Three learning pathways
Programmes are designed as progressive professional development. Delivery may include instructor-led workshops, practical labs, case simulations, guided exercises, assessment and train-the-trainer activity.
Digital Evidence Foundations
For investigators, first responders, justice professionals and early-career practitioners who need reliable evidence-handling skills.
Typical duration: 2 to 5 daysForensic Examination & Investigation
For practitioners conducting computer, mobile, browser, OSINT and cyber-enabled crime examinations.
Typical duration: 3 to 10 daysQuality, Leadership & Courtroom Practice
For senior examiners, team leads, trainers, laboratory managers and professionals responsible for quality and testimony.
Typical duration: 2 to 5 daysCore programmes
Digital Evidence First Responder
Introduces lawful identification, preservation, seizure, packaging, documentation and transfer of digital evidence.
Key modules
- Digital evidence principles and scene awareness
- Device identification and initial risk assessment
- Preservation, isolation and contamination control
- Chain of custody and contemporaneous notes
- Packaging, transport and laboratory submission
Learning outcomes
Participants should be able to recognise digital evidence, take proportionate preservation steps, document actions clearly and maintain evidential continuity.
Computer Forensics Practitioner
Develops a structured workflow for forensic acquisition, file-system examination, artefact interpretation and defensible reporting.
Key modules
- Forensic acquisition and verification
- File systems and operating-system artefacts
- Deleted data and user activity reconstruction
- Timeline analysis and corroboration
- Examination notes and technical reporting
Learning outcomes
Participants should be able to plan and conduct a documented computer examination, interpret common artefacts and communicate findings with appropriate limitations.
Mobile Device Forensics
Covers acquisition choices, mobile artefacts, application data, timestamps, communications and structured interpretation.
Key modules
- Mobile platforms and acquisition approaches
- Logical, file-system and physical acquisition concepts
- Application, communication and location artefacts
- Timestamp interpretation and validation
- Reporting and evidential limitations
Learning outcomes
Participants should be able to select appropriate examination approaches, analyse common mobile artefacts and explain the reliability and limitations of findings.
Browser & Internet Artefact Forensics
Focuses on browser history, downloads, searches, cookies, login metadata, extensions and timeline reconstruction.
Key modules
- Chromium and browser artefact structures
- History, downloads and search activity
- Cookies, autofill and login metadata
- Extensions, sessions and supporting artefacts
- Timeline reconstruction and validation
Learning outcomes
Participants should be able to identify and interpret browser artefacts, correlate activity across sources and produce a transparent examination timeline.
OSINT for Lawful Investigations
Builds disciplined open-source research skills with emphasis on verification, provenance, documentation, privacy and evidential value.
Key modules
- Investigation planning and collection discipline
- Search, social and web research techniques
- Source verification and corroboration
- Capture, preservation and provenance
- Ethics, privacy and reporting
Learning outcomes
Participants should be able to conduct documented open-source enquiries, evaluate source reliability and preserve relevant material responsibly.
Digital Forensic Reporting & Courtroom Practice
Develops clear forensic reports and confident, impartial communication of technical findings to non-technical decision makers.
Key modules
- Fact, interpretation and opinion
- Report structure and exhibit referencing
- Limitations, uncertainty and validation
- Preparing for testimony
- Mock examination and cross-examination
Learning outcomes
Participants should be able to produce clear reports, explain methodology and limitations, and communicate technical evidence impartially.
Forensic Quality, Validation & Laboratory Practice
Introduces repeatability, verification, tool testing, peer review, quality records and risk-based laboratory practice.
Key modules
- Quality principles for digital forensics
- Tool testing and method validation
- Peer review and technical verification
- Competence records and controlled procedures
- Continuous improvement and corrective action
Learning outcomes
Participants should be able to design practical quality controls, document validation activity and strengthen reproducibility within their teams.
Train the Digital Forensics Trainer
Supports sustainable local training capability by developing instructors who can plan, deliver and evaluate practical forensic learning.
Key modules
- Learning objectives and lesson design
- Practical lab and scenario development
- Facilitation and learner support
- Assessment and feedback
- Instructor demonstration and peer review
Learning outcomes
Participants should be able to design and facilitate structured training, assess learning consistently and maintain course materials responsibly.
Learning that demonstrates competence
Depending on the programme, assessment may combine practical exercises, short knowledge checks, scenario work, examination notes, report writing and instructor observation. Certificates should state what was completed and assessed. WADFIN will not describe a course as externally accredited unless formal accreditation has been obtained.
Programme design principles
- Practice-led and scenario-based
- Evidence integrity before tool operation
- Vendor-neutral concepts where practical
- Transparent limitations and validation
- Ethical and lawful professional practice
- Adaptable to institutional and national contexts
Institutional training options
Agency Cohorts
Structured delivery for law enforcement, justice, regulatory and public-sector teams, adapted to agreed learning needs.
University Collaboration
Guest teaching, practical labs, curriculum dialogue, research supervision support and practitioner-academic exchange.
Train-the-Trainer
Capacity-building programmes that help institutions develop sustainable internal instructors and repeatable training materials.
Build a training programme with WADFIN
Institutions can discuss cohort needs, technical priorities, faculty collaboration and capacity-building partnerships.