The aim of this training is to enhance the skill level of investigators from the countries of South-Eastern Europe (Albania, Bosnia and Herzegovina, the former Yugoslav Republic of Macedonia, Montenegro, Serbia), who deal with highly complex computer crimes, as well as computer related crimes with an emphasis on digital forensics.
Computers, tablets and smartphones are routinely seized by police because their contents often provide significant evidence in furthering criminal investigations. Many law enforcement agencies lack the technical capacity to conduct forensic examinations of such devices and critical evidence is often lost. Computer forensic capacity is also required to investigate traditional crimes such as homicide, drug trafficking and financial fraud. Law enforcement agencies which have the responsibility for investigating terrorism also require a competent forensic capacity.
The constant evolution of technology makes it difficult to define a concrete set of standard practices for extracting evidential data from digital devices. While the technological evolution of personal computers is less dynamic, each operating system manages data in a different manner to the others. Another difficulty faced by examiners is the variety of applications that are available on mobile devices and computers, many of which store evidential data in various locations in their respective file systems. All of this means that the techniques of the forensic examiner must constantly evolve with technological changes and this also underlines the importance of training and experience.
Law enforcement officers must be trained to acquire a fundamental understanding about digital forensics before they can consider themselves to be experts and participate in investigations or advanced training. Once they are fully aware of the fundamentals of digital forensics, investigators will benefit from advanced courses and certification from academic institutions or product vendor training.
As a member of the European Cybercrime Training and Education Group (ECTEG), comprising of representatives of law enforcement agencies, international bodies, academia and private industry, OSCE, in the effort to support ECTEG’s aim at “international activities to harmonise cybercrime training across international borders”, has been facilitating training initiatives in the OSCE region in the past decade using training curricula developed and delivered by the ECTEG partners. The advantage of the ECTEG approach in developing training material is that all of its courses are based on and relying on usage of free open source software and aim to provide law enforcement officers with the level of understanding of the underlying technology sufficient to present the evidence in a court of law in a forensically sound manner.
The laid the foundation for building up the capacity of newly appointed cybercrime investigators and digital forensic examiners in using open source digital forensics software in investigation of cybercrime, while enabling them to participate in intermediate and advanced ECTEG courses in the future.