Skip to main content Skip to footer Skip to menu

Master Digital Forensics (Part-time)

English programme
  • Duration: 2 years
  • Start: September 1st
  • Enrol: before Aug 15th
  • Master of Science
Requirements and enrolment
Studenten van Master Digital forensics

Our digitally transformed world creates many new opportunities for misconduct. Criminals are rapidly shifting their field of activity to the digital domain providing a growing need for trained forensic IT specialists who can act quickly and effectively in digital forensic investigations.

The Master Digital Forensics is a two-year part-time programme geared towards professionals with a Bachelor’s or Master’s degree working in the digital forensic field, looking to widen their knowledge and develop their technical skills.

What kind of education can I expect?

The Master Digital Forensics is a two-year part-time programme geared towards professionals with a Bachelor’s or Master’s degree working in the digital forensic field looking to widen their knowledge and developing their technical skills.

Specifically tailored

The Master of Digital Forensics is specifically tailored to professionals who would like to:

  • Advance their technical skills in modern day digital forensics and investigations.
  • Ccquire the necessary management and communication skills required to perform forensic investigations.
  • Be prepared for the technology paradigm shift towards IOT forensics.
  • Learn how to use analytics, AI, and ML methodologies and apply forensic frameworks to control huge investigations.
  • Learn to develop state of the art forensic tools.
Study load and your investment

The master has an average study load of 16 – 20 hours per week. This includes one dedicated day per week for on-campus lectures and guidance. Our education is offered in a hybrid format, providing the option to follow these lectures online.

The curriculum combines theory & practice. Participants are expected to carry out practical projects and assignments in their own workplace or at the Digital Forensics Lab at the Digital Forensics & E-Discovery lectorate based at the HSD-campus in the Hague.


The Digital Forensics & E-Discovery lectorate has opened a laboratory on the campus of The Hague Security Delta (HSD) for digital forensic research with a focus on the Internet of Things (IoT). The Digital Forensics Lab has specialized equipment, knowledge and (digital forensics) software. You will be able to can use this environment for research and carrying out practical assignments.

You will also have access to the facilities of Leiden University of Applied Sciences when enrolled in the Master’s programme. For example, you will have access to an extensive selection of professional literature and research results via the digital learning environment, including from the Leiden Centre for Applied Bioscience (LCAB) and the research group Digital Forensics & E-Discovery. You can also contact the Media Centre for additional professional literature and free access to various databases.

Study programme

The Master of Digital Forensics is a two-year part-time programme of 60 ECTS. Both year 1 and year 2 have been divided into two semesters with each three modules per semester. The entire programme consists of nine modules and is completed with a Master thesis.

First year
Semester 1

Digital Forensic Principles

This course provides a solid basis for developing the fundamentals of Digital Forensics. The course is a mix of investigation methodologies, basic forensic skills and technology. In addition to theory and assignments, this module also encompasses practical components.

Computer Forensics

This course focuses on digital forensic artifacts that can be found on computers. In this course the principles of computers and their operating systems will be covered. With this knowledge you will research various artifacts, the influence of the environment on these artifacts and even anti-forensics. You will research traces which can be left behind by applications, virtual computing, and/or cloud storage. You learn to apply various digital forensic processes and techniques, for identifying, acquiring, analysing, and reporting various traces.

Research Methodology

Every day, forensic research plays a pivotal role in gathering crucial evidence to be presented in the courtroom. Because this evidence serves as the key to unraveling the truth and ensuring justice prevails, scientific research skills are essential for every forensic investigator.

In the module Research methodology you will learn the essential research skills. This means that you will develop the expertise to design a research project and to transform your ideas into a well-structured research proposal. You'll receive guidance throughout your research project and engage in thoughtful discussions about the steps and decisions made along the way. Also, you will learn to critically assess the sources you rely on. By the end of the module, you can systematically design and execute scientifically sound research projects and effectively communicate your findings to various audiences.

Semester 2

Law, Ethics & Governance

When the expertise of a digital forensics expert is called upon digital skills are a necessary requirement. They are however not sufficient. All digital forensic work exists in a context that needs to be understood in order to work effectively. In this module you will gain a basic understanding of the legal and ethical context of digital forensic work and how it is influenced by that context.

This module will require you not only to consider the most efficient way to go about your work from a technical perspective, but also look at legal and ethical consequences of the choices you make.

Data Analytics

In this comprehensive module, you'll embark on a journey into the world of data analysis, where you will acquire essential skills for handling data in forensic scenarios. Our course takes you through the fundamental elements of data analysis, from data collection to visualization, and demonstrates how these skills can be applied effectively in forensic contexts.

By the end of this module, you will have not only acquired the essential knowledge and skills to work in a data analysis team, but also you have completed a small data project to showcase your practical experience. Join us today and unlock the potential of data analysis in the world of forensic applications.

Mobile Forensics

Mobile forensics is a subgroup within digital forensic investigation that deals with collecting, analyzing and reporting evidence from mobile devices such as smartphones, tablets and smartwatches. As people rely on mobile devices for most of their data usage, these devices contain a large amount of evidence that can be useful in investigations.

Mobile devices can provide a wide range of useful data, from call logs and web search history to location data and physical user activity showing where the owner of the device was at a given time and doing. This module looks at the file systems and operating systems used by mobile devices, and how to extract digital evidence from them. It also looks at techniques to analyse, interpret, and validate such data when the meaning of data is not clear.

Second year
Semester 3

Practical Laboratory Project

The aim of the practical project is to build or examine (forensic) devices.

Network and IOT Forensics

This course examines digital forensic techniques in the context of networks and the internet (b.e. Internet of Things). You will learn about the identification of artifacts and collecting and analysing evidence using appropriate technologies. At the end of the course you will be able to advise about the acquisition and use of this information.

Semester 4

Master Thesis

The purpose of the master thesis is to introduce and describe the results of a research project conducted on a topic of your choice related to Digital Forensics or E-Discovery. It should be written according to academic standards consistent with the relevant international literature in the field. The thesis is written in English and should provide clear evidence that you are familiar with the current scientific literature on the chosen topic, and can relate the research to existing work.

Not sure if you qualify?

If you have a Bachelor’s degree in Computer Science or Digital Forensics, often there is the option to follow a pre-master programme to meet the required prerequisites. The pre-master programme offers nine different modules.

Depending on your educational knowledge and professional background there is the option to follow one or more of the pre-master modules to ensure you obtain the required knowledge to be admitted to the Master’s programme Digital Forensics.

Pre-Master Modules
Calculus & Statistics

You’re able to transform a real-life situation towards a mathematics model, using functions, equations and formulas.

Success criteria:

  • A simple real-life situation has been transformed into a mathematics model and then solved with that model
  • Underlaying knowledge has been demonstrated

Knowledge and application are expected of the following:

  • Apply arithmetic operations (like calculations with negative numbers, fractions, percentages, exponentiation)
  • Using formulas
  • Solving (simple) equations
  • Using Functions (linear, square,exponential, etc.) for e.g. intersection determination, differentiation, recognizing limits and asymptots, etc.
Object Oriented Programming

You’re able to model and develop a (Java) application with complex programme structures, using UML and Object Oriented Programming principles.

Success criteria:

  • Sequence, State and class diagram are present
  • The application applies to the OO-principles, as written underlaying
  • The use of several different complex program structures (see below)
  • The application is technically and functionally correct
  • Underlaying knowledge has been demonstrated

Knowledge and application are expected of the following:

  1. UML
    • Description of Object interaction using a Sequence Diagram
    • Description of object states using a State Diagram
    • Creation of an implementation model using a class diagram
  2. OO principes
    • OO Principles - DRY
    • OO Principles - Favore composition
    • Relations – aggregation en composition
    • Interfaces and abstract classes
    • OO Principles - SOLID
    • OO Principles - LSP (Liskov Substitution)
    • OO Principles - OCP (Open/Closed)
    • OO Principles - SRP (Single Responsibility)
    • Polymorphism
    • Layer architecture
    • MPV
    • Encapsulation
  3. Programming structures
    • ArrayList
    • File I/O
    • Java I/O (binary)
    • Interfaces and abstract classes
    • Constructor
    • JavaFX
    • Event handling in JavaFX
    • Exception handling
    • Threads
Forensic IT basics

You’re able to initiate, execute and report a simple digital forensics investigation, taking in account the legal context with it’s stakeholders. The investigation consists of Computer-, Mobile- and Network Forensics.

Success criteria:

  • A digital forensic investigation lab environment has been created
  • Reporting is in such way, that the complete investigation is transparant and reproducable
  • Several different digital forensics has been substantiated used
  • Underlaying knowledge has been demonstrated

Knowledge and application are expected of the following:

  • ComputerForensics
    • Windows Operatingsystem (10 or 11)
    • Filesytems (e.g. NTFS / FAT32)
    • Application Forensics (browser, sqlite)
    • Acquisition artifacts (e.g. volatile memory, devices)
  • Network Forensics
    • Network protocols
    • Acquisition network traffic (e.g. WireShark)
    • Analyses log files
  • Mobile Forensics
    • Acquisition Artifacts (devices)
    • Analyses Artifacts
Database Systems

You’re able to set up and maintain a complex (relational) database (e.g. PostgreSQL), considering the aspects of: architecture, performance, security and concurrency.

Success criteria:

  • Queries are well optimized and whenever needed, implemented in views, triggers and stored procedures
  • Naming and structure is according valid rules and conventions
  • Security measures are implemented effectively
  • Data-integrity is guaranteed
  • Underlaying knowledge has been demonstrated

Knowledge and application are expected of the following:

  • Several databasemanagement solutions: open/closed; source, big-/small, non-relational/relational
  • PostgreSQL, Oracle or comparable
  • SQLite
Machine Learning

With the help of Machine Learning methods and techniques you have gained insight into, unknown, patterns in data. You have made this data suitable so that these methods and techniques can be applied. You have substantiated how you arrived at the results.

Success criteria:

  • There is an adequate problem definition
  • Several statistical models have been applied
  • There is a Python environment in which the methods and techniques used are implemented
  • The results have been validated

Knowledge and application are expected of the following:

  • Data Mining: data collection, feature extraction, labeling
  • Supervised– en Unsupervised-Learning
  • Predictive coding
  • Cross-validation, ROC-curves, R2
Organization & Business processes

You’re able to apply several common organizational, business- and market models within a given casus, using relevant methods like, RACI, BPMN and the PLC matrix.

Success criteria:

  • Usage of several relevant methods en techniques
  • The coherence of the used methods is clear and well explained
  • Underlaying knowledge has been demonstrated

Knowledge and application are expected of the following:

  • Mintzberg organizational types and the cultural types defined by Hofstede
  • Greiner’s life cycle model
  • The five P's of marketing (product, price, place, promotion and people)
  • De BCG-matrix and the PLC
  • Five forces model by Porter
  • PMC
  • Leadership styles
  • KPI’s
  • BPMN 2
  • CRUD and RACI
Computer Architecture basics

You’re able to place current IT technologies in a historical perspective, which results in insight in the fundamental operation and coherence and application of these technologies.

Success criteria:

  • Underlaying knowledge has been demonstrated

Knowledge and application are expected of the following:

  • Binary math
  • Logic
  • Basic architecture computersystems and their subsystems, including servers
  • Storage
  • Differences between Operating Systems (OS)
  • Shell-based OS (linux)
Computer Networking

You’re able to design and configurate a computer network. You implement networkapplications and are competent to give advice about networks.

Success criteria:

  • A working IP-network with well calculated subnets, including well configured routers and switches
  • Reporting of the IP-network instruction, showing knowledge and insight of the needed domain matter
  • Underlaying knowledge has been demonstrated

Knowledge and application are expected of the following:

  • Networkarchitecture with the several layers (OSI model) protocols (HTTP, SMTP, TCP, UDP, etc.)
  • Operation of proxies and the affection on connections
  • Datatransport, actions (ACK,, time-out, etc.) for reliability en knowledge of common errors
  • IP-network design and configuration
  • Cubnet mask, calculation and function knowledge
  • Ethernet, CSMA/CA, CSMA/CD
  • Wireless networks (IEEE.802.11)
  • TCP/IP tools (ipconfig, ping, route, etc.)
  • Network hardware (hub, bridge, switch, router, etc.)
Foto van Marja Krosenbrink

Marja Krosenbrink

Programme Manager Master Digital Forensics
Something for you?


Why Leiden University of Applied Sciences?

Vibrant student life
As a traditional university town, Leiden is well known for its vibrant student life. Its vicinity to The Hague, international city of peace and justice, adds to its position as a great place for an academic stay in the Netherlands.

The city is home to the oldest student society in the Netherlands as well as a variety of social student clubs. Most of these social student clubs have special memberships for international students.

Erasmus Student Network Leiden
The Erasmus Student Network Leiden organises all sorts of activities for international students like parties, movie nights and excursions.

SIB Leiden
The Dutch United Nations Student Association (DUNSA, also known as SIB Leiden) is an organisation with a main focus on international relations. Their activities include dinner parties, lectures and forums. Many of the activities are in English. International students are very welcome to join.


When is the deadline to enroll?

The final deadline for enrolment is August 15th. Please visit the Requirements and enrolment page for more information.

Can I also start the programme in February?

No, currently the Master’s programme only starts in September.

Is a workplace required?

Yes, a suitable workplace in the field of digital forensics is needed to start with the Master’s programme.

Do you also offer Digital Forensics courses?
What are the Education and Examination Regulations (EER)?

Still have some questions?

Contact the programme manager or reach out to our international office

Made your choice?

Are you interested in joining the two-year part-time programme of the Master Digital Forensics?

Enrol before the 15th of August