Industry Roundup: Online Digital Forensics Training

by Christa Miller, Forensic Focus 

Online digital forensics training has been around for a number of years, offered as a convenient alternative to in-person training for examiners who couldn’t travel or were otherwise resource-constrained. In an unforeseen twist, though, live and on-demand remote training has become critically necessary to professional development during the COVID-19 pandemic.

Each model has its strengths. Live, instructor-led online classes are interactive, offering a virtualized classroom experience as students communicate with both instructors and fellow students. However, on-demand training offers the benefit of going at your own pace and according to your own schedule.

When you’re evaluating online training, a few other things to keep in mind include time zones, language requirements, whether the class can be bundled or applied to a vendor’s annual pass, and whether the class counts toward certification training or exams. For interactive classes, also consider whether you have or will need a second monitor to interact with both course material and your instructor.

In this article, we round up many of these opportunities.

AccessData

AccessData Digital Investigations Training includes live online classes designed to guide examiners through the use of AccessData’s Forensic Toolkit® (FTK), AD Enterprise and AD Lab technologies in identifying, responding, investigating, prosecuting and adjudicating cases.

The company is currently in the process of changing live in person classes to live online. For the United Kingdom, all in-person classes through the end of May have been switched to live online. Learn more about the available course options and register at AccessData’s website.  

Amped

Amped recently announced via its blog that it is standing up live online training classes with its experienced trainers. The first online classes have been added to Amped’s training schedule, and more are slated to be added. Visit Amped’s website for more information and to register.

Autopsy 

Until May 15, 2020, free online training in the use of open-source Autopsy forensics software is available to anyone. Previously – and again after May 15 – the training was open only to local, state, and federal US law enforcement personnel. A completion certificate can be used towards CPE credits if desired. Register with any email address to receive the coupon code to register for the course. Learn more here.

BlackBag Technologies

BlackBag’s new live, instructor-led virtual training offers its three most requested courses, Basic Forensic Investigations, Windows Forensic Investigations, and Apple Forensic Investigations, throughout April and May.

In addition, new live virtual forensic workshops highlight product features and digital investigation techniques for Mac and Windows, and Mobilyze Tool Training is currently available on-demand as a free, self-paced online course.

Over the coming weeks, BlackBag plans to release more dates and time zones for live, virtual courses in the coming weeks as well as in-demand, self-paced training courses. Visit BlackBag’s training website to learn more and register.  

Belkasoft

Belkasoft’s four training courses — Belkasoft Essentials, Belkasoft Advanced, Belkasoft Certification Training, and Incident Response Examination — are all available online. Between them, these courses offer skills in both digital forensics and the use of Belkasoft Evidence Center, covering the acquisition and analysis of data artifacts from hard drives, smartphones and cloud, and other data sources such as memory and virtual machines.

Each module is accompanied by a set of practical exercises, with the opportunity for Q&A during the training session. Learn more at belkasoft.com/training. 

Cellebrite

The Cellebrite Academy offers one of the most extensive sets of online courses in both live online and self-paced formats. Delivered in 10 different languages, the courses are bundled to make it possible for students to work toward a certification. The Cellebrite Reader online class is free.

Cellebrite’s live online classes are limited to 16 students per class, and groups of five or more, are eligible to receive 15% off on all registrants. Learn more and register on Cellebrite’s website.

International Society of Forensic Computer Examiners (ISFCE)

The ISFCE’s Computer Forensic Training Center Online offers a self-paced, eight-module Guided Self Study CCE Bootcamp. Students receive course material handouts, along with pre-prepared USB thumb drives, mobile phones and a hard disk drive for examination.

With instructor support provided via email, the Self-Study CCE Bootcamp covers tool-agnostic core forensic practices with an eye toward evidentiary admissibility at trial and qualifying as an expert witness. Course eligibility is open to both civilian and law enforcement digital forensics professionals, along with those who work in IT, accounting, legal and other fields.

Magnet Forensics

Magnet Forensics has offered virtual instructor-led courses for years, but recently increased its virtual machines’ capacity and transitioned its classroom instructor-led courses online in both instructor-led and self-paced formats.

The training encompasses both tool- and platform (mobile and cloud)-oriented courses, as well as a dedicated incident response course. 

MSAB

MSAB’s online, on-demand training course options include its XRY Certification and Recertification courses in mobile forensics using its XRY software. Other online courses include certifications for XRY Express Logical and Physical certifications, as well as XAMN Spotlight, which is offered with both on-demand and instructor-led options.

For customers who had registered for classroom training, MSAB has waived its 14-day notification requirement until the end of May as long as participants reschedule the training for a later date before October 31, 2020 (subject to pandemic status).

National White Collar Crime Center (NW3C)

The NW3C’s training encompasses a range of courses for digital forensics examiners, cybercrime investigators, and prosecutors, with the result that professionals can cross-train to learn about multiple issues they may end up supporting.

Having suspended its classroom training through the end of April 2020, the NW3C is pivoting to deliver previously canceled classes through its virtual platform. It’s also stepping up its robust webinar program, offering seats to up to 3,000 participants two to three times per week. (Want to offer webinar content? Email topics@nw3c.org!)

Finally, the NW3C began offering Capture the Flag competitions in March. Daily challenges offer examiners from all experience levels a way to keep their skills up using open source tools. Thanks to sponsors, prizes will be offered for CTF winners throughout April through mid-May. Get a sense for what the challenges look like on NW3C’s YouTube page, and sign up at nw3.ctfd.io.

Nuix

The Nuix Workstation Forensic Practitioner Core, Nuix Workstation Forensic Practitioner Foundations, and Nuix Workstation Forensic Practitioner Windows certification courses, as well as the Nuix Investigations End User and Administrator courses, are all available live online, and along with their respective exams count toward Nuix Forensic Practitioner Master Certification. Classes may be purchased as a bundle at a discounted price. 

In addition, Nuix is expanding its webinar schedule throughout 2020. Look for a brand-new Nuix Investigate Power User webinar series coming this year, along with thought leadership panels and demos. Visit nuix.com/nuix-at-home for the latest content, or nuix.com/webinars for a full listing of webinars.

OpenText

OpenText Adoption & Learning Services offers self-paced online learning programs through its eLearning portal. It offers an annual training passports at a single flat, discounted rate for all available EnCase Training OnDemand courses — including OpenText EnCase Forensic, OpenText EnCase Mobile Investigator, OpenText Endpoint Investigator, and others — over a one- or two-year period. Certifications are available as well.

OSForensics

Three online options are available from PassMark’s OSForensics:

• Self-directed online learning combines slide decks, videos, and lab exercises that enable OSForensics users to build proficiency with the software.
• A separate online certification exam is available for those who wish to become an OSForensics Certified Examiner (OSFCE).
• In addition, first responders and new digital forensic practitioners can take the OSForensics Certified Triage Certification test completely free of charge.

Oxygen Forensics

With free remote training on the Oxygen Forensic® Detective interface, Oxygen is offering a complimentary introduction to its remote training platform. Over a two-hour session led by a live Oxygen instructor, attendees log into Oxygen’s online education environment to learn more about the software and how to implement it. Sessions are restricted to 10 attendees.

Oxygen additionally offers three- and five-day remote advanced training on its platform via its Forensic Boot Camp and Accelerated Training Program for a fee. 

Paraben

Paraben’s operator-level courses for mobile and computer each come with an online training, lab, and certification examination. Paraben currently offers the following courses online as of April 2020:

• A new free online training course focuses on the functions in the free version of the E3 Forensic Platform, which is provided to all attendees.
• Going further, the E3 Fast Track gets into the details of the Paraben E3 Forensic Platform and how it can be used with a large variety of different digital data types including computer data, email data, internet data, smartphones, and cloud information.
• The tool-agnostic Forensic Fundamentals course teaches novice examiners about getting started in digital forensics: chain of custody, collection, acquisition, analysis, and reporting on data.

Passware

Passware Certified Examiner (PCE) Training is an online, self-paced course that provides forensic examiners with a start-to-finish education on the use of Passware Kit Forensic to detect, analyze, and decrypt encrypted electronic evidence.

More than 15, 15-30 minute videos show attendees how to detect encrypted evidence, recover passwords for all common file types, analyze memory images, recover passwords for mobile backups, decrypt hard drives. An optional exam offers attendees the ability to test for a Passware Certified Examiner (PCE) certification.

Learn more at passware.com/training.

SANS Institute

SANS recently announced new live online training. Live, interactive sessions with SANS instructors offer electronic courseware and materials for hands-on labs in a virtual environment, along with four months of online access to the archive of your course. Flexible options allow students to complete courses in 1, 2, 3, or 6 weeks.

SANS also offers a number of free resources for digital forensics examiners. In particular, new weekly Capture-the-Flag events and NetWars challenges are available in a virtual online platform now through May 31st. For training, free one-hour course previews of more than 45 SANS courses, many involving digital forensics, are available through its OnDemand platform.  

Spyder Forensics

Training is Spyder Forensics’ focus, and its Remote Synchronous Training (RST) is fully interactive, designed to simulate a live classroom environment with structured – and customizable – courses.

In addition, Spyder Forensics’ Learning Management System (LMS) provides on-demand interactive delivery of nearly all training material. Students are assigned the appropriate course and module, or group of modules based on a customized learning path by role, skill level, or content. 

Also recently introduced is Forensic Fridays, a series of complimentary 1 hour knowledge exchange sessions on a wide range of topics. To learn more, visit www.spyderforensics.com.

Teel Technologies

Another training-oriented provider, Teel Technologies has recently introduced a weekly educational live broadcast straight from its instructors. These short, 15-20 minute lessons on topics like Faraday bags, SQLite Explorer, and flasher boxes, offer a brief presentation, followed by a Q+A and discussion.

As well, online training is available. The first class to be offered will be SQLite Forensics, a five-day course that teaches law enforcement mobile forensics examiners how to perform low-level analysis and recovery on SQLite databases. 

X-Ways

X-Ways’ online live training includes the four-day X-Ways Forensics and the two-day X-Ways Forensics II, though additional training may be offered with sufficient demand and filled seats. Hands-on exercises with sample image files help class attendees to implement their new skills immediately, and temporary licenses are available to take the class.

While only the four-day class is required to attempt X-PERT certification, the two courses together are recommended.

This article was updated April 20, 2020 to reflect new SANS Institute live online course offerings.