Training investigators worldwide — from crime scene to court room
A series of bespoke training modules navigating you through the Vehicle Systems Forensics labyrinth, built on casework experience in some of the most serious criminal investigations since 2016.
2026/27 dates available for bookings///2026/27 dates available for bookings///2026/27 dates available for bookings///2026/27 dates available for bookings///2026/27 dates available for bookings///2026/27 dates available for bookings///
2026/27 dates available for bookings///2026/27 dates available for bookings///2026/27 dates available for bookings///2026/27 dates available for bookings///2026/27 dates available for bookings///2026/27 dates available for bookings///
The pathway
Vehicle Systems Forensics Training Pathway
The first of its kind: building on experience in the field of Vehicle Systems Forensics (VSF) case work in some of the most serious criminal investigations since 2016, we are pleased to announce this Vehicle Systems Forensics Training Pathway.
Do you need to increase your knowledge and confidence around developing digital strategies for modern vehicles? Do you need to know how to document these types of examinations and comply with best practices? Do you need to learn new skills in how to acquire data from vehicles? Do you need to know how to formalise your VSF examinations and the acquired data to prepare reports for court and give evidence?
Whether you are an investigator of serious and complex crime, a serious collision investigator, or an insurance investigator of high value claims, Vehicle Systems Forensics may just be the key to unlocking the truth.
The programme is designed to work in conjunction with The Vehicle Network Application, where support and learning is at your fingertips. Module one is held online only via the App and is completed in your own time; modules two (online only option now available), three, four and R are held in person at our training facility in the West Yorkshire region. In person courses are limited to a maximum of six students.
M1
Online only
Vehicle Systems; Planning & Strategies
‘A comprehensive introduction to Vehicle Systems Forensics’
An introductory module looking at the whole Vehicle Eco System, outlining the various systems that can be considered for useful investigative data. Formulate a structured VSF strategy and understand evidential considerations.
Duration
8 hours — self study
Cost
£299 inc VAT
Prerequisites
An interest in Vehicle Systems Forensics
Dates
Flexible — online
The course is held inside The Vehicle Network App and provides lifetime access including updates. Access also triggers the Essential & Community Plan, saving £24.99 per year on continuing education for the first 12 months. A triage area is included as a complementary resource to help with planning — putting resources like the Bosch CDR supported vehicle list all in one place, alongside details of infotainment head units we have non-destructive solutions for outside the currently Berla or Rusolut supported units.
Course content
Introduction
Aims & Objectives
Vehicle Systems Forensics (VSF)
The Vehicle Eco System
Defining Vehicle Systems
Vehicle Apps
Data Types
Connected Car Data
Unique Identifiers
Tools & Techniques
Planning & Strategies
Evidential Considerations
Resources to Aide Strategies
Summary & Close
Equipment needed
A smart device / PC with the Vehicle Network App — course material is provided through this platform.
Who should attend & student feedbackClose course details
By the end of this module
Define the main vehicle systems capable of storing data
Explain how those systems differ in purpose and architecture
Identify common data types available from modern vehicles
Recognise where data may be stored and how it may be accessed
Understand available tools and acquisition approaches
Formulate a structured VSF strategy
Appreciate evidential and integrity considerations
Who should attend
Police officers and staff responsible for Digital Strategies (DMI's), Serious Collision Investigators, Independent Forensic Collision Investigators, Insurance Investigators, Solicitors and barristers dealing with vehicle data in evidence. Appropriate for those new to VSF and for experienced practitioners who want clearer structure, terminology and strategy in their work.
Very useful all-round approach to vehicle forensics. I have previously completed specific VF product training but this module would have been useful to do before that as it deals with the fuller picture of what VF entails.
M2
In person — West Yorkshire / Online option
Vehicle Examinations
‘Become confident with your Vehicle Systems Forensics examinations’
Essential for VSF first responders collecting data from modern vehicles. Physically examine a vehicle, work with vehicle networks on the 'Frankie' rig, and handle electric vehicles safely — with exclusive insights from James Wales, Master Technician & High Voltage Expert at Audi.
Duration
2 days
Cost
£2,000 ex VAT (in person) · £1,000 ex VAT (online only)
Prerequisites
Module 1
Dates
17th & 18th November 2026
Module 2 is now also available as an online only version for those who wish to study in their own time or are unable to travel to the UK on the advertised dates. This does not allow for practical participation and the costs are reduced to reflect this — the online only option can be activated directly in The Vehicle Network App from within the VSF training pathway section (Stage 2).
Course content
Vehicle Systems Forensics – Crime Scene Management
First Responder in Vehicle Data Acquisitions
In-Vehicle Data Acquisitions
CAN Signal Capture
Digital Contemporaneous Note Taking & Documentation
Evidence Handling & Best Practice
Vehicle Networks
Vehicle Systems Forensics Rig – Frankie
Diagnostic Fault Codes and Testing
Vehicle Keys
Handling Electric Vehicles – Awareness & Overview
Physical Examinations – What to record
Tools Required
Trim & Component Removal
Forensic Science Regulators Codes of Practice
Adaptive Task Sequencing
The Vehicle Network – Infotainment video teardowns / UI guides
Case Study – Part 2
Equipment needed
A smart device with a current subscription to The Vehicle Network App (course material provided through this platform). Laptops are provided with appropriate software as and when required. Personal diagnostics equipment can be used on the in person course — contact us to discuss. Some vehicle examinations take place outside, so weather permitting an outdoor jacket may be required.
Who should attend & student feedbackClose course details
Who should attend
Digital first responders responsible for Vehicle Systems Forensics examinations, module retrieval and evidence preservation — those hands on with the modern motor vehicle in their current role or about to be. Roles include DMI's, Crime Scene Investigators, police and staff involved in serious collision investigation, Independent Forensic / Collision Investigators, and Insurance Investigators involving motor vehicles.
M3A
In person — West Yorkshire
Component Examinations
‘Advanced acquisitions — increase your Vehicle Systems Forensics capabilities’
Learn to acquire data from the ECU outside of the vehicle — the bench examination. ISP / direct eMMC reads from infotainment modules, hands on and non-destructive, widening the arena of vehicles you can acquire data from.
Duration
4.5 days
Cost
£4,500 ex VAT
Prerequisites
An awareness of digital forensics principles is useful but not compulsory; attendance on Module 2 is of benefit but not compulsory
Dates
18th - 22nd May 2026
13th - 17th July 2026
5th - 9th October 2026
1st - 5th February 2027
Many of these solutions have been developed through our company's research and development, together with the expertise and knowledge of our trusted associates. Delegates are hands on with infotainment modules, putting theory into practice to acquire data in a non-destructive manner.
Course content
Advanced Vehicle Systems Forensics Acquisitions
ISP / Direct eMMC Reads
Module Disassembly
Infotainment Module Architecture
Data Acquisitions
HDD Imaging / SD Card / Memory Chips
Bench Top Power
Different Chip Types
Demonstration & Overview of Chip Off Process
File Systems – Data Discovery & Reconstruction
Equipment Requirements
Digital Contemporaneous Note Taking & Documentation
Evidence Handling & Best Practice
Vehicle Networks
Vehicle Systems Forensics Rig – Frankie
Equipment needed
A smart device with a current subscription to The Vehicle Network App (course material provided through this platform). Laptops are provided with appropriate software — if you wish to bring your own, contact us to discuss whether you have the required system requirements.
Who should attend & student feedbackClose course details
Who should attend
New and established digital forensics practitioners who wish to increase their knowledge of vehicle component examinations, and VSF examiners who wish to increase their capability of module examinations. Roles include DMI's, Digital Forensics Practitioners, Forensic Collision Investigators, and Insurance Investigators involving motor vehicles.
M3B
In person — West Yorkshire
Chip Off
‘Bespoke automotive chip-off training’
Chip-off taught as a controlled, repeatable acquisition technique — the safe removal of memory chips from automotive ECUs, including telematics and infotainment systems, across a wide range of circuit board sizes and chip types commonly encountered in casework.
Duration
2 days
Cost
£2,000 ex VAT
Prerequisites
Patience and a steady hand
Dates
16th & 17th April 2026
20th & 21st April 2026
13th & 14th May 2026
4th & 5th June 2026
8th & 9th June 2026
1st & 2nd October 2026
18th & 19th February 2027
Chip-off is often a last-resort technique, but the global vehicle population contains a wide, long-tail population of ECUs — many never supported through non-destructive access — and vehicles remain in service far longer than consumer devices, so these ECUs will continue to appear in investigations for years to come. Chip-off remains an essential capability, frequently underestimated by those without practical experience: it requires knowledge, planning and practice to perform safely and consistently. Delegate numbers are strictly limited to one or two participants for close supervision and meaningful time at the bench. The course does not include reading or parsing memory devices once removed — it supports advanced acquisition workflows where physical chip removal is necessary, and commercial vendor tools such as Berla and Rusolut accept chip-off imports. Delivered by Phil Cocking, who brings over 30 years' experience in electronics, soldering and board-level work in digital forensics.
Course content
Core theory and health & safety principles
Solder and flux — how and when to use them, and why different chips and boards require different approaches
Heat control and technique — the direct effect on the risk of damage and data loss
Live demonstration of the full chip-off workflow
Controlled PCB heating and memory device removal
Chip cleaning and preparation
Re-balling where required, and correct re-mounting of the device to the circuit board
Hands-on practice across multiple ECUs and memory types, with time deliberately allocated for repetition
Equipment options — practical guidance on what is suitable for operational use back in the workplace
Equipment needed
Nil — all material and equipment provided.
Who should attend & student feedbackClose course details
Who should attend
Those who wish to learn how to effectively and safely remove chips from printed circuit boards within infotainment modules. Roles include VSF examiners, DMI's, Digital Forensics Practitioners, Forensic Collision Investigators, and Insurance Investigators involving motor vehicles.
M4
In person — West Yorkshire
Data Analysis & Interpretation
‘Become court confident with your Vehicle Systems Forensics reports’
Data recovery is just the beginning — analysing and interpreting the data are equally, if not more, crucial. Understand GPS and speed data limitations, vehicle event data reliability, and prepare robust reports for court proceedings.
Duration
2 days
Cost
£2,000 ex VAT
Prerequisites
None
Dates
11th & 12th May 2026
22nd & 23rd Sept 2026
19th & 20th November 2026
23rd & 24th Feb 2027
Duanne Watkins from JTOL/GeoTime assists in simplifying data analysis by consolidating multiple data sources into a clear investigative picture, and Ray Ford, a leading GPS and Telematics expert, provides insights into GPS technology, its sources and vulnerabilities. Delegates receive real-life examples showcasing the reliability of speed data from various vehicle systems, plus access to in-house research and development results from the past five years on infotainment system event data — which can often not be as it seems. Expert reports authored by the course instructors have been widely used in Vehicle Systems Forensics cases across the UK, benefiting both prosecution and defence teams.
Course content
Data Analysis & Interpretation
Presentation of Data
Understanding GPS & GNSS Technology
GPS & GNSS Vulnerabilities
Limitations of GPS speed data
Limitations of CAN speed data
Vehicle Event Data – Reliability
Report Formulation for Court Proceedings
Prosecution and Defence Perspectives of Vehicle Systems Forensics
The Role of the Expert Witness
Case Studies
Equipment needed
A smart device or desktop with access to The Vehicle Network App (course material provided through this platform).
Who should attend & student feedbackClose course details
Who should attend
Those responsible for receiving data from investigators or third parties and analysing and reporting on it, where the modern motor vehicle is the source of the data. Roles include DMI's, Analysts, Digital Forensics Practitioners, Forensic Collision Investigators, and Insurance Investigators involving motor vehicles.
M5
Online
Workplace Implementation & Support
‘You are not alone — supporting resources via The Vehicle Network App’
Training is just the start of your journey — the real learning takes place back in the workplace. The Vehicle Network App keeps course material at your fingertips, pushes updates as they land, and connects you to a community of investigators worldwide.
Duration
Ongoing support
Cost
Included via The Vehicle Network App
Prerequisites
Attendance on pathway modules
Dates
Flexible — online
Course content
Module 1 support: triage area to help planning of examinations
Module 2 support: infotainment teardown videos and user interface videos — full access to course video presentations
Module 3 support: pinouts for direct eMMC reads, and 'how to' reference videos
Module 4 support: case studies and the GNSS handbook
Continuing education: Essentials & Community Plan
Equipment needed
A smart device or desktop with access to The Vehicle Network App (course material provided through this platform).
Who should attend & student feedbackClose course details
Who should attend
All pathway students. The App is designed so people who share a common interest in vehicle-related investigations can come together in one place, share experiences through a community platform, engage with other investigators globally, and keep in touch with the people you studied with. Updates are pushed to students as we get them — for example, new infotainment teardown videos reach Module 2 students immediately — and direct communication with Harper Shaw staff means issues are resolved expeditiously, wherever we are in the world. If any process from the training modules is adopted in your workplace, support is given to address how the implementation should take place and any associated costs.
MR
In person — West Yorkshire
Reverse Engineering & Automotive Cybersecurity
‘Ethical car hacking to understand and appreciate the need for automotive cybersecurity’
A hands-on introduction to Automotive Cybersecurity and the implications of reverse engineering vehicle systems — CAN bus protocols, attack methods and known exploits, with practical demonstrations. For those already practicing, a chance to gain further experience.
Duration
1 day
Cost
£1,000 ex VAT
Prerequisites
An interest in automotive cybersecurity and ethical hacking
Dates
Fri 11th September 2026
The automotive industry is going through a huge transition, and the technologies being developed on the modern vehicle are at risk of cyber-attack. Whilst the automotive cyber security scene and motor industry work hard to minimise these attacks, they are still prevalent — seen in the ways modern vehicles are sometimes stolen and in responsible disclosures to manufacturers by ethical hackers. The implications of these systems being compromised could result in death or serious injury in investigations to follow, so awareness is important as the scene develops and unfolds.
Course content
What is CAN – CAN Bus Network Communication Protocols
Hardware & Software required for Ethical Hacking
Attack methods – Physical / Back End / Apps
Known exploits of the CAN bus, including real world examples
Reverse Engineering
In-Vehicle Infotainment hack over WiFi or Bluetooth
Practical demonstrations of CAN bus hacks
Equipment needed
Simple CAN hardware is provided. A Linux / Windows device or VM with Python can be used to interact with the CAN hardware — installation of software drivers for the CAN hardware may be required.
Who should attend & student feedbackClose course details
Who should attend
Experienced Vehicle Systems Forensics Investigators and anyone with an interest in Automotive Cyber Security. Roles include staff in cyber security roles with an interest or responsibility for automotives, VSF examiners, DMI's, Digital Forensics Practitioners, Forensic & Serious Collision Investigators, and Insurance Investigators involving motor vehicles.
BL — Specialist course
TPM Sniffing & BitLocker Key Extraction
‘From chip to key: BitLocker decryption via TPM’
Unlock hardware-based encryption in this comprehensive 3 day course for digital forensic and security professionals. Learn to extract BitLocker keys from TPM chips using protocols like SPI and LPC — tap the lines with a logic analyser, capture and decode TPM traffic in real time, extract keys and mount BitLocker-encrypted volumes, and understand how TPM protects those keys and how to bypass that protection in a forensic context.
01 · BitLocker fundamentals02 · Laptop disassembly & component identification03 · Researching TPM (1.2 & 2.0 covered)04 · Logic analysers explained05 · Capture & decode VMK traffic06 · Key extraction with Dislocker07 · How TPM protects keys — and how to bypass that protection in a forensic context
Not one-button forensics — it requires tenacity, patience and an appetite to learn. Our expert instructors bring years of forensic experience to an immersive learning environment, with a strict cap of six participants for personalised attention throughout. The course combines theoretical knowledge with extensive hands-on sessions, so you can immediately apply what you've learned in realistic scenarios. Early booking is recommended, as places are strictly limited to maintain the highest quality learning experience.
Duration
3 days
Cost
£3,000 ex VAT
Delivery
In person — West Yorkshire
2027 dates
13th - 15th April 2026 (Mon - Wed)
22nd - 24th April 2026 (Wed - Fri)
1st - 3rd June 2026 (Mon - Wed)
Who should attend
Digital forensics staff, IT security and compliance specialists, security professionals and penetration testers, ethical hackers and security researchers, investigation professionals — including police officers and staff responsible for digital investigations.
FAQs
Do I need to pay for food / lunches?
No — we are based in Yorkshire, where we have an eyt all, sup all and pay nowt (Eat Everything, Drink Everything and pay nothing) policy for our students.
Can I bring and use my own laptop?
Yes. We provide laptops for all training, but you're welcome to bring your own if you'd rather work in an environment closer to what you use day-to-day.
Do you cover both versions of TPM?
Yes. We have two laptops to train on — one with TPM version 1.2 and the other running 2.0.
Will I need my own logic analyser for the course?
No. All equipment, including a logic analyser, is provided for training. For ongoing use in the workplace you'll need to source your own — you're welcome to bring one if you've already purchased it. We explain what to look for during the course and recommend reliable models and suppliers; if you're thinking of buying in advance, feel free to ask us for recommendations.
Can I pay extra for you to provide me with a logic analyser to take away?
Yes — we have a supply of them, and if you prefer for us to supply one then no problem. Speak to us at time of booking for the additional cost of this service.
Will I need any other equipment or incur extra costs after the course?
Just a logic analyser and a laptop. You might also choose to buy spare laptops to practise on, but that's optional. No other costs or equipment are required.
Is there an exam?
No. There's no final exam. You'll receive a certificate of attendance, and the course is delivered in a practical, no-pressure environment focused on skill-building.
Thanks again for the course the past few days — I don't think I've ever been on a course that has made me that motivated to get back to the office and get cracking.
Thanks for explaining the hardware as you did — I understand this much better and have become more confident with hardware.
Ready to book your place?
2026/27 dates are available for bookings. Places on in person courses are strictly limited — secure yours through the Harper Shaw training booking site, or send us an enquiry.
