The NHSCFA Digital Forensics Unit (DFU)
The NHS Counter Fraud Authority’s Digital Forensics Unit (DFU) helps investigate fraud across the NHS by providing expert digital forensics services. The DFU secures and analyses digital evidence related to suspected fraud, bribery and corruption to support investigations, criminal and civil legal proceedings, recovery of NHS funds lost to fraud, disciplinary and regulatory action.
About the DFU
The Digital Forensics Unit offers specialist digital forensics services to investigators working in, or for, NHS organisations and the Department of Health and Social Care.
Digital forensics is a branch of forensic science that identifies, recovers, preserves, examines and analyses material from digital devices, networks and cloud storage.
The DFU provides specialist digital forensic support for authorised investigations. This may include device, cloud, NHSmail and Microsoft 365 data capture, evidence review, reporting, and advice to investigators.
Not all services will be available in every case. Availability will depend on the request, legal authority, technical feasibility, permissions, credentials, DFU scope, accreditation scope and capacity.
Digital evidence
The majority of criminal offences now leave a digital footprint and evidence obtained from digital devices is often key to successful investigations and prosecutions.
Digital evidence sources require specialist handling to ensure that relevant evidence is located, extracted, preserved and presented in a way that –
- prevents it from being altered or deleted
- renders it admissible in court proceedings
- can be examined by defence experts if required
Combining digital forensic expertise with investigative experience, the DFU team uses specialist software, scientific methods and investigative techniques to uncover important evidence hidden in large amounts of digital data. The team’s knowledge of applicable legislation ensures lawful, clear digital investigative strategies and reliable analytical methods are used to help investigators to build fair, lawful and evidence-led cases.
Sources of digital evidence
Digital evidence can come from many different sources. Below are some common examples and how they can help in a fraud investigation.
| Source | Relevance to digital investigations |
|---|---|
| Laptops and computers | May contain emails, documents, browsing history, and saved files. |
| USBs and external hard drives | Often used to store or transfer files. |
| Cloud storage services | Can hold backups, documents, and deleted files. |
| Email accounts | Can confirm content of communication and attachments. |
| Application data | Shows how apps were used, including financial or chat logs from messaging apps. |
| Finance records | Can help identify suspicious transactions or patterns. |
| Access logs | Show who accessed systems, when, and from where. |
| Search history | May reveal intent, interests, or attempts to hide activity. |
| Mobile phones | Can include call logs, messages, app data, and location history. |
The amount of data stored on devices continues to grow as technical capabilities improve. It is common for the DFU to deal with terabytes of data in a single case. Instead of searching through all the data manually, the DFU uses powerful specialist software to process and organise the data first.
Working with investigators to develop a strategy to identify relevant data, the DFU shares the results with the investigator who can then identify and tag items for review as part of the investigation.
Accreditation and regulation
As a forensics unit, when working on criminal investigations and prosecutions in the Criminal Justice System in England and Wales, the DFU is required to be accredited by the UK Accreditation Service.
The DFU is a UKAS accredited testing laboratory No. 9707. UKAS accreditation applies only to activities listed on the DFU’s current UKAS schedule of accreditation. Some DFU activities may fall outside the UKAS accredited scope and shall be identified where relevant.
The current schedule can be found on the UKAS website.
Accreditation enables laboratories, including digital forensics laboratories, to demonstrate that they operate competently and generate valid results, thereby promoting confidence in their work.
Forensic units in England and Wales are also subject to regulation by the Forensic Science Regulator, a statutory body set up under the Forensic Science Regulator Act 2021.
The Forensic Science Regulator’s purpose is to set and enforce quality standards for forensic science activities in England and Wales, through its statutory Code of Practice. It can issue guidance, investigate, and take enforcement action where needed, helping ensure forensic work used in the criminal justice system is reliable and properly controlled.