Training Delivery - Online Training

This training will help investigators with the essential skills they need to obtain electronic evidence internationally. It will cover some foundational concepts about gathering information online, examine the different types of data service providers may have, and review the methods available to law enforcement for preserving and obtaining electronic evidence.

This online course introduces the dark web and some of the most popular tools to access the darknet, including Tor, Freenet, and Invisible Internet Project (I2P). Basic topics include what Tor is, how it works, and who uses it; as well as dark markets in Tor Onion Service Servers (also known as .onion servers) and other hidden services. The course concludes with brief case studies covering some of the largest dark-market seizures in history.

This course provides information on what constitutes cyberstalking in a legal context and information on handling cyberstalking complaints. Common elements of cyberstalking cases, potential tools and platforms used by cyberstalkers, and behavioral indicators are also covered in this course. Developed with a victim-centered approach, this course provides information on establishing a relationship with victims to maximize their safety and further investigative efforts.

This course introduces learners to the colloquially used term, deepfakes, and the technology that makes synthetic media possible.

This interactive online module provides an overview of how ransomware can affect devices and networks, how to recognize and respond to a ransomware attack, and how to prevent ransomware attacks.

With the rise of electronic evidence and the likelihood that the crimes you are investigating are conducted with or supported by the use of mobile devices, the Internet, or cloud-based applications, preservation letters provide a means to prevent the destruction of electronic records and buy an investigator time to retrieve and analyze potential evidence. This course focuses on the basics of preservation letters - what they are, their purpose, language to include, how to locate contact information, and how to submit them.

This course covers basic information and concepts that serve as an introduction to virtual currencies and their relationship to other types of currency. It covers various types of virtual currency, including the difference between decentralized and centralized currencies, with a strong focus on Bitcoin: what it is, how it is stored, and Bitcoin-specific investigative tips and techniques.

This course provides an overview of the two phases of a cell phone investigation: the preservation, extraction, and analysis of data within the phone; and the acquisition and analysis of data external to the phone (call detail records and other information). Students become familiar with several forensic tools currently in use in the field, as well as NW3Cs PerpHound, a specialized tool that assists in plotting historical cell site locations. Other topics include cell phone components, cellular network components, and mobile device identification.

This course introduces learners to the concept of digital footprints and best practices in protecting personally identifiable information (PII). Topics include limiting an individuals digital footprint, protecting privacy on social media, opting out of data aggregator sites, and the consequences of oversharing personal information; as well as steps to take after becoming a target of doxing.

Identifying and Seizing Digital Evidence provides a comprehensive overview of the issues surrounding digital media in relation to criminal investigations. Topics covered in this training included preparing to respond to the digital crime scene, identifying potential sources of digital evidence, and properly collecting items of evidentiary value to be used in court proceedings. The roles of the first responder, investigator, digital forensic examiner, prosecutor, and defense counsel are differentiated and explored. Legal concerns in conducting a search for digital evidence are also addressed.