Forensic Examination of Internet Use


This course focuses on forensic artefacts remaining upon a subject machine that has been used on the Internet.

Methods and tools for the recovery of such items are discussed, as well as binary confirmation of the presence and physical location of those artefacts. The importation of “unusual” software applications, (particularly Email applications) is demonstrated, and methods of extracting data from such proprietary storage systems are demonstrated and experienced.

Structure and content

Duration: 1 week Full Time

Examination: Written 1.5 hours, Practical 1.5 hours

Topics include: Internet Protocols and addressing, Usenet, Google Groups, Outlook & Outlook Express, Windows Mail, methods to deal with other internet mail packages, Email header interpretation, dealing with email traces from unallocated space and provenance, Java and viruses Malware, remote desktop and similar tools, deconstruction and data extraction from Indexes/Catches of Internet Explorer, Mozilla Firefox and Google Chrome, Telnet, MIRC and FTP methods and uses.

Examinations or analysis are carried out on prepared hard disks with suitable scenarios. Trojans and virus infections are explored, and methods of assessing their impact are discussed.

Who the course is for

This course is for practitioners, and applicants should normally be employed by, and sponsored by law enforcement or associated agencies, or a reputable organisation involved in the forensic computing domain.

Recommended prior knowledge

For new or inexperienced analysts, it is strongly recommended that Foundations of Forensic Computing is completed before other courses are attempted.

Accredited Prior Learning (APL) may be awarded for previous relevant studies. Individual guidance will be provided with respect to assessing APL.

Key learning outcomes

The aim of the course is to prepare the analyst to examine a machine which has been used on the internet, and to produce relevant evidence of such use.

What you will achieve

This course is designed to address the need for continuing professional development and career progression within a rapidly changing environment.

With this course students will be awarded 10 credits.  Students can then build more credits through successful completion of related courses and assessments, which may lead to a PG Cert Higher Education award.

Professional accreditation


Business benefits



This course is taught exclusively by Professor Brian Jenkinson.

With well over 1,000 forensic examinations, and 14 years of experience in teaching forensic computing, courses offered by Brian are highly specialist with a blend of highly practical hands-on experience, combined with rigorous theoretical and academic training.


Course delivery is a combination of practical hands-on experience, combined with rigorous theoretical and academic training.


This course is delivered in the Forensic Laboratory at De Montfort University, in Leicester City Centre.

The laboratory is new, and has been purpose built with “super fast” machines, wide screen monitors, and an array of top-of-the range display systems. The Lab is situated within a security controlled area of the Cyber Security Centre, and is a very pleasant place to work.





Places to stay

There are numerous hotels within easy walking distance (5-10 minutes) of De Montfort University (DMU) offering different grades of accommodation. Most will offer Government and Law Enforcement or DMU rates. A number are on the edge of the Town Centre and either have their own car parks, or have arrangements in place for discounted parking nearby.

Contact us

Faculty of Technology
Gateway House Room 4.64
De Montfort University
The Gateway

T: +44 (0)116 250 6339



Events target area image

At DMU there is always something to do or see, check out our events for yourself.

News target area image

DMU is a dynamic university, read about what we have been up to in our latest news section.

Mission and vision target area image
Mission and vision

Read about our mission and vision and how these create a supportive and exciting learning environment.