curriculum centers around various cybercrime certifications. In fact, upon graduation, students will also receive a CDFAE certificate. Students will also be able to receive the Department of Defense Digital Media Collector certificate and the Digital Forensic Examiner certificate. These are possible with a DC3 partnership.

Courses will provide a well-rounded educational experience in a variety of areas, including:

• Professional courses
• Technical electives
• Science literacy
• Human behavior & social institutions
• Human thought & creative expression

Students will also be trained and have hands-on experience in roughly 25 areas of technical skill development, such as:

• Programming languages
• Digital foresnics tools
• Software programs

Graduates of this online Digital Forensics degree go on to work for government organizations, corporations, law enforcement agencies and more. Admission requirements are considered a recommendation. Each individual is considered on a case-by-case basis. A 2.5 GPA minimum is preferred. However, the school will also consider positive contributions to communities, professional experience and a track record for online learning success. And Champlain College has a military-friendly designation.

Oklahoma State University, Bachelor of Technology in IT-Cybersecurity & Digital Forensics

The BT in IT-Cybersecurity and Digital Forensics at OSU is 100% online. This program is aimed at students interested in a career that combines security and digital forensics. Students will learn the fundamentals of cyber security while developing essential skills, such as:

• Secure access
• Identificaiton and analysis
• Problem solving
• Cybercrime and cyberattack investigation
• Communication

Courses include a variety of subjects, including:

• Programming
• Project management
• Cyber security
• Hardware systems support
• Network systems
• Web development
• Operating systems
• Digital forensics
• Enterprise security management

Students must complete at least 121 credit hours to graduate. It is possible to complete the degree in as little as two or three years. Transfer credits are accepted. However, students can complete the program at their own pace to accommodate for busy lives. The program also provides hands-on experience, including internships.

The program is accredited by the Computing Accreditation Commission of ABET. OSU's Institute of Technology has close to a 100% job placement rate.

OSU's digital forensics program is roughly half the cost of most in-state schools and the cost applies to all domestic students rather than in-state residents only. The school also offers extensive financial aid packages. To apply, students must provide ACT or SAT scores, a high school diploma or its equivalency and participate in an academic profiling assessment.

Keiser University, BS in Cybersecurity

Keiser University has a BS in Cybersecurity. It is available online and on roughly 15 campuses. This digital forensics program centers around technical and investigative skill development. Students will learn to identify and prevent cybercrime. They will also be able to provide assessments and viable solutions to cyberattacks.

Courses will focus on critical thinking, communication and expert-level know-how. Students will learn the essential foundations for forensics. And they will be able to apply legal considerations, recover from incidents and develop defensible forensic processes.

A few examples of major courses are as follows:

• Ethics in Information Systems
• Criminal Evidence and Procedures
• Systems design
• White-Collar and Economic Crime
• Digital Media Forensics
• Network Forensics
• Network Defense and Countermeasures

Students can apply with a high school diploma or its equivalency. Those who have completed some college courses or an associate degree in a computer-related field are also eligible. Several prerequisite lower division courses must be completed before being allowed to complete advanced major courses. Students can use transfer credits from accredited institutions to meet prerequisites.

Some Top Online Digital Forensics Master's Programs

Master's degrees in Digital Forensics are available in a wide range of specializations, such as:

• Forensic Accounting
• Forensic Investigation
• Computer Forensics
• Digital Forencis and Investigation
• Information Security and Digital Forensics
• Computer Forensics and Security Management
• Computer Forensics Management

It is possible to pursue a master's degree in Digital Forensics with any number of bachelor's degrees. Most people will complete a bachelor's degree in digital forensics or a computer-related field. However, for consideration into master's degrees, it is also possible to complete a bachelor's degree in criminal justice, legal studies, accounting, forensic science and more. Some programs will also consider professional experience over the concentration of a bachelor's degree. Some master's degrees might also be in cyber security with a concentration in digital forensics.

Stevenson University, MS in Cybersecurity and Digital Forensics

The Stevenson University MS in Cybersecurity and Digital Forensics is ideal for advancing careers in IT. The program centers around both cybersecurity and digital forensics. Program participants will learn to analyze digital evidence that has been forensically gathered. Students will also learn to preserve, interpret, record and report forensic details. These findings are then used to launch a prosecution or to secure a conviction. This might be related to computer security or legal proceedings.

Stevens University creates its curriculum based on the ever-changing needs and demands of employers. Courses might include the following:

• File Systems Forensic Analysis
• Malware Detection, Analysis, and Prevention
• Windows Forensic Examinations
• Mock Intrusion and Response
• Legal Compliance and Ethics
• Network Penetration Testing
• Incident Response and Evidence Collection

The fields of cybersecurity and digital forensics are in a constant state of evolution. As such, it is imperative to select programs that keep up with the times. Here, students have access to an advanced virtual lab to provide hands-on experience in forensic analysis. Students will also participate in various real-life exercises that center around the theft of electronic information. And everyone has access to critical skill development and career planning.

Graduates of this program often qualify to complete various digital forensics certifications. Many select growth careers, such as cyber security engineering, cyber security analysts and network architecture. To qualify for acceptance, students must have a bachelor's degree based on a quantitative or technical field. Professional work experience may also be acceptable. It is a requirement to have transcripts reviewed by an organization the is a NACES member. A minimum of a 3.0 GPA is necessary.

University of New Haven, MS in Digital Forensic Investigation

The University of New Haven offers an MS in Digital Forensic Investigation. This degree is entirely online and provides a career pathway to leadership positions and higher salaries. Students can even build their own degrees to reach their greatest career potential. The program’s 10 courses can be completed in a year for full-time students. Some students complete the program in two years.

Overall, students will gain superior know-how regarding digital forensics investigative practices. They will also acquire a deep grasp of digital evidence while practicing various techniques and using specific tools. Courses are led by industry experts with real-life field experience. And it is possible to transfer up to six credit hours from an approved higher learning institution.

Potential students can receive a 20% discount on tuition if they are part of specific professional organizations. Individuals who are already a correctional officer or a sworn officer can qualify for 50% off. All students are eligible for financial assistance in some way. And everyone has access to the Career Development Center. This university also offers master’s degrees in Financial Crimes and Healthcare Fraud, Waste and Abuse.

Students will have to complete 30 credit hours. The application process will depend on the type of student. However, most students will require at least a bachelor’s degree in a related field. Transfer students and international students will have their own set of requirements to meet.

University of Maryland Global Campus, MS Digital Forensics and Cyber Investigation

The University of Maryland Global Campus has an MS in Digital Forensics and Cyber Investigation. This program aims to prepare students for leadership roles and executive skill development. Students will learn to manage complex threats and attacks. They will also be able to follow best-in-class digital forensics practices for business, administration and legal prosecution.

This Digital Forensics degree will also assist in problem-solving alongside evidence examination. The UMGC MS in Digital Forensics and Cyber Investigation has a CAE designation from the NSA and the Department of Homeland Security. Graduates often work in business, for government agencies or in law enforcement. They work to mitigate cyberattacks, track down digital offenders and evaluate digital crime evidence.

Courses are designed to provide exceptional long-term career opportunities, such as:

• Communicating, Problem Solving and Leading in Cybersecurity
• Digital Forensics Response and Analysis
• Cyberspace and Cybersecurity Foundations
• Digital Forensics Technology and Practices
• Capstone in Cybersecurity
• Advanced Forensics

The school also features several related clubs and organizations to improve upon skills and establish future professional relationships. This includes the Computing Club and Cyber Competition Team. It is recommended that students have at least a background in programming and computing. If individuals do not have these existing skills, several courses are available through the school. UMGC undergraduates who major in cybersecurity and computer networks can reduce credit requirements by six credit hours.

Students must maintain at least a 3.0 GPA. The program must be complete within five years. And transfer credits are only valid if they were completed in the past five years.

Top Courses to Expect in Digital Forensics Degrees

The best programs in digital forensics will incorporate a combination of technical and soft skills, tools and know-how. Programs should prepare students in a wide area of subject matter, such as:

• Storage Media
• Operating Systems
• File Systems
• Database Systems
• Network Technologies and Infrastructures
• Programming and Scripting
• Computer Security
• Cryptography
• Software Tools
• Validation and Testing Tools
• Intro to Psychology
• IT for Business
• Intro to Law and Criminal Justice
• Cyber Defense
• Mobile Forensics
• Risk Analaysis and Security Policies
• Multimedia Forensics
• eDiscovery Forensics and Moot Court

Keep in mind that courses will be more advanced in graduate degree programs. And course offerings will be based on the specialization of the digital forensics program.

Is Accreditation Important for Digital Forensics?

Accreditation is essential for any degree. It is important to select programs from colleges and universities with regional accreditation. This accreditation is held to a higher educational standard than national accreditation. Employers are aware of this difference and typically prefer candidates with a regionally accredited education.

The best programs will have a National Centers of Academic Excellence (CAE) designation. This designation is awarded by the Department of Homeland Security and the NSA. Some top programs might have a specialized accreditation by the Forensic Science Education Programs Accreditation Commission. The US Department of Justice has a Technical Working Group for Education and Training in Digital Forensics. This organization assists with exceptional curriculum guidance. And programs can also be accredited by the Computing Accreditation Commission of ABET.

All of these accreditations can lead to better job opportunities, higher salaries and career advancement.

Are There Scholarships for Digital Forensics Degrees?

Scholarships for Digital Forensics students are available at all degree levels. However, it is often easier to secure scholarships for bachelor’s degrees. Many degrees will be available on financial need. Other degrees will be dedicated to any student pursuing a career in computer science or STEM.

And some degrees will be reserved for students who are underrepresented throughout the IT community, such as BIPOC and LGBTQ+ individuals and women. In certain cases, scholarships will be available through schools. Many scholarships are offered through corporations, private institutions, professional organizations, nonprofits and many others. Government agencies even offer scholarships as a service to help with tuition and living expenses.

The following are a few examples of scholarships available for students in Digital Forensics degrees:

• AFCEA Cyber Security Scholarship
• Stokes Educational Scholarship Program
• CIA Undergraduate Scholarship
• CIA Graduate Studies Scholarship
• Women in Defense Scholarship

Each scholarship will have different requirements and expectations for applicants.

Related Cyber Security Certifications

A wide range of cyber security and digital forensics certifications are available. Many of these certifications are essential to remain in demand by employers, such as:

• CDFAE Certificate
• DoD Digital Media Collector
• Computer Hacking Forensic Investigator (CHFI)
• AccessData Certified Examiner (ACE)
• EnCase Certified Examiner (EnCE)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Reverse Engineering Malware (GREM)
• GIAC Network Forensic Analyst (GNFA)
• GIAC Advanced Smartphone Forensics (GASF)
• GIAC Cyber Threat Intelligence (GCTI)
• CFCE (IACIS)
• CHFI (EC-Council)

Career Options with Digital Forensics Degree

Careers in Digital Forensics are widely available in numerous industries, including:

• Corporations
• Crime laboratories
• Law enforcement
• Municipalities
• Non-profits
• Federal agencies

The types of jobs one can secure are equally as diverse, such as:

• Computer Forensics Technician
• Information Security Analyst
• Security Consultant
• Forensic Computer Analyst
• Information Systems security Analyst
• Information Technology Auditor
• Malware Analyst
• Digital Forensics Specialist
• IS Security Engineer
• Sr. Quality Engineer
• Special Agent
• Computer Forensic Investigator

MS in Digital Forensics & Cybersecurity

MS in Digital Forensics & Cybersecurity (D4CS) Program Director:  Professor Shweta Jain

• D4CS faculty are full-time professors who are computer scientists, legal scholars and/or social scientists with a supporting cast of adjuncts who are working professionals.
• We are a small, selective program with a mix of mid-career professionals and recent graduates who attend both full and part time. Our students are from New York and beyond with most working in IT or other fields, all dedicated to beginning a career in digital forensics and cybersecurity.
• All courses are offered on-campus, typically on Monday through Thursday evenings to accommodate working students.
• Small classes enable students to build strong ties with each other and faculty.
• Students often work with faculty on research projects.
• Courses move from theory to practice with hands on lab work.
• Internships and cooperative education are key elements of the program.

Who We Seek

• Computer science graduates who are interested in combining the study of forensic computer science with criminal justice
• Public and private sector practitioners who wish to upgrade their expertise by studying the science beneath the tools they use in their work (up to six equivalency credits are available to practitioners)
• Law enforcement personnel and veterans who seek to move into cyber investigations and digital forensics
• Experienced information technology specialists or those from related fields who wish to make a career shift

What Our Graduates Do

Equipped with their multi-faceted education in forensics, computer science, law and criminal justice, our versatile graduates pursue a variety of career paths in digital forensics, cybersecurity and information assurance, such as:

• Cyber investigators
• Special agents with federal agencies
• Digital forensic analysts
• eDiscovery specialists
• Lab managers
• Information security (INFOSEC) specialists
• Cyber incident analyst responders
• Cybersecurity analysts
• Computer security
• Network security analysts
• Information assurance consultants
• Forensic computing product researchers and developers
• Doctoral students in related fields

Program Requiements

Read more...

How to apply?

Admission to the D4CS program requires a background in computer science with the ability to succeed in graduate computer science, criminal justice and law courses. Computer science or related majors are preferred; however, the minimal computer science background required consists of the following undergraduate courses: two courses in programming and courses in data structures, algorithms, operating systems, computer networks, statistics, and discrete math.

Admission to the program will also be based on the following criteria:

• Bachelor’s degree from an accredited institution (or international equivalent) with a cumulative GPA of 3.0 or higher
• Three letters of recommendation
• Personal statement
• Official transcripts from all post-secondary institutions attended

All applicants are required to submit a resume. Applicants who hold advanced graduate or professional degrees from an English language based program are advised, but not required, to submit GRE scores. Interested candidates who lack some or all of the computer science prerequisite courses may be admitted to CSIBridge, our Computer Science for Digital Forensics advanced certificate program. Successful completion of the CSIBridge program leads to seamless transfer into the D4CS master's degree program.

For any questions regarding the admissions process, contact: 

Office of Graduate Admissions 212-237-8863 [email protected]

The Graduate Certificate in Digital Forensics helps you gain the skills you need to investigate computer, cyber, and electronic crimes; to analyze networks that have been attacked or used for illicit purposes; and to properly identify, collect, secure, and present digital evidence.

•     Digital forensics tradecraft
•     Techniques and procedure
•     Standards of practice
•     Legal and ethical principles
•     Assuring that digital evidence is accurate, complete, and reliable

Although there are no specified course prerequisites, prospective students applying to this program are advised that this is a technology-based training program, focused on collecting security data and digital evidence.

Successful students will have an aptitude for technical training and investigative procedures. Some prior training or background in operating systems concepts, computer architecture, computer hardware and storage media will be helpful.

Graduate Certificate Admissions and Process

Students must apply and be admitted into the Graduate Certificate to be eligible to receive a Graduate Certificate. Applicants are encouraged to contact the Graduate Certificate Director prior to applying. 

Applicants must meet the following admission requirements:

• University Admission Requirements, including English Proficiency      
• Graduate Certificate Admission Requirements     
• ​​ Application Process 

Curriculum Requirements (15 Credit Hours)

• CJE 6688 Cybercrime and Criminal Justice Credit Hours: 3
• CJE 6627 Digital Evidence Recognition and Collection Credit Hours: 3
• CJE 6624 Introduction to Digital Evidence Credit Hours: 3
• CJE 6626 Digital Forensic Criminal Investigations Credit Hours: 3
• CJE 6625 Network Forensic Criminal Investigations Credit Hours: 3

Graduate Certificate Time Limit

Five (5) Years.

Graduate Certificate Completion

For procedures to confirm completion of the Graduate Certificate, please refer to the  website .

• Future Students
• Parents and Families

Office of Strategic Initiatives

Digital forensics programs.

The University of Rhode Island offers one of the most comprehensive degree programs in Digital Forensics through a Computer Science Department at a major university. This includes a variety of degree and certificate programs for undergraduate students, graduate students and working professionals.

Professional Certificate in Digital Forensics

Completely Online! For working professionals who do not currently have a four-year undergraduate degree and are not interested in pursuing a full four-year undergraduate degree at this time. Choose from a concentration in Windows Investigations or Incident Response Investigations.

Graduate Certificate in Digital Forensics

Completely Online! For working professionals who currently have a four-year undergraduate degree, but are not interested in pursuing a full Masters degree at this time. Choose from a concentration in Windows Investigations or Incident Response Investigations.

Master’s Degree with a concentration in Digital Forensics

For graduate students who are pursuing a Master’s Degree in Computer Science and would like to compliment that with a Graduate Certificate in Digital Forensics.

PhD with a concentration in Digital Forensics

For graduate students who are pursuing a PhD in Computer Science and would like to compliment that with a Graduate Certificate in Digital Forensics.

For detailed information about our programs, requirements, or how to prepare for starting any of the programs listed please visit this page .

To contact someone from this department, please email the program manager at [email protected] or contact Victor Fay-Wolfe, Ph.D, Program Director, 401.874.2701 , [email protected] .

Digital Forensics Graduate Certificate

Program at a glance.

• Online, On Campus, and Blended
• Part-Time Study
• 8–12 Months to Completion
• 17 Core Faculty
• No GRE/GMAT
• Tuition & Fees—Part-Time Study*: $15,400

*Based on 2023–2024 Boston University tuition and fees.

Become a Skilled Digital Crime Investigator

Available on campus, online, and in a blended format, the Graduate Certificate in Digital Forensics at Boston University’s Metropolitan College (MET) is designed to develop proficiency in digital crime scene investigation.

The fundamental role of digital systems in business—from computers and networks to all manner of smart devices—brings serious security challenges. According to the FBI’s Internet Crime Complaint Center (IC3), more than $10 billion in losses have been reported since 2015, much of that as a result of hackers, criminals, and other “bad actors” attacking organizations through schemes such as business email compromise (BEC), ransomware, phishing, extortion, and personal data breaches (to name just a few).

To mitigate such risks to valuable information, it is important for IT specialists to obtain a comprehensive overview of digital forensics. The specialized BU MET certificate program in Digital Forensics provides you with a comprehensive knowledge of digital crime scene investigation and introduces topics such as forensic analysis policy and procedures, forensic analysis tools, data recovery, and investigation, among others.

#8, Best Online Master's in Computer Information Technology Programs

MET’s online master’s degrees in computer information technology are ranked #8 in the nation by U.S. News & World Report for 2024.

Request Information

Receive more details about your program of interest.

Computer Science Career Outlook

Top computer science careers in data science, software development, and other popular areas of IT.

Explore Careers in Digital Forensics

Why bu should be your top choice for computer science graduate study.

• Recognized & Certified: Boston University is recognized by the National Security Agency and the Department of Homeland Security as a Center of Academic Excellence (CAE) in Cyber Defense and Research . BU MET’s information security programs are certified by the Committee on National Security Systems (CNSS).
• Active Learning Environment: BU MET’s computer science courses ensure you get the attention you need, while introducing case studies and real-world projects that emphasize technical and theoretical knowledge—combining in-depth, practical experience with the critical skills needed to remain on the forefront of the information technology field. In addition, BU’s Center for Reliable Information Systems and Cyber Security (RISCS) offers opportunities to collaborate and participate in research on system reliability and information security.
• Engaged Faculty: In BU MET’s computer science graduate programs, you benefit from working closely with highly qualified faculty and seasoned industry leaders in a wide range of technology fields who are committed to teaching the latest technologies within the framework of ideas, concepts, and methods that drive innovation.
• Extensive Network: Study alongside peers and professionals with solid IT experience, learn from faculty who have valuable contacts across several sectors, and benefit from an alumni community with strong professional connections.
• 15:1 Class Ratio: Enjoy an exceptional student-to-instructor ratio, ensuring close interaction with faculty and access to support.
• Valuable Resources: Make use of Boston University’s extensive resources, including the Center for Career Development , Educational Resource Center , Fitness & Recreation Center , IT Help Centers , Mugar Memorial Library , Center for Antiracist Research , Howard Thurman Center for Common Ground , George Sherman Union , Rafik B. Hariri Institute for Computing and Computational Science & Engineering , and many others.
• Flexible Options: Study at the pace that works for you, evenings on campus, fully online, or in the blended format that combines on-campus and online learning. Courses begin fall, spring, and summer; online courses have two starts per term.
• Track Record: Learn from the best—BU MET’s Department of Computer Science was established in 1979 and is the longest-running computer science department at BU. Over its four decades, the department has played an important role in the emergence of IT at the University and throughout the region.

Prepare for the Future of Technology with BU MET

The four-course Digital Forensics graduate certificate is part of BU MET’s portfolio of computer science and IT graduate programs. For over forty years, the Department of Computer Science at Metropolitan College has prepared students to tackle contemporary challenges in the field. Our programs are uniquely flexible—we offer courses evenings on campus, fully online, or in a blended format that combines online study with occasional campus visits—so you can balance graduate school with your career, family, and other obligations. We take pride in providing training in critical specialization areas and emphasizing practical, insightful, and adaptable knowledge that can be immediately applied on the job while informing your career growth for years to come. We also offer extensive advising to help you identify the subjects you’ll need to achieve your career goals.

Our degree programs are certified by the Committee on National Security Systems (CNSS)—the MS in Computer Information Systems has additional accreditation from the Project Management Institute Global Accreditation Center for Project Management Education Programs ( GAC ) and the Commission on Accreditation for Health Informatics and Information Management Education ( CAHIIM ). Boston University is designated a Center of Academic Excellence (CAE) in Cyber Defense and Research by the National Security Agency and Department of Homeland Security.

Gain Expertise in Digital Forensics

Metropolitan College’s Graduate Certificate in Digital Forensics will equip you with:

• Advanced knowledge of the computer and mobile forensics tools necessary to launch a complete and successful digital forensics investigation in civil, criminal, or administrative cases.
• Proficiency in conducting network forensics analysis, including determining how a perpetrator or an attacker gained access to a network and transmitted felonious digital data.
• Competence sufficient to conduct a comprehensive “digital crime scene investigation” and mastery of skills pertaining to acquisition of digital evidence, conducting analysis, presenting a report, and being an expert witness in a court.

Certificate-to-Degree Pathway

Digital Forensics Graduate Certificate Curriculum

Met cs 625 business data communication and networks.

This course presents the foundations of data communications and takes a bottom-up approach to computer networks. The course concludes with an overview of basic network security and management concepts. Prereq: MET CS 200, or instructor's consent. This course may not be taken in conjunction with MET CS 425 (undergraduate) or MET CS 535. Only one of these courses can be counted towards degree requirements.  [ 4 cr. ]

MET CS 693 Digital Forensics and Investigations

Provides a comprehensive understanding of digital forensics and investigation tools and techniques. Learn what computer forensics and investigation is as a profession and gain an understanding of the overall investigative process. Operating system architectures and disk structures are discussed. Studies how to set up an investigator's office and laboratory, as well as what computer forensic hardware and software tools are available. Other topics covered include importance of digital evidence controls and how to process crime and incident scenes, details of data acquisition, computer forensic analysis, e-mail investigations, image file recovery, investigative report writing, and expert witness requirements. Provides a range of laboratory and hands-on assignments either in solo or in teams. With rapid growth of computer systems and digital data this area has grown in importance. Prereq: Working knowledge of windows computers, including installing and removing software. Access to a PC meeting the minimum system requirements defined in the course syllabus.  [ 4 cr. ]

MET CS 694 Mobile Forensics and Security

Overview of mobile forensics investigation techniques and tools. Topics include mobile forensics procedures and principles, related legal issues, mobile platform internals, bypassing passcode, rooting or jailbreaking process, logical and physical acquisition, data recovery and analysis, and reporting. Provides in-depth coverage of both iOS and Android platforms. Laboratory and hands-on exercises using current tools are provided and required.  [ 4 cr. ]

And one of the following:

MET CS 690 Network Security

This course will cover advanced network security issues and solutions. The main focus on the first part of the course will be on Security basics, i.e. security services, access controls, vulnerabilities, threats and risk, network architectures and attacks. In the second part of the course, particular focus and emphasis will be given to network security capabilities and mechanisms (Access Control on wire-line and wireless networks), IPsec, Firewalls, Deep Packet Inspection and Transport security. The final portion of the course will address Network Application security (Email, Ad-hoc, XML/SAML and Services Oriented Architecture security. As part of our course review we will explore a number of Network Use Cases. Prereq: MET CS 535 or MET CS 625; Familiarity with OSI and TCP/IP protocol stack; Background-familiarity with binary numbers, prime numbers, binary- hexadecimal-decimal conversions, etc; Familiarity with computer programming concepts; or instructor's consent.  [ 4 cr. ]

MET CS 695 Cybersecurity

This course introduces fundamental concepts, principles of cybersecurity and their use in the development of security mechanisms and policies. Topics include basic risk assessment and management; basic legal and ethics issues, various cyber attacks, defense methods and tools; security principles, models and components; different crypto protocols, techniques and tools, including symmetric and asymmetric encryption algorithms, hashing, public key infrastructure, and how they can be used; security threats and defense to hardware, operating systems, networks and applications in modern computing environments. Hands-on labs using current tools are provided and required. Prerequisite: METCS535 or METCS625 or instructor's consent.  [ 4 cr. ]

Computer Science Faculty

Guanglan Zhang

Associate Professor Chair, Computer Science

Scott Arena

Senior Lecturer, Computer Science

Eric Braude

Associate Professor Director of Digital Learning, Computer Science

View All Faculty

Lou Chitkushev

Senior Associate Dean for Academic Affairs Associate Professor, Computer Science Director, Health Informatics & Health Sciences

Master Lecturer, Computer Science

Suresh Kalathur

Assistant Professor, Computer Science Director, Analytics

Vijay Kanabar

Associate Professor, Computer Science and Administrative Sciences Director, Project Management

Jae Young Lee

Assistant Professor, Computer Science Coordinator, Databases

Eugene Pinsky

Associate Professor of the Practice, Computer Science Coordinator, Software Development

Reza Rawassizadeh

Assistant Professor, Computer Science

Robert Schudy

Associate Professor Emeritus, Computer Science

Victor Shtern

Anatoly Temkin

Assistant Professor Emeritus, Computer Science

Shengzhi Zhang

Yuting Zhang

Assistant Professor, Computer Science Director, Cybersecurity

Tanya Zlateva

Dean, Metropolitan College & Extended Education Professor of the Practice, Computer Science and Education Education Director, Information Security, Center for Reliable Information Systems & Cyber Security

Learn more about the Department of Computer Science

Tuition & Financial Assistance

Competitive tuition, comprehensive financial assistance, how much does this program cost.

BU MET programs offer the flexibility of part-time study, either on campus or online. Tuition, fees, and total program cost are determined by enrollment status. Course enrollment in this certificate program is 1–2 courses (4–8 credits) in a semester, and tuition is charged the part-time per-credit rate .

Digital Forensics Graduate Certificate (Online and On Campus)

* Based on 2023–2024 Boston University tuition & fee rates. ** Cost per credit is determined by course number (100–599 = $535/credit, 600–999 = $955/credit).

Questions? Please contact us to hear from an Admissions Advisor who can help you determine the best enrollment pathway. For information regarding financial aid, visit BU MET’s Financial Aid page .

Get Started

Please visit the BU MET admissions page for details on how to apply, financial assistance, tuition and fees, requirements for international students, and more.

What to Read Next: MET Computer Science & IT Knowledge Center

• How Long Does a Master’s in Computer Science Take to Complete—and What is the Cost?
• Why Get a Master’s Degree in Computer Science at BU MET?
• What Do My Career Options Look Like with a Master’s in Computer Science from BU’s Metropolitan College?
• Are There Different Computer Science Graduate Programs or Specializations at BU?

News & Events

MET Cybersecurity Director Choi Lends Investigatory Expertise to True Crime Podcast

April 5th, 2024 in: Cybersecurity , Faculty News , Kyung-shick Choi , MET News

MET Online Master’s Programs Climb U.S. News & World Report Poll for 2024, with 3 Top-10 Placements

February 7th, 2024 in: Academics , BU Today Features , Business & Management , Computer Science and Information Technology , Criminal Justice , MET News

Computer Science Professor Earns $98K Grant to Improve Speech Recognition Technology

January 30th, 2024 in: Awards , Computer Science , Faculty News , MET News , Shengzhi Zhang

May 1st, 2024 at: 2:00pm - 2:45pm

Financing your BU MET Graduate Education (for DOMESTIC students)

May 1st, 2024 at: 5:00pm - 6:00pm

Third Annual Daniel Ranalli Lecture

May 8th, 2024 at: 1:00pm - 1:45pm

Online Graduate Study at Boston University

Back to Programs

• Cybersecurity
• Cryptography
• Digital Forensics
• Jobs/Skills
• Manufacturing
• Robotics/Automation
• Tech Future
• Tech History
• Art & Humanities
• Ethical/Moral
• Geopolitical
• Alternative Energy
• Climate Change
• Hydrocarbons
• Precision Agriculture
• Tech Advances

How Cyber Insurance Prevents Post-Cyberattack Disaster: A Business Guide to Essentials & Compliance

Cryptocurrency scams: what to watch for, a duty to use autonomous vehicles, limits to automated & ai-controlled military systems: urgent imperative to assure human control, history’s digital black hole: challenges to preserving records in the iphone era, cbdc vs bitcoin, ai’s energy appetite: voracious & efficient, what attorneys should know about deepfakes, ai will improve, not destroy, our jobs: workforce challenges in the ai economy, rebalancing our brain: the crisis of meaning in the age of ai, imagination, ai security: the national security commission on artificial intelligence and adversarial machine learning, innovative approaches to destroying herbicide-resistant weeds, net zero: path to zero growth, promise & peril of intelligent machines & cyberspace: how rural universities are teaming together, solving crime through digital evidence, combining precision ag technologies to improve crop management: improving site specific weed control in corn, looking beyond ai hype, invasion from planet zircon: ai-powered threat to humanity, whangdepootenawah technological disruption & demographic collapse ~part one~, [opinion] atoms of the world unite—or split.

O N JANUARY 15, 1974, four members of the Otero family were murdered in their home in Wichita, Kansas. Joseph and Julie Otero and their two youngest children, Joseph Jr. (Joey) and Josephine (Josie), ages 9 and 11, were found dead by their oldest son Charlie and siblings Carmen and Danny, when they returned home from school. All four victims had been bound and strangled, and the phone line to their house had been cut.

A few months later, on April 4, Kathryn Bright was stabbed to death in her Wichita home, while her brother was shot twice in the head but fortunately survived. The phone line to the Bright’s home had also been cut.

In October 1974, after a confession to the Otero murders was publicized—and later proven false— Wichita police received a phone call directing them to a mechanical engineering textbook on the second floor of the Wichita Public Library across the street from police headquarters. Inside the book was a letter written by someone claiming to be the real killer. The letter contained previously unpublicized details of the Otero deaths, along with the killer identifying himself with the code initials B.T.K., which the self-alleging killer wrote stood for “Bind them, Torture them, Kill them.”

In 1977, there were two more strangulation victims, Shirley Vian and Nancy Fox. Early the following year, another taunt, this time in the form of a poem, was sent to The Wichita Eagle, the city’s largest daily newspaper and, a few weeks later, another message arrived at KAKE-TV in Wichita. These prompted the Wichita police to reveal for the first time the presence of “The BTK Strangler,” alerting residents that a serial killer was operating in the area.

No more murders were attributed to BTK for more than seven years until the strangulation of Marnie Hedge on April 27, 1985, and then Vicki Wegerle on September 16, 1986. BTK’s final known victim was Dolores Davis, who was strangled and dumped near a bridge on January 19, 1991.

With the help of the FBI, Wichita police hunted for BTK, while being taunted with a series of clues left by the killer. Messages in public locations and sent to news media, along with packages with disturbing drawings depicting the murders and dolls posed in the positions of the victims.

After the 1991 murder, BTK seemed to disappear, until a story in The Wichita Eagle in 2004 implied that BTK was a distant memory. Then letters and packages from BTK began arriving again at local newspapers and television stations and even left in a garbage bag in Murdoch Park in Wichita. The letters and packages contained mementos from the victims, as well as drawings and puzzles with clues to the killer’s identity.

In late January 2005, an employee at a local store found a cereal box in the back of his truck with a note asking whether BTK could communicate with police via a computer floppy disk without being traced. The police were instructed to run a newspaper ad with the message: “Rex, it will be OK,” if this was true. i

After the police ran the ad, a package arrived at KSAS-TV in Wichita with a clue that ultimately would lead to catching the BTK killer. i That clue was uncovered with digital forensics, which did not exist during much of BTK’s killing spree.

Evolution of Digital Forensics

Digital evidence is associated with approximately 90 percent of crimes committed today. Although the first known computer crimes were in the 1970s, the origins of the relatively new field of digital forensics can be traced to the mid-1980s and early 1990s. BTK killed his last victim in 1991 at the dawn of the digital forensics era. In the early days, with the growing popularity of personal computers, it was known as “computer forensics” and recognized early on by law enforcement as a source of evidence in crimes. Prior to the digital age, data was stored differently. Boxes and filing cabinets of paper and letters became bytes and files on floppy disks, hard drives and servers. The country’s first official digital forensics program was the FBI’s Magnet Media Program launched in 1984. ii  This evolved into FBI’s Computer Analysis Response Team (CART).

Evidence found on personal computers evolved into evidence being located on multiple computers of small local networks. The growing popularity of the internet led to looking for evidence in data sent and retrieved over the internet. That, along with the later invention of cellphones and Internet of Things (IoT) devices, caused investigators to look beyond computers to other devices, including video gaming consoles, smart TVs, smart watches and vehicles.

Computer forensics became digital forensics to encompass all the different ways data could be stored or transmitted. Early tools consisted of data recovery software and command line tools (commands that a user types in directly for execution), with the first commercial software being developed in the 1990s and marketed to law enforcement. Forensics teams usually consisted of members of law enforcement officers who were computer hobbyists or had some type of computer background. Those officers tasked with investigating crimes had limited training and no official framework to follow to ensure repeatability in their investigations.

What Is Digital Forensics?

Digital forensics is the identification, preservation, analysis, reporting and presentation of data stored digitally. To reach the last step of presentation, in a criminal case in a court of law, the previous steps should be followed and done in a manner that can be repeated. By starting with proper identification, preserving the data contained on the collected device, analyzing that extracted data, and documenting every person, tool and action that has been carried out, the chain of custody is established. Following these steps provides assurances that the results of an investigation are acceptable for presentation in court.

Identification

Digital evidence has evolved from floppy disks and hard drives to include a myriad of devices, such as cellphones, drones, GPS, vehicles, internet data, cloud data and other devices that store or transmit data. Identifying devices at a crime scene can be critical to an investigation when a memory card can be as small as a fingernail, or a USB drive can be disguised as a tube of lipstick. Hard drives have been found glued to the underside of tables or hidden in ceiling tiles. By the early 2000s, the everyday use of floppy disks was on the decline when, in February 2005, a package arrived at KSAS-TV in Wichita from BTK containing a floppy disk. That disk would hold the missing clue to BTK’s identity.

Preservation

Digital evidence can be very volatile in nature, and steps must be taken to ensure that it isn’t tampered with. Collecting digital evidence properly can be the difference between having valuable evidentiary data or having no data. Cellphones can be accessed remotely by a suspect to wipe data if they are not collected and stored properly. An unknown password on a phone or encrypted computer can be the difference between accessing the data or having it locked permanently away out of reach of investigators. Every effort is made to create a digital copy of the data prior to analysis. Working from a copy of the data maintains the integrity of the data on the original device, avoiding any question of tampering or altering the evidence. On the occasion that a digital copy cannot be obtained, and the data must be viewed on the device itself, every step must be documented to ensure that the proper steps are followed.

The integrity of data recovered from devices is ensured using hashing. A hash function is a one-way cryptographic algorithm that, when applied to data, produces a unique output. Changing even one byte in the input data results in a different hash value. If thinking of this in terms of a picture, changing one pixel will result in a different hash value than the original. Another example is even adding an extra space in a document, which can’t be easily seen, alters the hash value, as shown in the illustration below, using the SHA256 algorithm.

During analysis, the analyst is looking for data that can serve as evidence that supports or refutes the case being investigated. Modern digital forensics tools, which comb through the vast amounts of data that can come during an investigation, make analysis easier than in the past. Each device that is examined and the level of access that can be obtained to the device’s data can vary based on the version of the operating system installed, the hardware contained within the device and other factors. The data on a device can include information such as emails, images, internet search history, documents, videos, chat information, and the device might also include deleted or hidden data. On a floppy disk, hard drive, USB stick or other similar storage device, deleted files remain available until overwritten by other data.

When analyzing that data, the investigator is trying to determine who created the data, what type of device created the data, when the data was created or modified, where the data was created and answers to other pertinent questions. In the BTK case, the floppy disk the killer sent had been used to send a document to the television station; however, it had previously contained other documents that the killer had deleted. The documents were still available, not having yet been overwritten by other data, and they were able to be recovered by investigators and analyzed.

Reporting is an important step in the digital forensics process. Analysts know what they see, but being able to interpret and describe that data in a report, which can be understood by non-experts, is a skill that is developed over time. Reporting must detail the steps the analyst took during the investigation, as well as tell the story of the significance of what was found, or not found, during the analysis of the data. Since reporting aids in the next step of presentation, which may be to a jury trial, reports need to be written for any audience regardless of their technical background.

Reporting should tell the story that the device has taken since arrival, detailing the acquisition of the evidence, everything done with the device while it was being examined, what evidentiary findings were located in the data recovered from the device and finally the return of the evidence in order to document the proper chain of custody. Detailed reports that include the proper handling of the evidence being reported on can avoid later accusations of improper handling or tampering of evidence.

Presentation

Presenting digital evidence to a jury during a trial can be challenging when compared to presenting physical evidence such as paper documents or photographs. Explaining how data is stored on a device requires someone who can speak to the jury in a way they can understand. It isn’t always as simple as handing jury members a document they can read or a photograph that they can see. Lawyers need to understand digital evidence and what is important to their case. The expert witnesses called to testify must be able to talk to the jury about their findings in a way that reflects the importance of the evidence without getting overly technical.

There are many challenges in digital forensics, from the continuous development of software and hardware to new encryption techniques. It is a cat-and-mouse game between law enforcement agencies and technology companies to stay one step ahead. Privacy advocates are on the side of end-to-end encryption to keep data private, however that privacy can also hide criminal behavior.

The sheer volume of devices and data is a challenge for investigators both in storage and analysis. According to Deloitte (a leading global provider of audit, consulting, advisory and tax services), the average household has 22 connected devices including laptops, phones, smart watches, smart home devices, which can store data—sometimes, a lot of data. iii

Modern smart phones can have up to 1 terabyte (TB) of storage. To put that in perspective, it would take 728,177 floppy disks to store 1TB of information. iv  Finding a document like the one left by BTK becomes much more difficult when looking through 728,177 items than just 1 item. The number of devices and the vast amounts of data to be analyzed lead to backlogs in casework, as well as stress and burnout for investigators and analysts.

Encryption poses a challenge with modern devices containing whole device encryption. v  Encryption uses a mathematical algorithm to scramble readable text so that only someone with the correct decryption code can understand it. Previously, a hard drive could be removed from a computer or chip removed from a phone, albeit not always easily, and the data read and analyzed. Modern devices that employ encryption techniques on the hardware level rather than file-based encryption present additional challenges. The hard drives or chips can still be removed and read, however the data that is recovered is encrypted, so while the data is still able to be retrieved, it cannot be interpreted due to the encryption. The only way to access the data held within that encrypted device is with the user’s passcode. If the passcode is unable to be recovered, from the user or through technological means, that data remains inaccessible.

Emerging Devices & Platforms

Along with encryption, new technology in both new devices and upgrades to existing technology, such as a newer operating system on a computer or cellphone, presents challenges. Devices such as drones, vehicles, Apple AirTags or home security cameras are introduced constantly. Technology companies are continuously upgrading their operating systems and the techniques to keep their devices secure from cyberattacks and other vulnerabilities. Combine that with the multitude of applications available on multiple platforms, and it takes a tremendous effort by the companies creating digital forensics tools to both access the devices and process data from installed applications. The introduction of a new chat application on a smartphone requires software engineers who can then decode that data to understand how it is stored and make it easily readable for forensic analysts or analysts digging deep into the database to find the data and manually linking tables stored within the database to find the stored communications—a time-consuming process.

Burnout & Staff Turnover

Digital forensics analysts are at high risk for burnout. The workload demands, due to the vast amounts of incoming devices and data, along with the material such as documents, images or videos that analysts are often exposed to that can contain violence or child exploitation content, can lead to workplace stress, reduced efficacy, absenteeism, early retirement and burnout.

Nature of Digital Evidence

Digital evidence requires different tools and techniques than physical evidence for identification, collection and analysis. Instead of blood or fingerprint evidence, digital evidence consists of information and data. Both physical and digital evidence can be volatile in that they might not be present for a long time. Blood can wash away, fingerprints can smudge, and digital evidence can disappear. For example, computer memory can vanish if the computer is powered down. However, digital evidence is wider in scope, can be mobile and is much more personal in nature. The National Institute of Justice defines digital evidence as: “Information and data of value to an investigation that is stored on, retrieved or transmitted by an electronic device.” vi

Computers and cellphones can hold the most personal material from banking information to conversations to pictures and videos. Pouring through that information is often akin to reading someone’s diary or inner-most thoughts. Chat conversations with friends and loved ones, internet searches conducted, locations visited, pictures and videos captured and shared. The metadata found within a document or image can be enough to place someone at a location or identify him or her as a person of interest and make the difference in an investigation, as in the BTK case.

Metadata is defined as “data about data.” Metadata describes data and can provide information about the item of interest (for example, a document, image or video), such as who created it, what type of device created it, when it was created, where it was created. In the BTK case, deleted documents found on the floppy disk sent to the television station contained metadata, which indicated that the disk had been used at Christ Lutheran Church in Wichita by a user named “Dennis.” That was the clue police needed that soon led them to the church’s council president. After 30 years of searching for the BTK killer, on February 25, 2005, within 10 days of that floppy disk arriving at the television station, BTK was identified, arrested and confessed to the killing of 10 people.

The volume of both devices and data will drive the digital forensics field toward automation. Artificial intelligence (AI) and machine learning (ML) will assist with analyzing and categorizing data faster. Unlike live analysts, AI applications don’t show fatigue and are not affected by graphic material. Using automation to complete some of the time-consuming activities can free up analysts to fine tune and do the detail work. AI and deep-learning algorithms can be used to review things, such as documents, looking for relevant information.

Digital forensics tools have begun to move toward collaborative cloud-based environments allowing more than one analyst to work on the same investigation simultaneously. This can aid in environments where investigators are working on the same case from different locations. These types of tools can also provide analytics to look for trends across different cases. Link analysis can show relationships between data recovered from multiple devices.

Digital forensics is a broad field with many specialties. So far this article has addressed digital forensics from the perspective of a law enforcement investigation, however there are many additional aspects of digital forensics. Increasingly, data is being stored in the cloud rather than on servers and workstations. Data travels across networks to get to that cloud storage with the potential for data breaches. Investigating how or where data breaches occur is a branch of digital forensics as well as cloud forensics. In addition to law enforcement, corporations need digital forensic analysts to investigate data breaches, intrusions, insider threats, theft of corporate property and violations of acceptable use policy. The increasingly connected world brings more and more opportunities for digital forensics to play an important role in helping to solve crimes.

i R.J. Rosen, “The Floppy Did Me In,” The Atlantic, 16 January 2014. [Online]. Available: https://www.theatlantic.com/technology/ar chiv e/2014/01/the-floppy-did- me-in/283132/. [Accessed 27 November 2022].

ii S. Moore, “What is Digital Forensics?,” [Online]. Available: https://www . azolifesciences.com/article/What-is-Digital-Forensics.aspx.

iii J. Arbanas, J. Loucks and S. Hupfer, “Connectivity and Mobile Trends Survey: Mastering the New Digital Life,” The Wall Street Journal, 20 September 2022. [Online]. Available: https://deloitte.wsj.com/articles/connectivity-and-mobile-trends- survey-mastering-the-new-digital-life-01663699532. [Accessed 27 November 2022].

iv T. Fisher, “Terabytes, Gigabytes, & Petabytes: How Big Are They?,” 1 January 2021. [Online]. Available: https://www .lifewir e.com/terabytes-gigabytes-amp- petabytes-how-big-are-they-4125169. [Accessed 27 November 2022].

v For a primer in encryption, please refer to: Marcus Fries, PhD, “The Unencrypted History of Cryptography,” Dakota Digital Review, North Dakota University System, Fall-Winter 2023, https://dda.ndus.edu/ddreview/the- unencrypted-history-of-cryptography/

vi M. B. Mukasey, J. L. Sedgwick and D. W. Hagy, “Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition,” U.S. Department of Justice, Washington, DC, 2008.

ARICA KULM, PHD Director of Digital Forensics Services Dakota State University

Arica Kulm, PhD, is the Director of Digital Forensic Services at the DigForCE Lab at Dakota State University. Her team works with clients to execute a variety of digital forensic supports for investigations with law enforcement agencies and cybercrime investigations for South Dakota Consumer Protection and other organizations. She also leads teams that provide free cybersecurity assessments for South Dakota cities and counties through the Project Boundary Fence. Kulm earned a bachelor’s degree from South Dakota State University, and her master’s and doctorate degrees in Cyber Defense from Dakota State University. She also holds several industry certifications. Her doctoral dissertation resulted in a patent on a digital forensic tool. Kulm’s research interests include the dark web and dark web host-based forensics. She is a much sought-after presenter at various conferences and trainings, and as a spokesperson for media engagements.

• Fargo Air National Guard
• Federal Aviation Administration
• General Atomics
• General Jay Raymond; Director of the Space Development Agency Derek Tournear
• Grand Forks Air Force Base
• Grand Sky Development Company
• Mercatus Center at George Mason University
• MQ-1 Predator
• MQ-9 Reaper
• NASA Administrator Jim Bridenstine; Chief of Space Operations
• national defense
• Northern Plains UAS Test Site
• Northrop Grumman
• PhD; Secretary of the Air Force Frank Kendall; Air Force Chief of Staff General Charles Brown Jr.; and Chief of Naval Research Rear Admiral Lorin Selby
• Research Institute for Autonomous Systems (RIAS)
• RQ-4 Global Hawk
• Soviet Union
• the County of Grand Forks
• the North Dakota Department of Commerce
• U.S. Air Force
• U.S. Senator John Hoeven
• U.S. Space Force
• UAS Summit & Expo
• University of North Dakota
• Unmanned Aerial Systems
• Visual Line of Sight (BVLOS)

Most Popular

Recent comments.

• Digitization
• Implications

© Copyright - 2021 Dakota Digital Review. Published by the North Dakota University System. The NDUS Foundation is a 501(c)(3) organization. For questions or to support the DDR, please email [email protected]

• Our Promise
• Our Achievements
• Our Mission
• Proposal Writing
• System Development
• Paper Writing
• Paper Publish
• Synopsis Writing
• Thesis Writing
• Assignments
• Survey Paper
• Conference Paper
• Journal Paper
• Empirical Paper
• Journal Support

PhD Projects in Digital Forensics

“ Digital Forensics is a way of exploring digital data to find any proof .”   PhD Projects in Digital Forensics  is an eminent service that will guide the PhD scholars. Explicitly, we will help our clients to reach their PhD dream. It will not only find the info but also checks it on a recursive basis.

We will focus only on making your research a better one…

Our adroit team will study the new facts in digital forensics. After that, we will create our own algorithm and methods. On balance, we will make sure the feat of your project. In fact, let us look at a few of the tools used here.

SIMULATION TOOLS IN DIGITAL FORENSICS

• OCFA ( Open Computer Forensics Architecture )
• CAINE ( Computer Aided Investigative Environment )
• Restry Recon
• The Sleuth Kit (TSK)

PhD Projects in Digital Forensics will give noble aid in every edge of digital forensics. It has roped  150+  world-class doyens into serving in your project wants. Now that you need to know the options flick through the following areas.

• Triage Digital Forensics
• Steganography and Covert Communication
• Cyber Criminal Profile
• Applied Cryptography
• Digital Evidence Extraction and Analysis
• Digital Forensic Information Visualization
• Surveillance

PhD Projects in Digital Forensics  has unique projects for all the budding PhD/MS students. Regardless of the stream, we will offer research help to all our clients. To be sure, we will revise our work with our experts before the final supply.

Owing to the above, we will never fail in our work. Hence, you can work with us on any kind of  digital forensics projects . In addition, our team will also perform other research services as per your need. Thus, you can find all your project requirements in one place.

Our sole motto is to fill your mind with thoughts of research…

An innovative mechanism for Digital forensics of 3D printers system

An effective function of  Fog-Based on Digital Forensics Investigation Structure designed for IoT Systems

An inventive methodology for Evidence Data Collection by ANDROSICS Tool used for Android Forensics scheme

The new system for Forensic Analysis of Digital Images over Smart Devices and Online Social Networks

A novel technique for IoT Forensic  based on digital investigation framework intended for IoT systems

A fresh function for Comparison of computer forensics investigation models aimed at cloud environment

The firsthand function for Identity theft based on e-government/e-governance & digital forensics system

A new-fangled method for FCT function based on Digital Forensics E-Learning System with Dynamic Examination Support

An effective methodology for New Approach in Digital Forensics Investigation Process

A novel approach for Analysis of VMware in forensics and anti-forensics paradigm practice

An inventive method for Next-Generation Digital Forensics system

An innovative method intended for Data acquisition techniques in mobile forensics system

Design a methodology function for Application based on digital forensics in traffic conditions system

The new process of Improved Feature Vector for Median Filtering Residual meant for Image Forensics

The novel process for Analysis of Rolling Shutter Effect based on ENF Video Forensics scheme

An effective method for Fast Tamper Detection designed for Hierarchical Data in Live Cloud Forensics

A novel method of Integrated Digital Forensic Investigation Structure designed  for IoT-Based on Ecosystem

An efficient design method used for Digital Forensic in Analysis via Android Application Cache Data system

The fresh function for Evaluating Automated based on Facial Age Estimation Techniques used for Digital Forensics system

An inventive method for Layer thickness estimation of 3D printed model used for digital multimedia forensics system

MILESTONE 1: Research Proposal

Finalize journal (indexing).

Before sit down to research proposal writing, we need to decide exact journals. For e.g. SCI, SCI-E, ISI, SCOPUS.

Research Subject Selection

As a doctoral student, subject selection is a big problem. Phdservices.org has the team of world class experts who experience in assisting all subjects. When you decide to work in networking, we assign our experts in your specific area for assistance.

Research Topic Selection

We helping you with right and perfect topic selection, which sound interesting to the other fellows of your committee. For e.g. if your interest in networking, the research topic is VANET / MANET / any other

Literature Survey Writing

To ensure the novelty of research, we find research gaps in 50+ latest benchmark papers (IEEE, Springer, Elsevier, MDPI, Hindawi, etc.)

Case Study Writing

After literature survey, we get the main issue/problem that your research topic will aim to resolve and elegant writing support to identify relevance of the issue.

Problem Statement

Based on the research gaps finding and importance of your research, we conclude the appropriate and specific problem statement.

Writing Research Proposal

Writing a good research proposal has need of lot of time. We only span a few to cover all major aspects (reference papers collection, deficiency finding, drawing system architecture, highlights novelty)

MILESTONE 2: System Development

Fix implementation plan.

We prepare a clear project implementation plan that narrates your proposal in step-by step and it contains Software and OS specification. We recommend you very suitable tools/software that fit for your concept.

Tools/Plan Approval

We get the approval for implementation tool, software, programing language and finally implementation plan to start development process.

Pseudocode Description

Our source code is original since we write the code after pseudocodes, algorithm writing and mathematical equation derivations.

Develop Proposal Idea

We implement our novel idea in step-by-step process that given in implementation plan. We can help scholars in implementation.

Comparison/Experiments

We perform the comparison between proposed and existing schemes in both quantitative and qualitative manner since it is most crucial part of any journal paper.

Graphs, Results, Analysis Table

We evaluate and analyze the project results by plotting graphs, numerical results computation, and broader discussion of quantitative results in table.

Project Deliverables

For every project order, we deliver the following: reference papers, source codes screenshots, project video, installation and running procedures.

MILESTONE 3: Paper Writing

Choosing right format.

We intend to write a paper in customized layout. If you are interesting in any specific journal, we ready to support you. Otherwise we prepare in IEEE transaction level.

Collecting Reliable Resources

Before paper writing, we collect reliable resources such as 50+ journal papers, magazines, news, encyclopedia (books), benchmark datasets, and online resources.

Writing Rough Draft

We create an outline of a paper at first and then writing under each heading and sub-headings. It consists of novel idea and resources

Proofreading & Formatting

We must proofread and formatting a paper to fix typesetting errors, and avoiding misspelled words, misplaced punctuation marks, and so on

Native English Writing

We check the communication of a paper by rewriting with native English writers who accomplish their English literature in University of Oxford.

Scrutinizing Paper Quality

We examine the paper quality by top-experts who can easily fix the issues in journal paper writing and also confirm the level of journal paper (SCI, Scopus or Normal).

Plagiarism Checking

We at phdservices.org is 100% guarantee for original journal paper writing. We never use previously published works.

MILESTONE 4: Paper Publication

Finding apt journal.

We play crucial role in this step since this is very important for scholar’s future. Our experts will help you in choosing high Impact Factor (SJR) journals for publishing.

Lay Paper to Submit

We organize your paper for journal submission, which covers the preparation of Authors Biography, Cover Letter, Highlights of Novelty, and Suggested Reviewers.

Paper Submission

We upload paper with submit all prerequisites that are required in journal. We completely remove frustration in paper publishing.

Paper Status Tracking

We track your paper status and answering the questions raise before review process and also we giving you frequent updates for your paper received from journal.

Revising Paper Precisely

When we receive decision for revising paper, we get ready to prepare the point-point response to address all reviewers query and resubmit it to catch final acceptance.

Get Accept & e-Proofing

We receive final mail for acceptance confirmation letter and editors send e-proofing and licensing to ensure the originality.

Publishing Paper

Paper published in online and we inform you with paper title, authors information, journal name volume, issue number, page number, and DOI link

MILESTONE 5: Thesis Writing

Identifying university format.

We pay special attention for your thesis writing and our 100+ thesis writers are proficient and clear in writing thesis for all university formats.

Gathering Adequate Resources

We collect primary and adequate resources for writing well-structured thesis using published research articles, 150+ reputed reference papers, writing plan, and so on.

Writing Thesis (Preliminary)

We write thesis in chapter-by-chapter without any empirical mistakes and we completely provide plagiarism-free thesis.

Skimming & Reading

Skimming involve reading the thesis and looking abstract, conclusions, sections, & sub-sections, paragraphs, sentences & words and writing thesis chorological order of papers.

Fixing Crosscutting Issues

This step is tricky when write thesis by amateurs. Proofreading and formatting is made by our world class thesis writers who avoid verbose, and brainstorming for significant writing.

Organize Thesis Chapters

We organize thesis chapters by completing the following: elaborate chapter, structuring chapters, flow of writing, citations correction, etc.

Writing Thesis (Final Version)

We attention to details of importance of thesis contribution, well-illustrated literature review, sharp and broad results and discussion and relevant applications study.

How PhDservices.org deal with significant issues ?

1. novel ideas.

Novelty is essential for a PhD degree. Our experts are bringing quality of being novel ideas in the particular research area. It can be only determined by after thorough literature search (state-of-the-art works published in IEEE, Springer, Elsevier, ACM, ScienceDirect, Inderscience, and so on). SCI and SCOPUS journals reviewers and editors will always demand “Novelty” for each publishing work. Our experts have in-depth knowledge in all major and sub-research fields to introduce New Methods and Ideas. MAKING NOVEL IDEAS IS THE ONLY WAY OF WINNING PHD.

2. Plagiarism-Free

To improve the quality and originality of works, we are strictly avoiding plagiarism since plagiarism is not allowed and acceptable for any type journals (SCI, SCI-E, or Scopus) in editorial and reviewer point of view. We have software named as “Anti-Plagiarism Software” that examines the similarity score for documents with good accuracy. We consist of various plagiarism tools like Viper, Turnitin, Students and scholars can get your work in Zero Tolerance to Plagiarism. DONT WORRY ABOUT PHD, WE WILL TAKE CARE OF EVERYTHING.

3. Confidential Info

We intended to keep your personal and technical information in secret and it is a basic worry for all scholars.

• Technical Info: We never share your technical details to any other scholar since we know the importance of time and resources that are giving us by scholars.
• Personal Info: We restricted to access scholars personal details by our experts. Our organization leading team will have your basic and necessary info for scholars.

CONFIDENTIALITY AND PRIVACY OF INFORMATION HELD IS OF VITAL IMPORTANCE AT PHDSERVICES.ORG. WE HONEST FOR ALL CUSTOMERS.

4. Publication

Most of the PhD consultancy services will end their services in Paper Writing, but our PhDservices.org is different from others by giving guarantee for both paper writing and publication in reputed journals. With our 18+ year of experience in delivering PhD services, we meet all requirements of journals (reviewers, editors, and editor-in-chief) for rapid publications. From the beginning of paper writing, we lay our smart works. PUBLICATION IS A ROOT FOR PHD DEGREE. WE LIKE A FRUIT FOR GIVING SWEET FEELING FOR ALL SCHOLARS.

5. No Duplication

After completion of your work, it does not available in our library i.e. we erased after completion of your PhD work so we avoid of giving duplicate contents for scholars. This step makes our experts to bringing new ideas, applications, methodologies and algorithms. Our work is more standard, quality and universal. Everything we make it as a new for all scholars. INNOVATION IS THE ABILITY TO SEE THE ORIGINALITY. EXPLORATION IS OUR ENGINE THAT DRIVES INNOVATION SO LET’S ALL GO EXPLORING.

Client Reviews

I ordered a research proposal in the research area of Wireless Communications and it was as very good as I can catch it.

I had wishes to complete implementation using latest software/tools and I had no idea of where to order it. My friend suggested this place and it delivers what I expect.

It really good platform to get all PhD services and I have used it many times because of reasonable price, best customer services, and high quality.

My colleague recommended this service to me and I’m delighted their services. They guide me a lot and given worthy contents for my research paper.

I’m never disappointed at any kind of service. Till I’m work with professional writers and getting lot of opportunities.

- Christopher

Once I am entered this organization I was just felt relax because lots of my colleagues and family relations were suggested to use this service and I received best thesis writing.

I recommend phdservices.org. They have professional writers for all type of writing (proposal, paper, thesis, assignment) support at affordable price.

You guys did a great job saved more money and time. I will keep working with you and I recommend to others also.

These experts are fast, knowledgeable, and dedicated to work under a short deadline. I had get good conference paper in short span.

Guys! You are the great and real experts for paper writing since it exactly matches with my demand. I will approach again.

I am fully satisfied with thesis writing. Thank you for your faultless service and soon I come back again.

Trusted customer service that you offer for me. I don’t have any cons to say.

I was at the edge of my doctorate graduation since my thesis is totally unconnected chapters. You people did a magic and I get my complete thesis!!!

- Abdul Mohammed

Good family environment with collaboration, and lot of hardworking team who actually share their knowledge by offering PhD Services.

I enjoyed huge when working with PhD services. I was asked several questions about my system development and I had wondered of smooth, dedication and caring.

I had not provided any specific requirements for my proposal work, but you guys are very awesome because I’m received proper proposal. Thank you!

- Bhanuprasad

I was read my entire research proposal and I liked concept suits for my research issues. Thank you so much for your efforts.

- Ghulam Nabi

I am extremely happy with your project development support and source codes are easily understanding and executed.

Hi!!! You guys supported me a lot. Thank you and I am 100% satisfied with publication service.

- Abhimanyu

I had found this as a wonderful platform for scholars so I highly recommend this service to all. I ordered thesis proposal and they covered everything. Thank you so much!!!

Related Pages

Phd Projects In Information Forensics Security

Phd Projects Research Help

Phd Projects In Image Mining

Phd Projects In Information Security

Phd Projects In Cybersecurity

Guidelines For Phd Projects

Phd Projects In Information Technology

Phd Projects In Pattern Analysis And Machine Intelligence

Phd Consultancy Service In Usa

Phd Projects In Cryptography

Phd Research Topics In Image Processing

Write My Phd Project For Me

Phd Projects In Pattern Analysis Machine Intelligence

Phd Projects In Pattern Recognition

Phd Projects In System Cybernetics

6 Best Digital Forensics Tools Used by Experts in 2024

Jenna Phipps

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

Digital forensics tools are products that help both business security teams and legal organizations uncover messy cases, from minor network security infractions to data privacy gaffes and major court cases. They offer features like data extraction, reporting, and anomaly detection to identify information in hard-to-access places. We analyzed the best digital forensics products, along with key features to consider and a breakdown of our evaluation.

Here are our picks for the best six digital forensics tools:

• Exterro FTK : Best overall forensics tool for a mix of pricing and features
• IBM QRadar SIEM & Forensics : Best for enterprise forensics and SIEM
• LogRhythm NetMon & SIEM : Best forensics software for customer support
• Cyber Triage : Best solution for cybersecurity-specific incident response
• Encase Forensic : Best solution for managed digital forensics services 
• Magnet AXIOM Cyber : Best solution for diverse deployment scenarios

Top Digital Forensics Software Compared

The following table gives a brief overview of our six top products, including features like data extraction and free trial availability:

✔️=Yes  ❌=No/Unclear  ➕=Add-On

Table of Contents

Exterro FTK

Best Forensics Tool Overall for a Mix of Pricing & Features

Overall Rating: 3.9/5

• Core Features: 3.7/5
• Advanced Features: 4.3/5
• Deployment & Usability: 4.5/5
• Customer Support: 2.4/5
• Pricing: 5/5

Exterro Forensic Toolkit (FTK) offers advanced digital forensics capabilities for both computer systems and mobile devices, including media thumbnail reviews and facial recognition. Other notable features include remote data collection and file recovery for deleted data. We recommend it for organizations of all sizes for its strong feature set and its pricing information — Exterro is transparent about licensing compared to the rest of the market.

Exterro is a fantastic all-around forensics product, but it’s not very transparent about customer support options. If that’s important to your team, look at LogRhythm instead — it also has plenty of key and advanced forensics features and was our criterion winner for customer support.

Pros & Cons

• Physical FTK license: $5,999–$11,500, depending on sale prices
• Virtual FTK license: $5,999–$11,500, depending on sale prices
• Yearly renewal: Subscription charges and renews annually
• Free trial: 30 days

Key Features

• Portable cases: Send data about a case to external reviewers and receive feedback.
• Facial and object recognition: FTK identifies identical image content automatically.
• Mac data analytics: Process data like encrypted Apple file systems.
• Thumbnail review: Inspect and categorize multimedia images by hovering over them.

IBM QRadar SIEM & Forensics

Best for Enterprise Forensics & SIEM

Overall Rating: 3.5/5

• Core Features: 3.8/5
• Advanced Features: 3.5/5
• Deployment & Usability: 3.4/5
• Customer Support: 3.7/5
• Pricing: 3.2/5

IBM QRadar SIEM is a security information and event management platform that offers capabilities like network analytics, threat response, and compliance audits. QRadar Forensics, which focuses specifically on digital forensics, can be a standalone product, but it’s also available as a SIEM module. Integrating the two is ideal for large enterprises that want to use a security management product and a digital forensics tool in conjunction.

QRadar is a strong enterprise solution, but it doesn’t support many cloud applications . Consider LogRhythm if you’re looking for cloud app support — it’s also a SIEM solution.

• Usage model: Priced by events per second and flows per minute
• Enterprise model: Based on the number of managed virtual servers used
• Pricing calculator: IBM’s calculator helps estimate initial costs
• Contact for quote: Available add-ons, including Forensics
• Network analytics: View network threat detections and dashboard visualizations.
• Compliance add-ons: Use QRadar SIEM extensions to comply with regulations.
• IBM X-Force integration: View recent threat intelligence data like malicious URLs.
• File recovery: The Forensics product finds raw capture data on specified devices.

LogRhythm NetMon & SIEM

Best Forensics Solution for Customer Support

Overall Rating: 3.3/5

• Core Features: 3.3/5
• Advanced Features: 3.6/5
• Deployment & Usability: 2.8/5
• Customer Support: 4.4/5
• Pricing: 1.8/5

LogRhythm’s next-gen SIEM platform integrates with LogRhythm NetMon, a forensics solution for networks that provides packet analytics, dashboards, and application recognition. This integration is another example of combined SIEM and forensics for teams that want those products connected. LogRhythm got particularly high marks in our rubric for its customer support availability, including phone support and a 24/7 platinum plan.

While LogRhythm SIEM is a strong network forensics product, it won’t be sufficient for all forensics cases. Consider Exterro if you need mobile and multi-platform forensics; it also finds indicators of compromise and offers incident response capabilities like LogRhythm.

• Contact for quote: Custom pricing available
• Threat scores: A risk-based priority calculator helps teams determine risk significance.
• Application recognition: NetMon identifies more than 3,500 applications.
• Incident response: The SIEM solution helps teams find and remediate security threats.
• Deep packet analytics: Extract and view network packet data from OSI layers 2-7.

Read more about different types of network security , including threat intelligence and network access control.

Cyber Triage

Best Solution for Cybersecurity-Specific Incident Response

Overall Rating: 3.2/5

• Advanced Features: 4.8/5
• Deployment & Usability: 2.5/5
• Customer Support: 0.9/5
• Pricing: 4.3/5

Cyber Triage is a combined forensics and incident response platform that’s great for teams that want to both manage incidents and explore attacks in detail. Key capabilities include malware scanning, artifact scores, and incident response recommendations. Cyber Triage also integrates with endpoint detection and response (EDR) and SIEM products like SentinelOne Singularity and Splunk; consider Cyber Triage if you want those major security integrations.

While Cyber Triage is a strong incident response solution, it doesn’t support mobile devices. Consider Exterro, which offers incident response integrations and collects mobile device data, if you’re looking for both IR and mobile capabilities.

• Standard plan: $2,500 per year
• Standard Pro plan: $3,500 per year
• Team plan: Custom pricing available
• Free trial: 7 days
• Artifact scoring: Cyber Triage helps prioritize incident evidence by ranking it.
• Malware scanning: Over 40 scanning engines increase the chances of finding malware.
• Air-gapped labs: Export hash values into a text file format through offline mode.
• IOCs: Cyber Triage identifies indicators of compromise like signs of potential malware.

Encase Forensic

Best Solution for Managed Digital Forensics Services

Overall Rating: 3/5

• Core Features: 3.5/5
• Advanced Features: 2.2/5
• Deployment & Usability: 3.3/5
• Customer Support: 3.9/5
• Pricing: 2.3/5

Encase Forensic by OpenText is a well-rounded digital forensics tool with multi-platform support, including all three major operating systems and mobile devices. It collects data from social media sites as well as apps like LinkedIn and WhatsApp. Encase Forensic is available as an on-premises managed product . Consider Encase if your business is looking for a managed forensics solution or has a small or inexperienced team; it’s a good choice for small and midsize businesses (SMBs).

While Encase Forensic is a great multi-platform product, it doesn’t offer a free trial. Consider Magnet AXIOM Cyber instead if you need to try a forensics product before buying. Magnet also supports multiple platforms and offers an integration for mobile data, too.

• Contact for quote: Custom pricing available; some pricing info available from resellers
• Optical character recognition: OCR finds and extracts text data in images and PDFs.
• AI and ML: Identify incriminating content with machine learning and artificial intelligence.
• App activity collection: Supported apps include LinkedIn, Instagram, and Twitter.
• Browser and location data: Encase also collects internet and location history.

Magnet AXIOM Cyber

Best Solution for Diverse Deployment Scenarios

• Core Features: 2.8/5
• Advanced Features: 2.4/5
• Deployment & Usability: 4.4/5
• Customer Support: 3/5
• Pricing: 2.5/5

Magnet AXIOM Cyber’s digital forensics and incident response solution offers features like remote data collection and data visualization. It supports Windows, Mac, and Linux machines, and users can deploy it in both AWS and Azure. Through its integration with Verakey, AXIOM Cyber can receive extracted mobile data as well. For businesses with multiple operating systems and cloud environments, AXIOM Cyber is a great choice.

While AXIOM Cyber is a strong multi-platform forensics product, its data extraction capabilities are limited to other products. Consider Encase Forensic if you’re looking for native extraction; it also supports multiple platforms, including mobile devices.

• Contact for quote: Custom pricing is available
• Free trial: Contact for length
• Remote collections: You can collect data from off-network endpoint computers.
• Data visualization: AXIOM Cyber shows connections between various artifacts.
• Threat scoring: Integration with VirusTotal allows users to better prioritize threats.
• Incident response: AXIOM Cyber is a DFIR product and offers response and detection.

Top 5 Features of Digital Forensics Software

Digital forensics products vary somewhat in their feature sets, but there are a few core capabilities that your future product should have. Data extraction, reporting functionality, data recovery, prioritization, and integrations with security platforms are all critical to conducting a successful forensics case and tracking the most important information.

Data Extraction

Data extraction pulls information from places it would otherwise be hard to find. If a criminal deletes a file from their computer, it won’t be simple to collect by ordinary means. But a digital forensics product has special capabilities that help it reconstruct or recover data that’s been damaged or deleted, which is critical for cases in which a criminal tried to cover their tracks or information has simply been lost over time.

Reporting functionality is important for almost every security product, but for digital forensics, it’s especially critical. Every piece of information could affect not only a company’s security but also a person’s life or livelihood. Reports help users present data clearly to business leaders, but they might also need to be provided to police and government officials.

Data Recovery

Some data appears to be lost, but forensics tools should be able to recover data that wouldn’t be found otherwise. That data could play a critical role in a case, and a threat actor or criminal might have attempted to hide the information. Digital recovery features are valuable and often necessary for a full forensics toolkit.

Threat Prioritization

Prioritizing alerts, threats, or other indicators of compromise take different forms, like threat scores, but a digital forensics tool should have some method of ranking potential issues. With prioritization features, teams will be better positioned to handle the most important alerts or potential cases first.

Security Integrations

Digital forensics tools should ideally integrate with at least one other security product, whether that’s a SIEM, EDR, or other type of incident response product. This product might also be a security management tool that centralizes multiple products. The best integrations depend on your business’s use cases and needs, though, so consider those before making a final selection.

How We Evaluated Digital Forensics Software

We used a product scoring rubric to compare a range of digital forensics tools, developing five main criteria with key characteristics of forensics products. The percentages below show how we weighted the criteria. Each criterion included multiple subcriteria with their own weighting. The total scores reflect how well each product ranked in our overall evaluation based on the criteria it met. After we scored the products, the six that scored best made our list.

Evaluation Criteria

The most important criteria we scored were core forensics features like data extraction and advanced features, like threat scores and SIEM integrations. We also considered deployment and usability, including product documentation, mobile device support, and supported operating systems. Lastly, we looked at customer support availability, including channels like phone and email, and pricing, like free trials and licensing details.

• Criterion winner: IBM QRadar
• Criterion winner: Cyber Triage
• Criterion winner: Exterro
• Criterion winner: LogRhythm

Frequently Asked Questions (FAQs)

What types of cases require digital forensics tools.

Any legal investigation involving software, hardware, or networks can require a digital forensics tool to find data that otherwise wouldn’t be retrievable. Extraction capabilities help legal and security teams find information that may have been deleted from a computer system. Common examples of cases requiring forensics tools include embezzlement, extortion, identity theft, assault, or child exploitation, including pornography and any kind of trafficking.

Businesses may want forensics simply for their information security and cybersecurity, too, so they can track intruder and attacker behavior in a clinical way. It doesn’t have to be a legal case — an internal security incident might benefit from forensic data as well.

Are Digital Forensics Tools Difficult to Use?

Like any other software solution, digital forensics tools take time to learn. Some will be simpler to use than others, though. If your business is looking for a particularly easy-to-learn product, look for user reviews that mention usability and features like a central management interface. Any product will have a learning curve, but they differ in length.

What Are Common Digital Forensic Product Capabilities?

Broadly speaking, forensics software should be able to pull data from multiple, difficult-to-find locations and present it so teams can analyze it meaningfully. Many different features serve that purpose, like reporting, data extraction, and remote collection, but distilled into simple terms, your digital forensics product needs to access the right systems, find the necessary data, and help users make sense of it.

Bottom Line: Digital Forensics Software Is a Critical Investment

A digital forensics product can be a powerful tool to not only uncover cybersecurity data but also support your team in a legal investigation. It should suit your security, compliance, and legal teams’ skill sets, as well as give them research and response abilities that may not have been available to them before. If your organization frequently deals with criminal activity or investigations, a digital forensics tool is one of the most important investments you’ll make.

Is your organization looking for specifically Linux-based forensics capabilities? Read about our picks for the best Linux distros for pentesting and forensics next.

Get the Free Cybersecurity Newsletter

Strengthen your organization’s IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices.

Previous article

Next article

Subscribe to Cybersecurity Insider

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.

IT Security Resources

Shadowray vulnerability: 6 lessons for ai & cybersecurity.

Vulnerability Recap 4/15/24 – Palo Alto, Microsoft, Ivanti Exploits

Top 6 Network Access Control (NAC) Solutions in 2024

NordPass Review 2024: Is It the Right Fit for Your Business?

Top Cybersecurity Companies

Get the free newsletter.

Subscribe to Cybersecurity Insider for top news, trends & analysis

Related Articles

Keeper Password Manager Review 2024: Who Should Use It?