Courses by Description

Cyber Investigation 100 - Identifying and Seizing Electronic Evidence (ISEE)
This course is designed to instruct participants in the basics of recognizing potential sources of electronic evidence, preparing them to respond to an electronic crime scene, and to safely and methodically preserve and collect items of evidentiary value to be used in court proceedings. This particular course utilizes advanced adult learning skills and takes the participants through a process and methodology that can be presented either in a basic recruit academy atmosphere or an in-service training situation.

Cyber Investigation 101 - Secure Techniques for Onsite Preview (STOP)

This 2 day course is intended for probation/parole, detectives and officers conducting “knock and talk” interviews or spot checks and home visits. This class utilizes a Linux-based bootable CD to preview a suspect computer system for potential evidence in a forensically sound manner. The CD has the advantage of being able to “read” other computer system’s files without writing to or altering the data on those systems.

Cyber Investigation 105 - Basic Cell Phone Investigations (BCPI)
Cyber-Investigation 105 – Basic Cell Phone Investigations (BCPI) This 2-day course is for officers, investigators, and analysts that encounter cell phone evidence, and includes the acquisition and analysis of information external to the phone, specifically Call Detail Records. This course concentrates heavily on document analysis, in which a strong working knowledge of Microsoft Office® is preferred. This course also has a companion course, Cyber-Investigation 205 – Small Scale Digital Device Interrogation, which focuses on the obtainable data internal to the device itself.

Cyber Investigation 201 - Basic On-Line Technical Skills (BOTS)
Designed for the officer who is new to on-line investigations. The course will teach the basic technical skills and considerations involved in setting up an under-cover account, and techniques for both proactive and reactive online investigations. The student will learn how to document and trace real-time chats, instant messaging, and other on-line evidence.

Cyber-Investigation 205 - Cell Phone & Small Scale Digital Device Interrogation (CPSSDD)
Cyber-Investigation 205 – Small Scale Digital Device Interrogation (SSDDI) This 3-day course trains officers and investigators in the acquisition and analysis of information internal to cell phones and GPS devices. This course focuses heavily on cell phones, and allows the student hands-on time with several of the popular cell phone extraction tools available on the market. This course is the companion course to Cyber-Investigation 105 – Basic Cell Phone Investigations, which covers the information obtainable external to the phone (such as call detail records).

Cybercop 101 - Basic Data Recovery and Acquisition (BDRA)
Through a series of classroom presentations and hands-on reinforcement, participants will learn how a computer works, how data is stored and how to obtain a forensically sound image. This course provides attendees the knowledge and skills to successfully demonstrate their ability in protecting and preserving electronic evidence. Participants will use this class as a prerequisite to continue their professional development and to assist in the investigation and prosecution of cyber crime cases.

Cybercop 201 - Intermediate Data Recovery and Analysis (IDRA)

This 5-day course is designed to be the “sequel” to the Cybercop 101 (BDRA) course.

Cybercop 305 - Windows NT File System (NTFS)
This 4 day class introduces the experienced examiner to a “behind the scenes” approach to the NT file system. Students will explore the components of the file system (master file table), the concepts of the file system (resident vs non resident data), and the processing of the data tracked by the file system (saving, deleting, recycling, encrypting).

Cybercop 310 - Windows NT Operating System (NTOS)
This 4 day class introduces the experienced examiner to the Windows XP, Vista, and Windows 7 operating systems. Registry components and forensically relevant information they contain are emphasized throughout this course. Students will also examine the operating system’s security structures and volume shadow copy service.

Cybercop 320 - Windows Internet Trace Evidence (INET)
This 3 1/2 day course is designed to teach the recovery of “trace evidence” left on a computer system as a result of using the Internet.

Cybercop 401 - Linux File System for Computer Forensic Examiners (LinuxFS)

This 4 1/2 day class is designed for experienced computer forensic examiners who want to gain a better understanding of the unique issues related to Linux based computers. The class will emphasize the native Linux file systems (ext2, ext3 and Reiser), interpreting command shell histories, and the location of evidence on a Linux machine.

Fast CyberForensic Triage (FCT)
This 3-day course will introduce investigators and first responders to the process known as Fast CyberForensic Triage. Fast forensics is defined as “those investigative processes that are conducted within the first few hours of an investigation, that provides information used during the suspect interview phase. Due to the need for information to be obtained in a relatively short time frame, fast forensics usually involves an on site/field analysis of the computer system in question.”

ICAC - Cyber Investigation 100 - Identifying and Seizing Electronic Evidence (ICAC-ISEE)
This course is designed to instruct participants in the basics of recognizing potential sources of electronic evidence, preparing them to respond to an electronic crime scene, and to safely and methodically preserve and collect items of evidentiary value to be used in court proceedings. This particular course utilizes advanced adult learning skills and takes the participants through a process and methodology that can be presented either in a basic recruit academy atmosphere or an in-service training situation.

ICAC - Cyber Investigation 105 - Basic Cell Phone Investigations (ICAC-BCPI)
Cyber-Investigation 105 – Basic Cell Phone Investigations (BCPI) This 2 day course is designed as a basic introduction for officers, investigators, and analysts looking to initiate or follow up on cell phone related cases. It is based around the acquisition and analysis of information external to the phone, particularly Call Detail Records. This course focuses heavily on analysis; a working knowledge of Microsoft Office® is highly recommended.

ICAC - Cyber-Investigation 101 - Secure Techniques for Onsite Preview (ICAC-STOP)

This 2 day course is intended for probation/parole, detectives and officers conducting “knock and talk” interviews or spot checks and home visits. This class utilizes a Linux-based bootable CD to preview a suspect computer system for potential evidence in a forensically sound manner. The CD has the advantage of being able to “read” other computer system’s files without writing to or altering the data on those systems.

ICAC - Cyber-Investigation 250 - Identifying & Seizing Electronic Evidence - Train the Trainer (ICAC-ISEE-T3)
ISEE-T3 is an Instructor Development Project (IDP) course. In a T3 course, participants are trained to instruct the ISEE course. After completing the course, they are supplied with all of the course materials that will allow them to instruct the course on their own, with support from NW3C. The course is designed to be instructed by non-technical instructors. Instructors with varying investigative backgrounds will be able to grasp the concepts and materials necessary to instruct the course.

ICAC - Cybercop 101 - Basic Data Recovery & Acquisition (ICAC-BDRA)
Through a series of classroom presentations and hands-on reinforcement, participants will learn how a computer works, how data is stored and how to obtain a forensically sound image. This course provides attendees the knowledge and skills to successfully demonstrate their ability in protecting and preserving electronic evidence. Participants will use this class as a prerequisite to continue their professional development and to assist in the investigation and prosecution of cyber crime cases.

ICAC - Cybercop 201 - Intermediate Data Recovery and Analysis (ICAC-IDRA)

This 5-day course is designed to be the “sequel” to the Cybercop 101 (BDRA) course.

ICAC - Cybercop 305 - Windows NT File System (ICAC-NTFS)
This 4 day class introduces the experienced examiner to a “behind the scenes” approach to the NT file system. Students will explore the components of the file system (master file table), the concepts of the file system (resident vs non resident data), and the processing of the data tracked by the file system (saving, deleting, recycling, encrypting).

ICAC - Cybercop 310 - Windows NT Operating System (ICAC-NTOS)
This 4 day class introduces the experienced examiner to the Windows XP, Vista, and Windows 7 operating systems. Registry components and forensically relevant information they contain are emphasized throughout this course. Students will also examine the operating system’s security structures and volume shadow copy service.

ICAC - Cybercop 320 - Windows Internet Trace Evidence (ICAC-INET)
This 3 1/2 day course is designed to teach the recovery of “trace evidence” left on a computer system as a result of using the Internet.

ICAC - Cybercop 401 - Linux File System for Computer Forensic Examiners (ICAC-Linux FS)

This 4 1/2 day class is designed for experienced computer forensic examiners who want to gain a better understanding of the unique issues related to Linux based computers. The class will emphasize the native Linux file systems (ext2, ext3 and Reiser), interpreting command shell histories, and the location of evidence on a Linux machine.

Introduction to Securing Law Enforcement Networks (ISLEN)
This 3-day course is designed for smaller departments to assist in the securing of their networks. The course helps network administrators/officers by providing tips and techniques for securing their network and covers items such as host-based security, physical security, LAN-based security, and perimeter security.

Financial Crimes Against Seniors (FCAS)
This 3-day training in Financial Crimes Against Seniors includes tools and techniques for investigating crimes involving this rapidly increasing victim group. The course also discusses the importance of a multi-agency approach to these crimes and we encourage Adult Protective Service investigators to attend the class.

Financial Investigations Practical Skills (FIPS)
This 4 1/2 day training will benefit investigators, auditors, prosecutors, paralegals, financial analysts, and regulatory personnel who are learning the fundamentals of conducting successful financial crime investigations. During the course, participants will apply the concepts learned throughout the week to a complex financial investigation from discovery to prosecution.

Financial Records Examination and Analysis (FREA)
Financial records are a large part of nearly all financial crime investigations. This 4 1/2 day course provides participants with the skills necessary to organize, analyze, and present the evidence and indicators of fraud found in various financial records. Investigators, Analysts, Auditors, Regulators, Prosecutors and other law enforcement professionals will benefit from the hands-on approach offered in this course. Participants will discuss the indicators of fraud in various financial records and utilize a computer and software to assist in the analysis of financial records.

Identity Theft Investigations (IDTI)

Identity theft exists in every strata of crime, from individual street crimes, such as purse snatching & mailbox robberies, to highly complex and organized criminal enterprises.

This 3-day introductory level course is intended for law enforcement, criminal intelligence analysts, and prosecutors who may be involved with identity theft cases. This training increases the student’s awareness of the “bigger picture” of identity theft. Students learn to recognize identity theft indicators and the potential nexus to terrorism and larger-scale criminal activity. The training promotes multi-agency & private-sector collaborations and teaches investigative best practices that lead to successful prosecutions.

White Collar Crime and Terrorism (WCCAT)
Over the recent past, a link has been developed between white collar crime and terrorism. Terrorist organizations are committing white collar crimes to finance their endeavors. This 3 day intermediate course was designed to give state and local officers, investigators, analysts, and prosecutors an overview of domestic and international terrorism and the crimes that are typically committed by these organizations including identity theft, money laundering, securities fraud, and RICO.

Advanced Criminal Intelligence Analysis to Prevent Terrorism (ACIAPT)

This 5-day training is for law enforcement personnel who have successfully completed a basic intelligence analysis training.

Law enforcement intelligence for counterterrorism requires a more strategic or predictive approach to deal with both domestic and international terrorist threats. This training helps law enforcement analysts become aware of intelligence processes used in the national security arena, and law enforcement’s role in the intelligence community. This course has been certified by the Federal Emergency Management Agency, National Preparedness Directorate, National Intergration Center, Training and Exercise Integration's Training Operations as course number AWR-158.

Analyst's Notebook® version 8 (i2)
i2's Analyst's Notebook 8 is an introductory course that lays the foundations of the software capabilities and gives the user the skills to create basic link and timeline charts, allowing investigators and analysts to bring clarity to complex investigations.

Foundations of Intelligence Analysis Training (FIAT)
The FIAT course is designed for state, local, and federal law enforcement, regulatory and other appropriate agency personnel who need training in basic criminal intelligence analysis principles and methods. The 5-day course is structured to meet the standards set forth by the National Criminal Intelligence Sharing Plan, and the DHS/FEMA Training and Exercise Integration Secretariat (TEI) for a basic criminal intelligence analysis course. The course is a mixture of lectures, discussions, and individual and group activities to give participants an understanding of analytic thinking skills and methods required for effective intelligence analysis. This course has been certified by the Federal Emergency Management Agency, National Preparedness Directorate, National Integration Center, Training and Exercise Integration’s Training Operations as course number AWR-204.

Economic Crime Foundation Series (ECFS)
NW3C's first complete Online Distance Learning Program, The Economic Crime Foundation Series (ECFS), consists of five self-paced introductory level courses: Introduction to White Collar Crime, Elder Fraud, Identity Theft, Disaster Fraud, and Money Laundering.

This course can be accessed only through the secure members website: https://members.nw3c.org. This series is located under the Resources section of the website. If your agency is a member and you do not have a user name and password please see your agency representative.

Cyber Investigation 250 - Instructor Development Program (ISEE-T3)
ISEE-T3 is an Instructor Development Project (IDP) course. In a T3 course, participants are trained to instruct the ISEE course. After completing the course, they are supplied with all of the course materials that will allow them to instruct the course on their own, with support from NW3C. The course is designed to be instructed by non-technical instructors. Instructors with varying investigative backgrounds will be able to grasp the concepts and materials necessary to instruct the course.

Cyber-Investigation 260 - Secure Techniques for Onsite Preview (STOP-T3)
STOP-T3 is an Instructor Development Project (IDP) course. In a T3 course, participants are trained to instruct the STOP course. After completing the course, they are supplied with all of the course materials that will allow them to instruct the course on their own, with support from NW3C. The course is designed to be instructed by non-technical instructors. Instructors with varying investigative backgrounds will be able to grasp the concepts and materials necessary to instruct the course.