Courses by Description

Cyber Investigation 100 - Identifying and Seizing Electronic Evidence (ISEE)
This course is designed to instruct participants in the basics of recognizing potential sources of electronic evidence, preparing them to respond to an electronic crime scene, and to safely and methodically preserve and collect items of evidentiary value to be used in court proceedings. This particular course utilizes advanced adult learning skills and takes the participants through a process and methodology that can be presented either in a basic recruit academy atmosphere or an in-service training situation.

Cyber Investigation 101 - Secure Techniques for Onsite Preview (STOP)

This 2 day course is intended for probation/parole, detectives and officers conducting “knock and talk” interviews or spot checks and home visits. This class utilizes a Linux-based bootable CD to preview a suspect computer system for potential evidence in a forensically sound manner. The CD has the advantage of being able to “read” other computer system’s files without writing to or altering the data on those systems.

Cyber Investigation 101 - Secure Techniques for Onsite Preview (STOP) - FT (STOP - One day)
This 1-day, delivered as part of a Fast Track, course is intended for probation/parole, detectives and officers conducting “knock and talk” interviews or spot checks and home visits. This class utilizes the TUX4N6™ digital triage program to preview a suspect computer system for potential evidence in a forensically sound manner.

Cyber Investigation 105 - Basic Cell Phone Investigations (BCPI)
This 2-day course is for officers, investigators, and analysts that encounter cell phone evidence, and includes the acquisition and analysis of information external to the phone, specifically Call Detail Records. This course concentrates heavily on document analysis, in which a strong working knowledge of Microsoft Office® is preferred. This course also has a companion course, Cyber-Investigation 205 – Cell Phone Interrogation (CPI), which focuses on the obtainable data internal to the device itself.

Cyber Investigation 201 - Basic On-Line Technical Skills (BOTS)
Designed for the officer who is new to on-line investigations. The course will teach the basic technical skills and considerations involved in setting up an under-cover account, and techniques for both proactive and reactive online investigations. The student will learn how to document and trace real-time chats, instant messaging, and other on-line evidence.

Cyber-Investigation 205 - Cell Phone Interrogation (CPI)
This 2-day course trains officers and investigators in the acquisition and analysis of information internal to cell phones. Attendees are given significant hands-on time with some of the most popular cell phone extraction tools available on the market today. This is the companion course to Cyber-Investigation 105 – Basic Cell Phone Investigations, which covers obtainable information external to the phone (such as call detail records).

Cyber-Investigation 210 GPS Interrogation (GPSI)
This one-day course is designed to familiarize attendees with the vast amount of location information present on GPS devices. Through a series of presentations and hands-on exercises, attendees will acquire the knowledge and skills necessary to extract and analyze data associated with GPS-enabled technologies, including portable and marine navigation units.

Cyber-Investigation 220 - Wireless Network Investigation (WNI)
This 3 day course focuses on techniques and methodologies used in documenting and seizing network-based digital evidence from scenes utilizing 802.11 wireless network equipment.  Students will be taught the standards and best practices for investigating, documenting, and seizing a wireless network. 

Cybercop 101 - Basic Data Recovery and Acquisition (BDRA)
Through a series of classroom presentations and hands-on reinforcement, participants will learn how a computer works, how data is stored and how to obtain a forensically sound image. This course provides attendees the knowledge and skills to successfully demonstrate their ability in protecting and preserving electronic evidence. Participants will use this class as a prerequisite to continue their professional development and to assist in the investigation and prosecution of cyber crime cases.

Cybercop 201 - Intermediate Data Recovery and Analysis (IDRA)

This 5-day course is designed to be the “sequel” to the Cybercop 101 (BDRA) course. It covers the forensic examination of Windows based operating systems on FAT File System, and includes processing the Recycle Bin, the swap file, the registry, long file names and other windows features.

Cybercop 305 - Windows NT File System (NTFS)
This 4 day class introduces the experienced examiner to a “behind the scenes” approach to the NT file system. Students will explore the components of the file system (master file table), the concepts of the file system (resident vs non resident data), and the processing of the data tracked by the file system (saving, deleting, recycling, encrypting).

Cybercop 310 - Windows NT Operating System (NTOS)
This 4 day class introduces the experienced examiner to the Windows XP, Vista, and Windows 7 operating systems. Registry components and forensically relevant information they contain are emphasized throughout this course. Students will also examine the operating system’s security structures and volume shadow copy service.

Cybercop 320 - Windows Internet Trace Evidence (INET)
This 3 1/2 day course is designed to teach the recovery of “trace evidence” left on a computer system as a result of using the Internet. INET covers information about the use of Internet Explorer, FireFox, AOL and several of the instant messaging tools like Yahoo, AIM and WLM (Windows Live Messenger).

Cybercop 401 - Linux File System for Computer Forensic Examiners (LinuxFS)

This 4 1/2 day class is designed for experienced computer forensic examiners who want to gain a better understanding of the unique issues related to Linux based computers. The class will emphasize the native Linux file systems (ext2, ext3 and Reiser), interpreting command shell histories, and the location of evidence on a Linux machine.

Fast CyberForensic Triage (FCT)
This 3-day course will introduce investigators and first responders to the process known as Fast CyberForensic Triage. Fast forensics is defined as “those investigative processes that are conducted within the first few hours of an investigation, that provides information used during the suspect interview phase. Due to the need for information to be obtained in a relatively short time frame, fast forensics usually involves an on site/field analysis of the computer system in question.”

Fast Track Program (STOP, BDRA and IDRA) (Fast Track) (Fast Track-FT)
The NW3C Fast Track Program (FT) delivers three courses (STOP, BDRA, and IDRA), at the same location, in two one week training sessions, separated by four to six weeks. These courses will bring a student from identifying and seizing digital evidence, through on-site previews and triage, to duplicate imaging of digital media to the analysis of the media resulting in reports detailing their results. This program has three prerequisite web based courses: Basic Computer Skills for Law Enforcement, Legal Concerns for Digital Evidence Responders, and Identification and Seizure of Electronic Evidence (ISEE).

Fast Track Program Advanced (NTFS, NTOS, and INET) (Fast Track - Advanced)
The NW3C Advanced Fast Track Program (FT) delivers three courses (NTFS, NTOS, and INET), at the same location, in three one week training sessions, spread out over a three month period. These courses will provide an experienced student with detailed knowledge and skills of the NT File System, the XP, VISTA, and Windows 7 operating systems, and the trace evidence available from popular internet applications.

ICAC - Cyber-Investigation 100 - Identifying and Seizing Electronic Evidence (ICAC-ISEE)
This 6 hour course provides law enforcement professionals with the knowledge and skills necessary to respond to an electronic crime scene and to safely and methodically collect and preserve items of evidentiary value that may be used in court proceedings.

ICAC - Cyber-Investigation 101 - Secure Techniques for Onsite Preview (ICAC-STOP)

This 2-day course is designed for probation/parole staff, detectives and officers conducting “knock and talk” interviews or spot checks and home visits.

ICAC - Cyber-Investigation 105 - Basic Cell Phone Investigations (ICAC-BCPI)
This 2-day course is designed as a basic introduction for officers, investigators and analysts who require the knowledge and skill set to initiate or follow-up on cell phone related cases. The student is expected to have basic computer literacy and some experience in Microsoft Office applications such as Excel and Access.

ICAC - Cyber-Investigation 205 - Cell Phone Interrogation (ICAC-CPI)
This 2-day course trains officers and investigators in the acquisition and analysis of information internal to cell phones. Attendees are given significant hands-on time with some of the most popular cell phone extraction tools available on the market today. This is the companion course to Cyber-Investigation 105 – Basic Cell Phone Investigations, which covers obtainable information external to the phone (such as call detail records).

ICAC - Cyber-Investigation 210 GPS Interrogation (ICAC-GPSI)
This one-day course is designed to familiarize attendees with the vast amount of location information present on GPS devices. Through a series of presentations and hands-on exercises, attendees will acquire the knowledge and skills necessary to extract and analyze data associated with GPS-enabled technologies, including portable and marine navigation units.

ICAC - Cyber-Investigation 220 - Wireless Network Investigation (ICAC-WNI)
This 3 day course focuses on techniques and methodologies used in documenting and seizing network-based digital evidence from scenes utilizing 802.11 wireless network equipment. Students will be taught the standards and best practices for investigating, documenting, and seizing a wireless network.

ICAC - Cyber-Investigation 250 - Identifying & Seizing Electronic Evidence - Train the Trainer (ICAC-ISEE-T3)
This is a 2-day course. Participants are introduced to adult learning concepts and course content relating to identifying electronic evidence at a crime scene and the proper method for securing this evidence.

ICAC - Cyber-Investigation 260 - Secure Techniques for Onsite Preview (ICAC-STOP-T3)
STOP-T3 is an Instructor Development Project (IDP) course. In a T3 course, participants are trained to instruct the STOP course. After completing the course, they are supplied with all of the course materials that will allow them to instruct the course on their own, with support from NW3C. The course is designed to be instructed by non-technical instructors. Instructors with varying investigative backgrounds will be able to grasp the concepts and materials necessary to instruct the course.

ICAC - Cybercop 101 - Basic Data Recovery & Acquisition (ICAC-BDRA)
This 4-day course was designed for criminal investigators, prosecutors, or support staff whose duties include the investigation and prosecution of high-technology crimes and the seizure and imaging of electronic media and evidence. Students must possess a good understanding of computers and common software applications.

ICAC - Cybercop 201 - Intermediate Data Recovery and Analysis (ICAC-IDRA)

This 5-day course is designed to be the “sequel” to the Cybercop 101 (BDRA) course. The course covers the forensic examination and analysis of Windows based operating systems on FAT and NTFS File Systems, and includes processing and analyzing of the Recycle Bin, the swap file, the registry, long file names and other windows features.

ICAC - Cybercop 305 - Windows NT File System (ICAC-NTFS)
This 4 day class introduces the experienced examiner to a “behind the scenes” approach to the NT file system. Students will explore the components of the file system (master file table), the concepts of the file system (resident vs non resident data), and the processing of the data tracked by the file system (saving, deleting, recycling, encrypting).

ICAC - Cybercop 310 - Windows NT Operating System (ICAC-NTOS)
This 4-day course is designed to be an introduction to processing issues related to the Windows NT operating systems to include Windows XP and Vista. This course will be dedicated to the NT Operating Systems and the particular issues of processing and analysis.

ICAC - Cybercop 320 - Windows Internet Trace Evidence (ICAC-INET)
This 3 1/2 day course is designed to teach the recovery of “trace evidence” left on a computer system as a result of using the Internet. INET covers information about the use of Internet Explorer, FireFox, AOL and several of the instant messaging tools like Yahoo, AIM and WLM (Windows Live Messenger).

ICAC - Cybercop 401 - Linux File System for Computer Forensic Examiners (ICAC-Linux FS)
This 4-day course is designed to be an introduction to processing issues related to the Windows NT operating systems to include Windows XP and Vista. This course will be dedicated to the NT Operating Systems and the particular issues of processing and analysis.

ICAC - Fast Track Program (ISEE-T3, STOP, BDRA and IDRA) (ICAC - Fast Track)
The NW3C Fast Track Program (FT) delivers four courses (ISEE-T3, STOP, BDRA, and IDRA), at the same location, in three one week training sessions, spread out over a three month period. These courses will bring a student from identifying and seizing digital evidence, through on-site previews and triage, to duplicate imaging of digital media to the analysis of the media resulting in reports detailing their results.

ICAC - Fast Track Program Advanced (NTFS, NTOS, and INET) (ICAC - Fast Track - Advanced)
The NW3C Advanced Fast Track Program (FT) delivers three courses (NTFS, NTOS, and INET), at the same location, in three one week training sessions, spread out over a three month period. These courses will provide an experienced student with detailed knowledge and skills of the NT File System, the XP, VISTA, and Windows 7 operating systems, and the trace evidence available from popular internet applications.

Introduction to Securing Law Enforcement Networks (ISLEN)
This 3-day course is designed for smaller departments to assist in the securing of their networks. The course helps network administrators/officers by providing tips and techniques for securing their network and covers items such as host-based security, physical security, LAN-based security, and perimeter security.

Financial Crimes Against Seniors (FCAS)
This 3-day training in Financial Crimes Against Seniors includes tools and techniques for investigating crimes involving this rapidly increasing victim group. The course also discusses the importance of a multi-agency approach to these crimes and we encourage Adult Protective Service investigators to attend the class.

Financial Investigations Practical Skills (FIPS)
This 4 1/2 day training will benefit investigators, auditors, prosecutors, paralegals, financial analysts, and regulatory personnel who are learning the fundamentals of conducting successful financial crime investigations. During the course, participants will apply the concepts learned throughout the week to a complex financial investigation from discovery to prosecution.

Financial Records Examination and Analysis (FREA)
Financial records are a large part of nearly all financial crime investigations. This 4 day course provides participants with the skills necessary to organize, analyze, and present the evidence and indicators of fraud found in various financial records. Investigators, Analysts, Auditors, Regulators, Prosecutors and other law enforcement professionals will benefit from the hands-on approach offered in this course. Participants will discuss the indicators of fraud in various financial records and utilize a computer and software to assist in the analysis of financial records.

Identity Theft Investigations (IDTI)

Identity theft exists in every strata of crime, from individual street crimes, such as purse snatching & mailbox robberies, to highly complex and organized criminal enterprises.

This 2-day introductory level course is intended for law enforcement, criminal intelligence analysts, and prosecutors who may be involved with identity theft cases. This training increases the student’s awareness of the “bigger picture” of identity theft. Students learn to recognize identity theft indicators often present in many other types of criminal activity. The training promotes multi-agency & private-sector collaborations and teaches investigative best practices that lead to successful prosecutions.

Intellectual Property Crime (IP Crime)

As a response to the serious threat of Intellectual Property (IP) crime, NW3C and the National Association of Attorneys General (NAAG) are providing training to state and local law enforcement in the area of IP crime.

This 1-day training is intended for investigators and prosecutors. The course uses a mix of lecture, discussion, and interactive exercises.

Mortgage Fraud (Mortgage Fraud)
Mortgage fraud is a multi-billion dollar a year problem in the United States. Infrastructure held in place by strong neighborhoods and communities are feeling the devastating effects of mortgage fraud and subsequently, vacant property crimes.

White Collar Crime and Terrorism (WCCAT)
Over the recent past, a link has been developed between white collar crime and terrorism. Terrorist organizations are committing white collar crimes to finance their endeavors. This 3 day intermediate course was designed to give state and local officers, investigators, analysts, and prosecutors an overview of domestic and international terrorism and the crimes that are typically committed by these organizations including identity theft, money laundering, securities fraud, and RICO.

Advanced Criminal Intelligence Analysis to Prevent Terrorism (ACIAPT)

This 5-day training is for law enforcement personnel who have successfully completed a basic intelligence analysis training.

Law enforcement intelligence for counterterrorism requires a more strategic or predictive approach to deal with both domestic and international terrorist threats. This training helps law enforcement analysts become aware of intelligence processes used in the national security arena, and law enforcement’s role in the intelligence community. This course has been certified by the Federal Emergency Management Agency, National Preparedness Directorate, National Intergration Center, Training and Exercise Integration's Training Operations as course number AWR-158.

Analyst's Notebook® version 8.5 (i2)
i2's Analyst's Notebook 8.5 is an introductory course that lays the foundations of the software capabilities and gives the user the skills to create basic link and timeline charts, allowing investigators and analysts to bring clarity to complex investigations.

Foundations of Intelligence Analysis Training (FIAT)
The FIAT course is designed for state, local, and federal law enforcement, regulatory and other appropriate agency personnel who need training in basic criminal intelligence analysis principles and methods. The 5-day course is structured to meet the standards set forth by the National Criminal Intelligence Sharing Plan, and the DHS/FEMA Training and Exercise Integration Secretariat (TEI) for a basic criminal intelligence analysis course. The course is a mixture of lectures, discussions, and individual and group activities to give participants an understanding of analytic thinking skills and methods required for effective intelligence analysis. This course has been certified by the Federal Emergency Management Agency, National Preparedness Directorate, National Integration Center, Training and Exercise Integration’s Training Operations as course number AWR-204.

Intelligence Writing and Briefing (Intel Writing)
Intelligence Writing and Briefing, a DHS/FEMA grant-funded project, addresses the demonstrated need for fusion centers and other analysts to produce high quality intelligence reports and briefings. This 3-day course is for state, local, and tribal law enforcement and regulatory agency personnel. The training includes basic intelligence writing and briefing principles and methods to facilitate increased intelligence sharing.

Economic Crime Foundation Series (ECFS)
NW3C's first complete Online Distance Learning Program, The Economic Crime Foundation Series (ECFS), consists of five self-paced introductory level courses: Introduction to White Collar Crime, Elder Fraud, Identity Theft, Disaster Fraud, and Money Laundering.

This course can be accessed only through the secure members website: https://members.nw3c.org. This series is located under the Resources section of the website. If your agency is a member and you do not have a user name and password please see your agency representative.

Cyber Investigation 250 - Instructor Development Program (ISEE-T3)
ISEE-T3 is an Instructor Development Project (IDP) course. In a T3 course, participants are trained to instruct the ISEE course. After completing the course, they are supplied with all of the course materials that will allow them to instruct the course on their own, with support from NW3C. The course is designed to be instructed by non-technical instructors. Instructors with varying investigative backgrounds will be able to grasp the concepts and materials necessary to instruct the course.

Cyber-Investigation 260 - Secure Techniques for Onsite Preview (STOP-T3)
STOP-T3 is an Instructor Development Project (IDP) course. In a T3 course, participants are trained to instruct the STOP course. After completing the course, they are supplied with all of the course materials that will allow them to instruct the course on their own, with support from NW3C. The course is designed to be instructed by non-technical instructors. Instructors with varying investigative backgrounds will be able to grasp the concepts and materials necessary to instruct the course.

ICSIS (Internet Complaint Search & Investigation System) Training (ICSIS)
ICSIS training has been developed to equip law enforcement personnel with the skills necessary for extracting investigative leads and case-related information from the IC3 database. This training provides students with an expanded knowledge of the database and introduces them to tools for use in building cases during investigations. Students are taught how to search the database for relevant complaints and build case files for individual investigative use and for shared use with others working similar leads. 6 hour course

ICSIS (Internet Complaint Search & Investigation System) Training (ICSIS) - Train the Trainer (ICSIS-T3)
This 2-Day course is part of the NW3C instructor develop program (IDP). Participants are introduced to adult learning concepts, presentation skills, and course content relating to the Internet Complaint Search and Investigation System (ICSIS) database and it’s functionality.