Digital Forensics & Cyber Investigation Advanced

The digital transformation of society is affecting crime, criminals and criminal investigation. The Digital Forensics & Cyber Investigation continuing education program at BFH was created to address new education demands for skilled digital forensic and cyber investigators. The CAS Digital Forensics & Cyber Investigation Advanced builds on the previous Fundamentals CAS and provides you with the knowledge and skills needed to perform forensic analysis of file systems, operating systems, applications, and memory.

This CAS

  • teaches advanced storage and file system forensics, operating system artefact analysis, application and media file artifact analysis and memory forensics,

  • consists of 4 residential one-week block (modules),

  • is taught in English by internationally recognized experts in the field. 


  • Degree/Certificate Certificate of Advanced Studies (CAS)
  • Duration Week 43 to week 14
  • Schedule 4 residential one-week block
  • Application deadline One month before the start of the semester
  • ECTS credits 12 ECTS-Credits
  • Costs CHF 7'500
  • Teaching language English
  • Location Biel, Aarbergstrasse 46
  • School School of Engineering and Computer Science
  • Next session Autumn semester 2023


Structure + Content

The digital transformation of society is affecting crime, criminals and criminal investigation. New cyber criminal methods using advanced technical tools and exploitation are an opportunity for criminals and a challenge for investigators. Technically complex illegal activities are being sold as services to less skilled criminals, increasing the challenge of fighting cybercrime. On the other hand, criminals face challenges trying to hide and avoid attribution. The large amount of digital traces stored across multiple locations creates an opportunity for criminal investigators.


Crime scenes are also changing. With the growth of cybercrime, crime scenes are becoming virtual, global, and multi-jurisdictional. Investigating a trans-national cyber crime scene requires investigative tools to remotely gather information, and also collaboration between entities in both the public and private sectors.
Modern physical crime scenes have a comprehensive set of digital evidence sources. In addition to PCs and notebooks, digital evidence traces can be found in mobiles, IoT devices, automobiles, smart control systems, data stored with cloud providers, and distributed on servers across the Internet. With the increase in digital and online payment systems, financial transactions are also becoming an important digital evidence source, especially in financially motivated crimes.

Objectives + Skills

This continuing education program has practical learning objectives. Students completing the CAS in Digital Forensics & Cyber Investigation Advanced will understand the concepts of modern digital forensic analysis in depth. They will have the skills to analyze digital evidence from a variety of sources, including file systems, operating systems, applications, and memory.

This will prepare students for career opportunities in a variety of organizations:

  • Law enforcement - Federal agencies, KAPOs
  • Military and government - CERTs, cyber-troops
  • Finance industry - fraud/cybercrime investigation teams
  • Insurance industry - cyber insurance claims investigation
  • Large enterprises - security and incident response teams
  • Consultancy and audit - e-Discovery, accounting, «Big Four»
  • IT security service providers and product vendors
  • Private boutique digital forensic and investigation firms

The CAS Digital Forensics & Cyber Investigation Advanced is built on the CAS Digital Forensics Fundamentals, and designed for two groups of professionals:

  • Experienced forensic investigators who want to increase their technical skills in digital forensics and cyber investigations.
  • Experienced engineers and technicians who want to transition into the field of digital forensics and cyber investigations.

The individual modules make up this programme are described below.

  • File system Analysis
  • Operating System Artifact Analysis
  • Application and Media File Artifact Analysis
  • Memory Forensics
Skill levels | CAS Advanced Digital Forensics Enlarge image

Skill levels

  1. Proficiency/knowledge
  2. Comprehension
  3. Application
  4. Analysis
  5. Synthesis
  6. Appraisal

A module may include a variety of teaching methods such as lectures, seminars, case studies, practical labs, assignments, etc.

To gain the 12 ECTS credits, students must demonstrate proficiency by successfully completing all coursework (examinations, project work).

As a rule, a university degree and practical experience are required for admission. 
People with a high vocational training can apply, provided they have suitable professional experience and prior scientific and methodological knowledge. 

Degree + Title

Certificate of Advanced Studies (CAS) in «Digital Forensics & Cyber Investigation Advanced»