31 Courses Across 8 Disciplines

The essential foundation for anyone who handles digital evidence. Participants build the sound, court-defensible habits (lawful authority, identification, seizure, chain of custody, hashing, and write-blocking) that every advanced discipline relies on.

Who should attend: Investigators and new examiners

Hardware literacy that prevents costly mistakes in the field. Participants learn to recognize storage technologies, understand how and where data is stored, and connect media correctly through a write-blocker.

Who should attend: Field investigators and new examiners

A force multiplier for general field investigators. Trains first responders to recognize, lawfully collect, isolate, and document digital evidence so examiners receive sound, admissible material.

Who should attend: General field investigators / first responders

Hands-on forensic imaging done right. Participants acquire verified images from a range of media using hardware and software tools, proving integrity at every step.

Who should attend: Examiners

Sound acquisition under time pressure. Covers on-scene triage, volatile and live capture, and the encryption-aware power-state decisions that can make or break a case.

Who should attend: Examiners and responders

From image to insight. Participants examine acquired evidence with leading analysis platforms, recovering files, analyzing user activity, building timelines, and producing defensible reports.

Who should attend: Examiners

Deep Windows artifact analysis. Reconstruct user and system activity from the registry, event logs, and file-system artifacts to answer the questions a case turns on.

Who should attend: Experienced examiners

What the disk cannot tell you. Acquire and analyze volatile memory to surface running processes, network connections, injected code, and malware indicators.

Who should attend: Advanced examiners

Make video evidence count. Recover, authenticate, and present footage from DVR/CCTV, body and dash cameras, and cloud sources using defensible, reproducible methods.

Who should attend: Investigators and examiners

Investigate the drone. Recover and analyze data from unmanned aircraft systems (UAS) and their controllers (flight logs, telemetry, media, and operator identity) to reconstruct missions and attribute activity. A 5-day intensive.

Who should attend: Examiners and investigators handling drone incidents

Lawfully seize, acquire, and analyze mobile devices to recover communications, location, and application data in a sound, defensible manner.

Who should attend: Examiners and investigators

The hard extractions. Full file-system and physical methods, locked and encrypted devices, manual SQLite and application decoding, and cloud acquisition.

Who should attend: Experienced mobile examiners

Plan and run lawful, secure open-source investigations with sound attribution management and court-ready evidence capture.

Who should attend: Investigators and analysts

Turn social media into evidence. Identify and attribute accounts, analyze activity and networks, and lawfully collect and preserve social-media evidence.

Who should attend: Investigators and analysts

Operate safely in anonymized spaces. Access and investigate dark-web sources, recognize illicit-marketplace indicators, and develop attribution leads while protecting the investigator.

Who should attend: Investigators

Demystify cryptocurrency for investigators. Understand blockchains, wallets, and transactions well enough to recognize, preserve, and act on crypto evidence.

Who should attend: Investigators new to cryptocurrency

Follow the money on-chain. Trace transactions across wallets and services using industry tracing tools, cluster addresses, and convert leads into lawful action.

Who should attend: Financial-crime investigators

Respond to the scams hitting your community. Recognize crypto fraud typologies and red flags, capture evidence quickly, and support victims.

Who should attend: Investigators and fraud units

A balanced, practical look at AI-enabled threats (deepfakes and synthetic media), the responsible investigative use of AI, and the governance and bias issues leaders must manage.

Who should attend: Investigators, analysts, supervisors

How threat actors use technology: online radicalization and recruitment, digital financing, operational use of technology, and how investigators detect and disrupt it.

Who should attend: Counterterrorism investigators and analysts

A practical introduction to electronic discovery, from legal hold to production. Participants learn how electronically stored information (ESI) is identified, preserved, collected, processed, reviewed, and produced defensibly, and how investigators, IT, and counsel work together. A 1-day workshop.

Who should attend: Investigators, examiners, litigation-support staff, and counsel

Become a credible, effective expert witness. Participants learn to write defensible reports, qualify as an expert, present technical findings clearly, and hold up under cross-examination, with courtroom simulation and feedback. A 2-day course.

Who should attend: Examiners, analysts, and investigators who testify

Digital evidence for the bench. A peer workshop helping judges evaluate admissibility, authentication, reliability, and chain of custody for digital evidence, with practical ruling scenarios.

Who should attend: Judges and judicial officers

Win the digital case. Equips prosecutors to frame charges, work with examiners, lay foundation, qualify experts, and present digital exhibits effectively.

Who should attend: Prosecutors

From raw information to actionable leads. Build, evaluate, and analyze information from human, open, and record sources, including link analysis and lead development.

Who should attend: Investigators and analysts

Never lose a lead. Disciplined registration, case-file construction, secure storage, retrieval, deconfliction, and lawful sharing of investigative information.

Who should attend: Investigators and records personnel

Run the major-incident investigation. Secure and document the scene, manage evidence, and drive the investigation from response to case-building with a structured methodology.

Who should attend: Investigators

Lawful, effective, evidence-based interviewing. A rapport-based, rights-compliant program built on the proven PEACE model, with recorded role-play practice.

Who should attend: Investigators

Understand and disrupt the network. Analyze terrorist organizations (structure, financing, and networks) and apply rights-based investigative and disruption strategies.

Who should attend: Counterterrorism investigators and analysts

Lead the complex investigation. Command structure, strategy and decision logging, tasking, information flow, resources, and inter-agency coordination.

Who should attend: Investigation managers and team leaders

Strategy for senior leaders. A seminar on building counterterrorism capability, prevention and community partnerships, rights-based accountability, and crisis leadership.

Who should attend: Senior police leaders