ProSentinel
Contact

Academy / Competency programme

Digital forensics / DFIR

Digital forensics is the examination of digital traces to help establish what happened. Training develops evidence assessment, an understanding of data preservation and the limits of interpretation, from the foundations to complex incidents.

Compare Levels I–III Discuss your entry level

Professional application

Internal investigations, incident analysis and collaboration between analysts, legal advisers and IT teams.

Role in the wider system

Contributes reconstructed chronology and a clear assessment of what the available digital data supports.

Explore the related service

Development within this discipline

Three levels of independence.

Compare outcomes and entry requirements. Each higher level requires the preceding competence or equivalent experience. We agree your entry level before training.

Level I

Digital traces and limitations

Understand what a digital trace can describe.

Outcome

You can explain the significance of basic traces and identify limitations in the material.

Entry requirements

Basic familiarity with devices, accounts and files; the scope is matched to the participant’s role.

Audience and competency scope
Who it is for
People beginning to work with digital material.
Competencies developed
  • Recognise the significance of data in an event
  • Separate observation from interpretation
Areas covered
Digital traces; data quality and completeness.
Nature of the work
A practical introduction linked to professional use.

Level certification

Assessment format: A knowledge check and a task using prepared digital material, assessing integrity, sound interpretation and limits to inference.

After passing: ProSentinel Academy / Digital forensics / DFIR / Level I

Assessment and validity rulesNext recommended competencyPosition in the full path
Next level: Level II

Level II

Event reconstruction

Combine traces into a supported chronology.

Outcome

You can reconstruct events to the extent supported by the data and explain the gaps.

Entry requirements

Level I or equivalent experience.

You can explain the significance of basic traces and identify limitations in the material.

Audience and competency scope
Who it is for
Analysts who understand basic artefacts and their limitations.
Competencies developed
  • Compare data from different sources
  • Assess chronological consistency and discrepancies
Areas covered
Temporal context; relationships between traces.
Nature of the work
Applied analysis requiring comparison and reasoned judgement.

Level certification

Assessment format: Artefact analysis, time correlation and a report. The candidate explains relationships and distinguishes an observation from attribution to a person.

After passing: ProSentinel Academy / Digital forensics / DFIR / Level II

Assessment and validity rulesNext recommended competencyPosition in the full path
Next level: Level III

Level III

Complex material assessment

Independently assess competing interpretations of digital material.

Outcome

You can explain a complex digital assessment without automatically attributing intent or responsibility to a person.

Entry requirements

Level II or equivalent experience.

You can reconstruct events to the extent supported by the data and explain the gaps.

Audience and competency scope
Who it is for
Experienced analysts and those responsible for communicating the assessment.
Competencies developed
  • Weigh ambiguous artefacts
  • Connect technical assessment to the investigative question
Areas covered
Alternative explanations; limits of attribution.
Nature of the work
Advanced work with ambiguity, individually or in teams depending on the objective.

Level certification

Assessment format: Independent examination of a complex case and defence of the report, covering connected artefacts, evidence gaps and a justified reconstruction.

After passing: ProSentinel Academy / Digital forensics / DFIR / Level III

Assessment and validity rulesNext recommended competencyPosition in the full path
After Level III: next recommended competency

After Level III

Next recommended competency

A new direction broadens your profile. The programme and entry level depend on your role and existing competencies.

Organised crime

Extend a digital chronology with an assessment of structures, relationships and threat mechanisms.

From assessment to competency development

Where the starting point is an organisational concern, an audit of competencies, processes or information exposure can help define the training need. Objectives, access to material and assessment boundaries are agreed before work begins.

Audit scope and engagement process
Discuss your entry levelAcademy mapExplore the Integrated Competency Path