Data Analysis and Evidence Gathering

Course purpose

This Advanced course develops a defensible approach to gathering and analysing investigative evidence. Learners translate issues and hypotheses into data requirements; identify and authorize sources; preserve provenance; design collections; validate completeness; prepare reproducible datasets; apply descriptive, comparative, temporal, duplicate, outlier, linkage and network techniques; corroborate indicators with documents, systems and testimony; document limitations; and report conclusions that remain traceable to source. The course emphasizes professional judgement, contrary evidence, privacy, secure handling, peer review and reproducibility. It does not authorize access, surveillance, covert collection, device imaging, compulsory process or cross-border transfer; determine privilege; certify admissibility; or establish that an anomaly is fraud. Applicable law, contracts, professional standards, court or regulator directions, data-protection duties and specialist forensic procedures must be confirmed for the actual engagement and jurisdiction.

Learning outcomes

By the end of this course, you should be able to:

1. Convert investigative issues and competing hypotheses into proportionate evidence and data requirements.
2. Plan and document authorized acquisition across financial, operational, digital, documentary, interview and external sources.
3. Prepare and validate analysis-ready data while preserving provenance, integrity, transformations and reproducibility.
4. Apply suitable analytical methods and distinguish anomalies, indicators, corroborated facts, limitations and findings.
5. Communicate analytical results through traceable exhibits, review files and decision-focused reporting.