Practitioner to AdvancedSelf-paced

Devices and Forensic Practice

Go deeper: forensic imaging and recovery, device and cloud sources, quality and error, and a clear, defensible report.

10 lessons2h 33m totalEnglishRecord of Completion

Readiness, not a licence. This course builds knowledge and readiness and ends with a Record of Completion. It is not a government certification and does not by itself grant any licence, authority or regulatory approval.

What you'll learn

Understand forensic imaging and write-blocking
Know what recovery can and cannot do
Recognise device, cloud and connected-device sources
Spot anti-forensic techniques
Write a clear, defensible report

Who it's for

Experienced investigators
Lawyers handling expert evidence

No prior training needed for the first lesson. Read it free to judge the level.

Syllabus

I am reading as

Choose a path to see which units are core for you.

Collection and devicesFREE PREVIEW5 units · 1h 15m

Advanced Electronic Evidence (Part 1): Collection, Imaging and Recovery · 18m
Unit 14A · Mobile Devices: Extraction Levels, Locks and App Data · 15m · continues “Advanced Electronic Evidence (Part 1): Collection, Imaging and Recovery”
Unit 14B · Computers: Artefacts, Timestamps and Timelines · 15m · continues “Advanced Electronic Evidence (Part 1): Collection, Imaging and Recovery”
Unit 14C · Cloud and Remote Acquisition · 12m · continues “Advanced Electronic Evidence (Part 1): Collection, Imaging and Recovery”
Unit 14D · CCTV, Video, Images and Audio · 15m · continues “Advanced Electronic Evidence (Part 1): Collection, Imaging and Recovery”

Special sources, quality and reporting5 units · 1h 18m

Advanced Electronic Evidence (Part 2): IoT, Anti-Forensics, Ethics and Reporting · 18m
Unit 15A · Vehicles, Wearables, Smart Homes and Drones · 15m · continues “Advanced Electronic Evidence (Part 2): IoT, Anti-Forensics, Ethics and Reporting”
Unit 15B · Synthetic Media and Machine-Generated Evidence · 15m · continues “Advanced Electronic Evidence (Part 2): IoT, Anti-Forensics, Ethics and Reporting”
Unit 15C · Validation, Error and Quality in Forensic Work · 15m · continues “Advanced Electronic Evidence (Part 2): IoT, Anti-Forensics, Ethics and Reporting”
Unit 15D · The Forensic Report and Giving Evidence · 15m · continues “Advanced Electronic Evidence (Part 2): IoT, Anti-Forensics, Ethics and Reporting”

Final assessment optional · pass 70%

A timed assessment over the whole course. Pass at 70% to earn your Record of Completion.

What this means where you work

The skills are the same everywhere. The legal and licensing rules differ by country, so each course carries a country card that follows your edition.

Electronic evidence and lawful access in Australia

◐ Partial coverage

About this card: This card covers Commonwealth law only. Each State and Territory has its own evidence, search and surveillance laws, and they differ in detail. Check the law of the court and the agency you work with. Checked on 12 November 2026.
What you must do: Check which evidence Act applies in your court: the Commonwealth Act or a State or Territory Act.
Keep a record of how each copy or output was made, so its contents can be proved under s.48 and the device presumption can apply.
Obtain evidence lawfully. Improperly obtained evidence may be excluded under s.138.
Do not intercept communications or access stored communications without the warrant or exception the TIA Act provides.
Ask for telecommunications data only through an authorisation by an authorised officer of an enforcement agency.
Use a surveillance device or access a computer covertly only under a warrant.
Local term: Document: Any record of information, including anything from which sounds, images or writings can be reproduced.
Local term: Stored communication: A communication held on equipment of a carrier that cannot be accessed without its help.
Local term: Telecommunications data: Information about a communication, not its content, that service providers keep.
Local term: Section 3LA order: A magistrate's order that a person help police access data on a computer or device.

Show the law (11 entries)

Law: Evidence Act 1995 (Cth), s.48 (Proof of contents of documents)
Law: Evidence Act 1995 (Cth), s.51 (Original document rule abolished)
Law: Evidence Act 1995 (Cth), s.138 (Improperly or illegally obtained evidence)
Law: Evidence Act 1995 (Cth), s.146 (Evidence produced by devices)
Law: Evidence Act 1995 (Cth), s.147 (Business documents produced by devices)
Law: Telecommunications (Interception and Access) Act 1979, s.7 (No interception)
Law: Telecommunications (Interception and Access) Act 1979, s.108 (No access to stored communications)
Law: Telecommunications (Interception and Access) Act 1979, s.178 (Existing telecommunications data)
Law: Telecommunications (Interception and Access) Act 1979, s.187C (Data retention period)
Law: Surveillance Devices Act 2004, s.10 (Types of warrant)
Law: Crimes Act 1914, s.3LA (Assistance to access data)

Last verified 2026-11-12. Sources: Evidence Act 1995 (Cth), compilation No. 35, 10 June 2025 — Federal Register of Legislation, Telecommunications (Interception and Access) Act 1979, compilation No. 134, 27 August 2026, volume 1, Telecommunications (Interception and Access) Act 1979, compilation No. 134, 27 August 2026, volume 2, Surveillance Devices Act 2004, compilation No. 62, 27 August 2026, Crimes Act 1914, compilation No. 167, 27 August 2026, volume 1, Evidence Act 2008 (Vic) — Victorian legislation, Evidence Act 2025 (WA) — Western Australian legislation

Who wrote this

VSVSV training faculty

Written by the VSVSV training team from its own lesson scripts and guidebooks, rewritten in plain international English. Points of law and country rules were checked against official sources, and each country note shows the date it was checked.

Your Record of Completion

SAMPLE

LEA.Training · Record of Completion

Devices and Forensic Practice

This records completion of training. It is not a licence or government certification.

A. Learner

completed the course and passed the final assessment.

Record number 0000 0000 0000 0000 · Verify at lea.training/verify

The public verify page shows only name, course, date and status. Nothing else.

Common questions

Will this course make me a forensic examiner?

No. It explains forensic practice so that you can ask for it, read a forensic report and test it. It is not tool training and not a forensic qualification.

Should I take Electronic Evidence Essentials first?

Yes, that is the best order. This course assumes you know the basics from the foundation course.

When can I take the final assessment?

When you have marked complete the units that are core on your path. The final draws its questions from those units. If you did not choose a role, every unit counts.

Is this an official licence or certification?

No. LEA.Training is a private training provider. A course builds knowledge and readiness and ends with a Record of Completion. It is not a licence, a regulator's certificate or an accreditation, and it is not endorsed by any government agency.

Can I try it before I pay?

Yes. The first lesson of each course is open to read, with no sign-up.

How do I get a Record of Completion?

Finish the lessons, then pass the course’s final assessment with 70% or more. Your Record carries a number and a QR code that anyone can check on the verify page. It shows only your name (or initials), the course, the date and its status.

How long do I keep access?

Paid access lasts 12 months from the day you buy. You can study at your own pace and come back to any lesson during that time. Your Record of Completion stays verifiable after access ends.

Who sells the course, and how is tax handled?

In the Australia edition the seller is Vanaranya LLC. Tax, where it applies, is calculated at checkout from your billing country.

Can I buy seats for my team?

Yes. Agencies, firms, colleges and companies can buy seats, assign the right path for each role and see progress and results. Larger teams get a discount. See For organisations.