Courses by Description

Cyber Investigation 100 - Identifying and Seizing Electronic Evidence (ISEE)
This course is designed to instruct participants in the basics of recognizing potential sources of electronic evidence, preparing them to respond to an electronic crime scene, and to safely and methodically preserve and collect items of evidentiary value to be used in court proceedings. This particular course utilizes advanced adult learning skills and takes the participants through a process and methodology that can be presented either in a basic recruit academy atmosphere or an in-service training situation.

Cyber Investigation 101 - Secure Techniques for Onsite Preview (STOP)

This 2 day course is intended for probation/parole, detectives and officers conducting “knock and talk” interviews or spot checks and home visits. This class utilizes a Linux-based bootable CD to preview a suspect computer system for potential evidence in a forensically sound manner. The CD has the advantage of being able to “read” other computer system’s files without writing to or altering the data on those systems.

Cyber Investigation 201 - Basic On-Line Technical Skills (BOTS)
Designed for the officer who is new to on-line investigations. The course will teach the basic technical skills and considerations involved in setting up an under-cover account, and techniques for both proactive and reactive online investigations. The student will learn how to document and trace real-time chats, instant messaging, and other on-line evidence.

Cybercop 101 - Basic Data Recovery and Acquisition (BDRA)
Through a series of classroom presentations and hands-on reinforcement, participants will learn the basics of how computers work and store data. Attendees will use this information as a foundation to further understand and successfully demonstrate the critical concepts necessary to seize, protect, preserve, and collect potential electronic evidence found at the computer crime scene. Participants will use this class as prerequisite to continue their professional development and training to assist in the investigation and prosecution of cyber crime cases.

Cybercop 201 - Intermediate Data Recovery and Analysis (IDRA)
A scenario-based course with the students examining a suspect’s hard drive as well as alternate media with a focus on in depth computer analysis for evidentiary material. This course should be taken prior to other advanced classes to become familiar with an overview of the structure of media and techniques used in complex forensic examinations.

Cybercop 305 - Windows NT File System (NTFS)
Introduction to processing issues related to the Windows NT File System (NTFS) and Windows Vista BitLocker full volume encryption.

Cybercop 310 - Windows NT Operating System (NTOS)
Introduction to processing issues related to the Windows 2000, Windows XP, and Windows Vista operating systems.

Cybercop 320 - Windows Internet Trace Evidence (INET)
Teaches data recovery from the following online platforms: Internet Explorer and Netscape Navigator, the America Online client 9.0, the America Online Communicator platform, and the following Instant Messenger Software: AIM/MSN/ICQ/YAHOO.

Cybercop 401 - Linux File System for Computer Forensic Examiners (Linux)

This 4 1/2 day class is designed for experienced computer forensic examiners who want to gain a better understanding of the unique issues related to Linux based computers. The class will emphasize the native Linux file systems (ext2, ext3 and Reiser), interpreting command shell histories, and the location of evidence on a Linux machine.

Fast CyberForensic Triage (FCT)
This 3-day course will introduce investigators and first responders to the process known as Fast CyberForensic Triage. Fast forensics is defined as “those investigative processes that are conducted within the first few hours of an investigation, that provides information used during the suspect interview phase. Due to the need for information to be obtained in a relatively short time frame, fast forensics usually involves an on site/field analysis of the computer system in question.”

Introduction to Securing Law Enforcement Networks (ISLEN)
This 3-day course is designed for smaller departments to assist in the securing of their networks. The course helps network administrators/officers by providing tips and techniques for securing their network and covers items such as host-based security, physical security, LAN-based security, and perimeter security.

Financial Crimes Against Seniors (FCAS)
This 3-day training in Financial Crimes Against Seniors includes tools and techniques for investigating crimes involving this rapidly increasing victim group. The course also discusses the importance of a multi-agency approach to these crimes and we encourage Adult Protective Service investigators to attend the class.

Financial Investigations Practical Skills (FIPS)
This 4 1/2 day training will benefit investigators, auditors, prosecutors, paralegals, financial analysts, and regulatory personnel who are learning the fundamentals of conducting successful financial crime investigations. During the course, participants will apply the concepts learned throughout the week to a complex financial investigation from discovery to prosecution.

Financial Records Examination and Analysis (FREA)
Financial records are a large part of nearly all financial crime investigations. This 4 1/2 day course provides participants with the skills necessary to organize, analyze, and present the evidence and indicators of fraud found in various financial records. Investigators, Analysts, Auditors, Regulators, Prosecutors and other law enforcement professionals will benefit from the hands-on approach offered in this course. Participants will discuss the indicators of fraud in various financial records and utilize a computer and software to assist in the analysis of financial records.

Identity Theft Investigations (IDTI)

Identity theft exists in every strata of crime, from individual street crimes, such as purse snatching & mailbox robberies, to highly complex and organized criminal enterprises.

This 3-day introductory level course is intended for law enforcement, criminal intelligence analysts, and prosecutors who may be involved with identity theft cases. This training increases the student’s awareness of the “bigger picture” of identity theft. Students learn to recognize identity theft indicators and the potential nexus to terrorism and larger-scale criminal activity. The training promotes multi-agency & private-sector collaborations and teaches investigative best practices that lead to successful prosecutions.

White Collar Crime and Terrorism (WCCAT)
Over the recent past, a link has been developed between white collar crime and terrorism. Terrorist organizations are committing white collar crimes to finance their endeavors. This 3 day intermediate course was designed to give state and local officers, investigators, analysts, and prosecutors an overview of domestic and international terrorism and the crimes that are typically committed by these organizations including identity theft, money laundering, securities fraud, and RICO.

Advanced Criminal Intelligence Analysis to Prevent Terrorism (ACIAPT)

This 5-day training is for law enforcement personnel who have successfully completed a basic intelligence analysis training.

Law enforcement intelligence for counterterrorism requires a more strategic or predictive approach to deal with both domestic and international terrorist threats. This training helps law enforcement analysts become aware of intelligence processes used in the national security arena, and law enforcement’s role in the intelligence community. This course has been certified by the Federal Emergency Management Agency, National Preparedness Directorate, National Integration Center’s Training and Education Division as course number AWR-158.

Analyst's Notebook® version 6 - level one (i2-vs 6)
i2's Analyst's Notebook 6 is an introductory course that lays the foundations of the software capabilities and gives the user the skills to create basic link and timeline charts, allowing investigators and analysts to bring clarity to complex investigations.

Analyst's Notebook® version 7 - level one (i2)
i2's Analyst's Notebook 7 is an introductory course that lays the foundations of the software capabilities and gives the user the skills to create basic link and timeline charts, allowing investigators and analysts to bring clarity to complex investigations.

Foundations of Intelligence Analysis Training (FIAT)
The FIAT course is designed for state, local, and federal law enforcement, regulatory and other appropriate agency personnel who need training in basic criminal intelligence analysis principles and methods. The 5-day course is structured to meet the standards set forth by the National Criminal Intelligence Sharing Plan, and the DHS/FEMA Training and Exercise Integration Secretariat (TEI) for a basic criminal intelligence analysis course. The course is a mixture of lectures, discussions, and individual and group activities to give participants an understanding of analytic thinking skills and methods required for effective intelligence analysis. FIAT is approved for the use of state DHS/FEMA training funds — course number WV-001-PREV.

Economic Crime Foundation Series (ECFS)
NW3C's first complete Online Distance Learning Program, The Economic Crime Foundation Series (ECFS), consists of five self-paced introductory level courses: Introduction to White Collar Crime, Elder Fraud, Identity Theft, Disaster Fraud, and Money Laundering.

This course can be accessed only through the secure members website: https://members.nw3c.org. This series is located under the Resources section of the website. If your agency is a member and you do not have a user name and password please see your agency representative.

Cyber Investigation ISEE - Instructor Development Program (ISEE-IDP)
ISEE-IDP is an Instructor Development Project (IDP) course. In an IDP course, participants are trained to instruct the ISEE course. After completing the course, they are supplied with all of the course materials that will allow them to instruct the course on their own, with support from NW3C. The course is designed to be instructed by non-technical instructors. Instructors with varying investigative backgrounds will be able to grasp the concepts and materials necessary to instruct the course.

Secure Techniques for Onsite Preview (STOP-IDP)
STOP-IDP is an Instructor Development Project (IDP) course. In an IDP course, participants are trained to instruct the STOP course. After completing the course, they are supplied with all of the course materials that will allow them to instruct the course on their own, with support from NW3C. The course is designed to be instructed by non-technical instructors. Instructors with varying investigative backgrounds will be able to grasp the concepts and materials necessary to instruct the course.