Live Digital Forensics Training

The essential foundation for anyone who handles digital evidence. Participants build the sound, court-defensible habits (lawful authority, identification, seizure, chain of custody, hashing, and write-blocking) that every advanced discipline relies on.

Key topics: Legal authority & scope • Identifying digital evidence • Lawful seizure & order of volatility • Chain of custody & hashing • Write-blocking & forensic soundness • Examination workflow & reporting

Who should attend: Investigators and new examiners

Hardware literacy that prevents costly mistakes in the field. Participants learn to recognize storage technologies, understand how and where data is stored, and connect media correctly through a write-blocker.

Key topics: Core components • HDD vs SSD & flash storage • Interfaces & adapters • How data is stored (sectors, clusters, slack) • Write-blocked connections • Recognizing devices at a scene

Who should attend: Field investigators and new examiners

A force multiplier for general field investigators. Trains first responders to recognize, lawfully collect, isolate, and document digital evidence so examiners receive sound, admissible material.

Key topics: First-responder role & do-no-harm • Legal authority & scope • Recognizing evidence sources • Securing & isolating devices • Collection, packaging & labeling • Documentation & chain of custody

Who should attend: General field investigators / first responders

Hands-on forensic imaging done right. Participants acquire verified images from a range of media using hardware and software tools, proving integrity at every step.

Key topics: Acquisition principles & image formats • Hardware & software imaging • Verification & hashing • Difficult acquisitions (SSD, HPA/DCO) • Acquisition documentation • Validated capstone

Who should attend: Examiners

Sound acquisition under time pressure. Covers on-scene triage, volatile and live capture, and the encryption-aware power-state decisions that can make or break a case.

Key topics: Order of volatility • Live & memory capture • On-scene triage methodology • Encryption & power-state decisions • Rapid acquisition • Documentation under pressure

Who should attend: Examiners and responders

From image to insight. Participants examine acquired evidence with leading analysis platforms, recovering files, analyzing user activity, building timelines, and producing defensible reports.

Key topics: Examination workflow • File systems & data recovery • File carving • User-activity artifacts • Keyword, hash & filtering • Timeline analysis & reporting

Who should attend: Examiners

Deep Windows artifact analysis. Reconstruct user and system activity from the registry, event logs, and file-system artifacts to answer the questions a case turns on.

Key topics: NTFS & file-system artifacts • The Windows registry • User-activity artifacts • Program-execution artifacts • Event logs & browser artifacts • Timeline reconstruction & testimony

Who should attend: Experienced examiners

What the disk cannot tell you. Acquire and analyze volatile memory to surface running processes, network connections, injected code, and malware indicators.

Key topics: Memory acquisition • Processes & loaded modules • Network & handle artifacts • Code injection & malware indicators • Strings, keys & credentials • Correlating memory with disk

Who should attend: Advanced examiners

Make video evidence count. Recover, authenticate, and present footage from DVR/CCTV, body and dash cameras, and cloud sources using defensible, reproducible methods.

Key topics: Containers & codecs • DVR/CCTV acquisition • Recovering deleted video • Authentication & integrity • Defensible enhancement • Presentation & reporting

Who should attend: Investigators and examiners

Investigate the drone. Recover and analyze data from unmanned aircraft systems (UAS) and their controllers (flight logs, telemetry, media, and operator identity) to reconstruct missions and attribute activity. A 5-day intensive.

Key topics: UAS components & data sources • Seizing UAS, controllers & batteries • Flight log & telemetry recovery • Onboard & SD-card media • Controller & mobile-app artifacts • Geolocation, flight reconstruction & operator attribution

Who should attend: Examiners and investigators handling drone incidents

Lawfully seize, acquire, and analyze mobile devices to recover communications, location, and application data in a sound, defensible manner.

Key topics: Mobile evidence & lawful seizure • Isolation & power management • Acquisition types • Extraction with mobile suites • Decoding communications & app data • Location & reporting

Who should attend: Examiners and investigators

The hard extractions. Full file-system and physical methods, locked and encrypted devices, manual SQLite and application decoding, and cloud acquisition.

Key topics: Advanced acquisition methods • Locked & encrypted devices • SQLite & app database decoding • Encrypted messaging artifacts • Cloud & account acquisition • Validation & anti-forensics

Who should attend: Experienced mobile examiners

Plan and run lawful, secure open-source investigations with sound attribution management and court-ready evidence capture.

Key topics: Internet fundamentals for investigators • Managed attribution & OPSEC • Advanced search & discovery • Evaluating & verifying information • Capturing & preserving web evidence • Geolocation & media analysis

Who should attend: Investigators and analysts

Turn social media into evidence. Identify and attribute accounts, analyze activity and networks, and lawfully collect and preserve social-media evidence.

Key topics: The social-media landscape • Account identification & attribution • Profile & network analysis • Lawful collection & preservation • Covert engagement & OPSEC • Analysis & reporting

Who should attend: Investigators and analysts

Operate safely in anonymized spaces. Access and investigate dark-web sources, recognize illicit-marketplace indicators, and develop attribution leads while protecting the investigator.

Key topics: Anonymity networks explained • Safe access & OPSEC • Marketplaces, forums & indicators • Searching & mapping hidden services • Collecting & preserving evidence • De-anonymization leads

Who should attend: Investigators

Demystify cryptocurrency for investigators. Understand blockchains, wallets, and transactions well enough to recognize, preserve, and act on crypto evidence.

Key topics: Blockchain basics • Wallets, keys & addresses • Reading transactions • Exchanges, on/off ramps & compliance • Recognizing & seizing crypto evidence

Who should attend: Investigators new to cryptocurrency

Follow the money on-chain. Trace transactions across wallets and services using industry tracing tools, cluster addresses, and convert leads into lawful action.

Key topics: Tracing fundamentals • Address clustering & attribution • Using a tracing platform • Following funds through services • Obfuscation: mixers, bridges & privacy coins • Reporting & visualization

Who should attend: Financial-crime investigators

Respond to the scams hitting your community. Recognize crypto fraud typologies and red flags, capture evidence quickly, and support victims.

Key topics: Scam typologies • Red flags & indicators • Initial response & evidence capture • Victim engagement • Hand-off to tracing & disruption

Who should attend: Investigators and fraud units

A balanced, practical look at AI-enabled threats (deepfakes and synthetic media), the responsible investigative use of AI, and the governance and bias issues leaders must manage.

Key topics: AI foundations for investigators • AI-enabled threats • AI as an investigative aid • Detecting synthetic media • Governance, bias & accountability

Who should attend: Investigators, analysts, supervisors

How threat actors use technology: online radicalization and recruitment, digital financing, operational use of technology, and how investigators detect and disrupt it.

Key topics: The cyber-enabled threat landscape • Online radicalization & recruitment • Digital-age financing • Planning, coordination & attack use • Detection, disruption & coordination

Who should attend: Counterterrorism investigators and analysts

A practical introduction to electronic discovery, from legal hold to production. Participants learn how electronically stored information (ESI) is identified, preserved, collected, processed, reviewed, and produced defensibly, and how investigators, IT, and counsel work together. A 1-day workshop.

Key topics: ESI & FRCP Rule 34 • Litigation holds & Rule 37(e) • Defensible collection vs self-collection • Metadata, processing & TAR • Privilege & Rule 502 clawback • Production formats & proportionality

Who should attend: Investigators, examiners, litigation-support staff, and counsel

Become a credible, effective expert witness. Participants learn to write defensible reports, qualify as an expert, present technical findings clearly, and hold up under cross-examination, with courtroom simulation and feedback. A 2-day course.

Key topics: FRE 702/703/705 & the Daubert trilogy • Writing the defensible report • Qualification & voir dire • Direct examination for juries • Surviving cross-examination • Full moot-court simulation

Who should attend: Examiners, analysts, and investigators who testify

Digital evidence for the bench. A peer workshop helping judges evaluate admissibility, authentication, reliability, and chain of custody for digital evidence, with practical ruling scenarios.

Key topics: Digital evidence for the bench • Legal framework • Authentication, reliability & chain of custody • Common challenges & pitfalls • Ruling scenarios

Who should attend: Judges and judicial officers

Win the digital case. Equips prosecutors to frame charges, work with examiners, lay foundation, qualify experts, and present digital exhibits effectively.

Key topics: Digital evidence & the charging decision • Working with examiners & reports • Foundation, authentication & admissibility • Qualifying & examining the expert • Presenting digital exhibits

Who should attend: Prosecutors

From raw information to actionable leads. Build, evaluate, and analyze information from human, open, and record sources, including link analysis and lead development.

Key topics: The investigative information cycle • Sources & source development • Information evaluation • Link & association analysis • Developing leads & hypotheses • Protecting information & sources

Who should attend: Investigators and analysts

Never lose a lead. Disciplined registration, case-file construction, secure storage, retrieval, deconfliction, and lawful sharing of investigative information.

Key topics: Registration & logging • Case-file construction & standards • Storage, security & access control • Retrieval, cross-matching & deconfliction • Records, retention & disposal • Lawful sharing

Who should attend: Investigators and records personnel

Run the major-incident investigation. Secure and document the scene, manage evidence, and drive the investigation from response to case-building with a structured methodology.

Key topics: Incident types & dynamics • Scene security & documentation • Evidence identification & management • Witness & victim management • Investigative planning • Forensic & inter-agency integration

Who should attend: Investigators

Lawful, effective, evidence-based interviewing. A rapport-based, rights-compliant program built on the proven PEACE model, with recorded role-play practice.

Key topics: Principles of ethical interviewing • Legal framework & rights • Interview planning • Rapport, communication & questioning • Account development & probing • Recorded interview practical

Who should attend: Investigators

Understand and disrupt the network. Analyze terrorist organizations (structure, financing, and networks) and apply rights-based investigative and disruption strategies.

Key topics: Threat, ideologies & context • Organizational structures • Radicalization & recruitment • Terrorist financing • Network & link analysis • Investigative & disruption strategies

Who should attend: Counterterrorism investigators and analysts

Lead the complex investigation. Command structure, strategy and decision logging, tasking, information flow, resources, and inter-agency coordination.

Key topics: Command, control & structure • Investigative strategy & decision logging • Tasking & action management • Information & intelligence flow • Resource & personnel management • Risk, review & lessons learned

Who should attend: Investigation managers and team leaders

Strategy for senior leaders. A seminar on building counterterrorism capability, prevention and community partnerships, rights-based accountability, and crisis leadership.

Key topics: The strategic threat picture • The leader's role • Building & sustaining capability • Prevention, partnerships & trust • Oversight, integrity & accountability • Crisis leadership & communications

Who should attend: Senior police leaders