Online Course 35/2021: Digital Forensic Investigator Training

Status message

Active context: context_uid_training_courses
Digital Forensic Investigator Training
20 September 2021 to 15 October 2021
CEPOL in cooperation with Europol & ECTEG

The aim of the activity is to provide participants with an introduction to Open Source Digital forensics software, file systems, data carving, evidential digital artefacts, computer forensic strategies and data forensics. It also aims to disseminate the latest investigation techniques and methods and to promote the mutual sharing of experience.

The learning strategy is focused to support the participants to achieve the learning outcomes by following a learner-centred approach and interactive, participatory, practical and experiential principles in accordance with andragogic theory.

The activity involves didactic learning through presentations by subject matter experts and experiential learning by providing practical exercises. Live sessions will be included and compulsory to allow live interaction with experts but also with other students.

After each topic, the participants will have to complete an assignment that will allow him/her progress into the course and attend the mandatory live session. A summative assessment will be conducted by the participants at the end of the activity in form of online feedback, which is a condition for receiving the Attendance Certificate. The outcomes will feed into a Trainers’ Report, which will be used for quality enhancement of the activity in future.

After completion of the training activity, the participant will be able to:

1. Explain and apply the rules of forensics and reporting
2. Understand computer data representation and convert values between the binary, hexadecimal and decimal notations
3. Use a forensic distribution of the Linux operating system for basic tasks
4. Acquire and access forensically digital evidence
a. Plan portioning, create and format partitions
b. Use Imaging and Hashing
c. Forensically mount acquired images
5. Analyse exFAT and NTFS file systems and interpret related metadata
6. Recover deleted files and apply basic file carving tasks
7. Recover and interpret basic MS Windows forensic artifacts (registry, browser cookies and history, explore SQLite databases
8. Filter large text files like log files using basic regular expressions
9. Solve an integrated exercise applying forensics strategies and the knowledge acquired during the course.
10. Adapt his/her digital forensic tools use accordingly the acquired principle once agreed by line management.

The course will be delivered online over a period of 4 weeks, between 20 September - 15 October 2021. Participants are expected to study around 20 hours per week, including practical exercises and live sessions.

A computer with full admin access is required to do the practical exercises assigned during the course. A Linux Distro will be provided by CEPOL and ECTEG before the course and requires 8GB ram and 500 GB HDD/SSD, a USB2 port and a network interface.

The course will be held entirely in English, therefore it is essential that nominated officials possess appropriate language skills (at least B2 level). The entire activity will be carried out online on CEPOL’s Law Enforcement Education Platform (LEEd), hence the physical presence of participants will not be required.


In case you are interested to attend, please contact your local CEPOL National Unit / CEPOL National Contact Point as soon as possible. Deadline for nominations by CEPOL National Units: 20 August 2021.

Selected participants have to be registered to CEPOL's online Law Enforcement Education platform LEEd where the online activity will take the place.

Target Audience: 

Law enforcement officials with experience in high-tech crime investigations or who are about to be appointed as network investigators or IT forensic analysts.

This is considered a basic level course.

Virtual, accesible through CEPOL's eLearning platform LEEd (after approved registration)


Office address

European Union Agency for Law Enforcement Training
1066 Budapest
Ó utca 27

Correspondence address

European Union Agency for Law Enforcement Training
1903 Budapest

Email address

Telephone: +36 1 803 8030/8031

Fax: +36 1 803 8032