StorageDigital Storage ForensicsSSD / NVMe ForensicsHow TRIM, garbage collection and wear levelling change evidence on SSD and NVMe drives.Founder & Leadership Team
DFRTI is led by senior professionals from digital forensics, incident response and forensic research. They make sure every programme matches how real investigations work.
About the leadership
The leadership team has worked across forensic investigation, incident response, evidence analysis and research. Their backgrounds span government, law enforcement, company investigations, academic research and forensic technology.
This mix matters for a training institute. A course designed only by academics can drift away from practice. A course designed only by practitioners can skip the reasons behind each step. The leadership team keeps both in view and checks that DFRTI's programmes follow current investigative standards and sound evidence handling.
How the team leads
The team's aim is to raise the standard of digital evidence acquisition, forensic analysis training and investigation methods. In practice that means real datasets, case-based scenarios, current forensic tools and procedures that change as the field changes.
When Android changes how it stores app data or a new SSD controller changes how deleted blocks behave, the curriculum has to change too. Keeping it current is part of the leadership's job.
Areas of expertise in the leadership
Each part of the curriculum is overseen by people with experience in that area.
- Digital storage forensics
Disk forensics, SSD and NVMe analysis, USB investigation, RAID and NAS recovery and file systems. They guide teaching on imaging, acquisition and evidence preservation.
- Mobile and IoT forensics
Android and iOS investigation, SIM and memory cards, drones and IoT devices, with a focus on extraction, decoding and correlating artefacts.
- Network and cloud forensics
Packet analysis, network traffic investigation, Wireshark workflows, cloud storage and virtual machine evidence.
- Surveillance and image/video forensics
CCTV and DVR extraction, video metadata, image verification and deepfake detection.
- Incident response and malware analysis
Spotting signs of compromise, analysing malicious code, capturing volatile memory and rebuilding attack timelines.
- Advanced and specialised forensics
Vehicle forensics, blockchain investigation, machine learning artefacts and OSINT.
What the leadership looks after
- The curriculum for each track and how it maps to DFRTI certifications
- Lab design, tools and practice datasets
- Research priorities and partnerships with universities and agencies
- Training programmes for police, labs and companies
- Standards for evidence handling and reporting across all courses
Related courses
StorageDigital Storage ForensicsSSD / NVMe ForensicsHow TRIM, garbage collection and wear levelling change evidence on SSD and NVMe drives.
MobileMobile & IoT ForensicsDrone ForensicsRecover DJI flight logs, GPS tracks and home points from drones, controllers and phone apps
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.