Digital Forensics and Evidence Handling (IMCS-013) Training Course

Digital Forensics and Evidence Handling

When cyber incidents, fraud or misconduct occur, organisations need to collect and analyse digital evidence in a way that is reliable and legally defensible. Mistakes in…

5 daysClassroom or online

14Upcoming dates

8Cities

£2,750Fees from

Course overview

Why Attend

When cyber incidents, fraud or misconduct occur, organisations need to collect and analyse digital evidence in a way that is reliable and legally defensible. Mistakes in handling evidence can destroy its value.

This LLMI course explains digital forensics principles, evidence identification and acquisition, chain of custody, forensic analysis of computers, mobile devices, email and cloud, log analysis, reporting findings and working with legal teams and law enforcement. Participants conduct a simulated investigation.

The course is an introduction for IT, security, audit and investigation professionals.

Course Objectives

Explain digital forensics principles and legal considerations

Identify and preserve digital evidence

Maintain chain of custody

Understand analysis of devices, email, cloud and logs

Document and report forensic findings

Work effectively with legal and investigation teams

Target Audience

IT security professionals

Incident responders

Fraud investigators

Internal auditors

Compliance officers

IT managers

Course Methodology

Technical presentations

Demonstrations

Simulated investigation

Case studies

Report writing

Course outline

1Day 1: Digital Forensics Fundamentals

Purpose and scope
Legal and privacy considerations
Forensic principles
Types of evidence
Investigation process
Exercise: Investigation planning

2Day 2: Evidence Acquisition

Identification
Preservation
Imaging
Volatile data
Chain of custody
Demonstration: Evidence acquisition

3Day 3: Analysis

File system analysis
Email analysis
Mobile devices
Cloud evidence
Timelines
Lab: Analysis exercise

4Day 4: Logs and Network Evidence

Log sources
Network evidence
Correlation
Incident response links
Case study: Insider data theft
Exercise: Log review

5Day 5: Reporting

Forensic reports
Expert testimony basics
Working with lawyers
Lessons learned
Readiness
Capstone: Investigation report

Frequently asked questions

How long is the Digital Forensics and Evidence Handling course?

The course runs over 5 days of classroom training, usually Monday to Friday.

When is the next Digital Forensics and Evidence Handling course?

The next public date is 16 - 20 Nov 2026 in Barcelona. There are 14 upcoming dates in total.

Where is this course held?

Upcoming sessions run in Barcelona, Paris, Munich, Amsterdam, London, Istanbul, Cape Town, Vienna.

Can I take Digital Forensics and Evidence Handling online?

Yes. Every date can also be joined live online in a virtual classroom with the trainer, for £1,280 per participant. Choose "Live online" in the dates table when you register.

How much does the course cost?

Fees start from £2,750 per delegate, depending on the city. Fees include tuition and course materials.

Do participants receive a certificate?

Yes. Delegates who complete the course receive a London Leadership Management Innovation certificate of completion.

Can this course be delivered in-house for our team?

Yes. LLMI can tailor and deliver this course privately for your organisation at your premises or in one of our training cities.

Course information last updated 14 November 2026.

Digital Forensics and Evidence Handling

Course overview

Course outline

Dates and fees

Frequently asked questions

More IT Management and Cyber Security courses

AI Security: Protecting Machine Learning Systems

Application Security and Secure Software Development

Artificial Intelligence (AI) in Cyber Forensics: Investigating Advanced Cyber Crimes

Training a team?