Skip to main content
Institute of Advanced Technological and Commercial Studies

Skills

Incident response and digital forensics

After a breach, everything is decided in the first hours: preserving traces, rebuilding the timeline, identifying the entry point and producing a file that stands up before an insurer or a court. It is a discipline of method and evidence.

Reconstruct, prove, hand over

Digital forensics answers three questions in order: what happened, how far the attacker went, and how to keep them out. Answering them requires a rigorous chain of custody — an intact disk image, a control hash, a log of analytical actions — because a finding without traceability loses its value exactly when it becomes useful. The programme teaches that rigour alongside the technical analysis, on complete cases rebuilt in the laboratory.

  • Preserve traces from a compromised system with a chain of custody
  • Rebuild the timeline of an intrusion from system logs
  • Identify the entry point and the true extent of the compromise
  • Write an incident report that stands up to a third party

Its place in the programmes

This table shows where the skill lives in the catalogue. It lets you check, before applying, that the volume matches your ambition.

Teaching blockProgrammeTaught hoursYear
Incident response and digital forensicsCybersecurity programme — Bac+5 level180 hYear 2
Security fundamentalsCybersecurity programme — Bac+5 level220 hYear 1
Governance, risk and complianceCybersecurity programme — Bac+5 level100 hYear 2

Roles in the official framework

These qualifications are prepared after a first role or as a career change, for an occupation the market names.

Professional qualificationTarget occupationLevelTaught volume
Chief Information Security OfficerCISO7 · Expert and executive700 h
Enterprise ArchitectIS architect7 · Expert and executive700 h

How far you go

You take charge of an incident response and deliver the complete file, technical and legal. The ambition of a skill is measured by the act it authorises, then by the volume behind it.

teaching blocks
3

Catalogue rule: one credit is twenty-five hours of work, ten of them taught.

of taught instruction
500 h
credits in total
50
professional qualifications concerned
2

Your routes in

Each row leads to the full programme page: objectives, admission, blocks and calendar.

ProgrammeLevelDurationFees
Cybersecurity programme — Bac+5 levelMaster's degree2 years7 500 000 GNF per year

The questions we are asked

Does this skill apply to small organisations?

It applies to them first: a thirty-person organisation faces the same automated attacks as a large group, with a team that has to respond on its own.

Do you learn to work with the authorities?

The block covers the format of the file handed to a third party — insurer, authority, board — and the conditions that give it evidential weight.

Do I need Linux and networking beforehand?

Both are taught in year one of the same programme, with 220 taught hours for network and systems security. Forensics comes after that.

Explore next

See all 56 pages
Browse the programmes
Incident response and digital forensics — Skills | IHETC — IHETC