An official website of the United States government. Here’s how you know.
NCFI

National Computer Forensics Institute

NCFI Alerts

News

Star divider image

02/08/2023

NCFI Course Offerings for June - September Announced

The nomination period to attend NCFI courses will be open until Wednesday, February 22, 2023. Please contact your local U.S. Secret Service field office for further information and to be nominated.


07/19/2022

NCFI Announces 2022 Cyber Games

As part of the U.S. Secret Service National Computer Forensics Institute Cyber Games, the NCFI will host the 2022 Ransomware Incident Response Training Event; October 25th – 28th in Hoover, Alabama, as well as the Cyber Incident Response Competition (Virtual team event) from October 31st - November 2nd. The competition bolsters multi-jurisdictional collaboration among the national law enforcement community in response to cyber-attack incidents. Incident Response Teams test their technical investigative skills, working as a multi-agency group, and respond to a simulated ransomware attack. The target audience is law enforcement cyber investigators / task force technical responders, as well as any federal incident responders available to participate (provided they receive approval and federal funds for travel).


The nomination period for the training and competition will be open July 18, 2022 and closes on August 1, 2022.


Please contact your local U.S. Secret Service Field Office for more information.


06/01/2022

NCFI Course Offerings for October - January Announced

The nomination period for NCFI course offerings from October 2022 to January 2023 will be open through Wednesday, June 22, 2022. Contact your local Secret Service field office to be nominated to attend.


The following courses are available for nomination:


First Responder Courses:

  • Business Email Compromise (BEC-V)
  • Basic Network Investigation Training (BNIT)
  • Ransomware Response Case Study
  • Digital Currency Course (DCC)
  • Digital Evidence Investigations (DEI)
  • Digital Investigations Supervisors Course (DISC)
  • Drone Operations Course (DOC)
  • Filesystem Recognition Electronic Sterilization and Hashing (FRESH)
  • Report Authors Course (RAC)
  • Ransomware Investigative Principles (RIP)


Basic Examiner Courses:

  • Basic Computer Evidence Recover Training (BCERT)
  • Command Line Principles (CLP)
  • QBOT Backdoor Trojan (Case Study: QBOT)
  • Drone Analysis and Forensics (DAF)
  • Device Triage Workshop (DTW)
  • Digital Video Recorders
  • Introduction to Phone Repair (IPR)
  • Linux for Law Enforcement (LLE)
  • Mobile Device Examiner (MDE)
  • Network Intrusion Response Program (NITRO)
  • Vehicle Forensics Course (VFC)


Advanced Examiner Courses:

  • Advanced Forensics Training (AFT)
  • Advanced Mobile Device Examiner (AMDE)
  • Forensic Scripting Course (FSC)
  • Mac Forensics Training (MFT)


Prosecutor/Judge Courses:

  • Advanced Digital Evidence for Prosecutors (ADEP)
  • Digital Evidence for Judges (DEJ)
  • Digital Evidence for Prosecutors (DEP)


For course descriptions click the "Courses" tab above.




04/27/2020

NCFI anticipated restart information

“The NCFI anticipates the restart of training classes at its facility on June 15, 2020, pending coordination with local, state and federal COVID-19 guidelines. All students please standby for further instruction and coordination from your respective U.S. Secret Service field office sponsors, as information becomes available.”


03/13/2020

NCFI operations suspended

As we are all aware, to execute our mission to train state and local law enforcement, prosecutors, and judges involves these partners traveling here from all 50 states and multiple US territories. Concurrently, during this pandemic situation the USSS strategy and goal is to limit the exposure of our workforce and our partners to the virus to ensure operational capability for law enforcement activities. With this national strategy in mind, effective immediately the NCFI will:


The NCFI will not travel any new classes to the NCFI for 30 days. This impacts BCERT 20-03 and DEJ 20-02, with a potential impact on MDE 20-04, DCC 20-02, DEI 20-11, DEP 20-07, and AFT 2-03. We will reassess the pandemic virus situation on March 30th as a guide to what exact week we may re-open the NCFI. Be assured, the NCFI will make every attempt to reschedule students into a future class. We greatly appreciate your understanding and patience.

Please contact your USSS Field Office sponsor with any questions.


03/12/2020

Operational Status concerning COVID-19 (Coronavirus)

Many of you have inquired as to the status of NCFI operations during the COVID-19 (coronavirus) situation. At this time, all training classes are planned to commence as scheduled. The NCFI understands travel restrictions may be enacted by your state/county/agency, which prohibits you from attendance of an upcoming training course. Please notify your U.S. Secret Service field office sponsor and NCFI.INFO@usss.dhs.gov as soon as possible whether or not you plan to attend your upcoming training course.


NOTE: If you are ill, or become sick in any capacity prior to your training course, do not travel to the NCFI. Every effort will be made to accommodate your training in a future course.


The NCFI will notify all travelers by COB Thursday, 3/12/20, of any changes in the operational status of its facility. 

 


06/21/2019

October 2019 through January 2020 Nominations are open

The below listed courses are currently being offered at the National Computer Forensics Institute (NCFI) from October 2019 through January 2020. The courses are broken down into four different categories: First Responder Courses, Basic Examiner Courses, Advanced Examiner Courses, and Prosecutor/Judge Courses. The nomination period for LEO courses will end on Friday, June 28, 2019.  The nomination period for all prosecutor and judge classes will end on July 12, 2019.

 

First Responder Courses

 

These courses are designed for individuals who currently do not conduct digital forensic exams and who do not have a basic working knowledge of computers and computer investigations.

 

Basic Network Investigation Training (BNIT)

A 5-day course centered on basic network investigative techniques and network incident mitigation methods. First responders/investigators gain hands-on experience with computer networking fundamentals, legal issues, and digital evidence search and seizure procedures.

 

BNIT 20-01

Date: October 14-18, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, October 13, 2019 and return on Friday, October 18, 2019.

 

BNIT 20-02

Date: November 11-15, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, November 10, 2019 and return on Friday, November 15, 2019.

 

BNIT 20-03

Date: December 2-6, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, December 1, 2019 and return on Friday, December 6, 2019.

 

Digital Evidence for Investigators (DEI)

A 5-day course, which provides first responders/investigators a working knowledge in the identification, extrapolation and analysis of digital evidence obtained from computers and other electronic devices: cellphones, GPS units, and tablets; as well as hands-on training with forensic analysis tools, legal issues, and report generation techniques.

 

DEI 20-01

Date: October 7-11, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, October 6, 2019 and return on Friday, October 11, 2019.

 

DEI 20-02

Date: October 21-25, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, October 20, 2019 and return on Friday, October 25, 2019.

 

DEI 20-03

Date: November 4-8, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, November 3, 2019 and return on Friday, November 8, 2019.

 

DEI 20-04

Date: November 18-22, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, November 17, 2019 and return on Friday, November 22, 2019.

 

DEI 20-05

Date: December 2-6, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, December 1, 2019 and return on Friday, December 6, 2019.

 

DEI 20-06

Date: December 16-20, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, December 15, 2019 and return on Friday, December 20, 2019.

 

DEI 20-07

Date: January 6-10, 2020

This class is limited to 25 students. Travel to the NCFI on Sunday, January 5, 2020 and return on Friday, January 10, 2020.

 

DEI 20-08

Date: January 27-31, 2020

This class is limited to 25 students. Travel to the NCFI on Sunday, January 26, 2020 and return on Friday, January 31, 2020.

 

Social Networking Investigations (SNI)

A 5-day course, which offers investigators insight and practical experience regarding online investigations associated with social media, email, and basic networking, as well as legal issues, and search and seizure procedures.

 

SNI 20-01

Date: October 28-November 1, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, October 27, 2019 and return on Friday, November 1, 2019.

 

SNI 20-02

Date: November 11-15, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, November 10, 2019 and return on Friday, November 15, 2019.

 

SNI 20-03

Date: December 2-6, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, December 1, 2019 and return on Friday, December 6, 2019.

 

SNI 20-04

Date: December 9-13, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, December 8, 2019 and return on Friday, December 13, 2019.

 

 

Basic Examiner Courses

These courses are designed for individuals who are newly assigned to conduct digital forensic exams or network intrusion investigations, and who currently have a basic working knowledge of computers and computer investigations.

 

Basic Computer Evidence Recovery Training (BCERT)

A 5-week course, which provides law enforcement investigators real-world experience with computer

hardware, device imaging solutions, forensic analysis tools, legal issues, and report generation

techniques. Graduates return home with issued equipment necessary to perform forensic examinations.

 

BCERT 20-01

Date: January 6-February 7, 2020

This class is limited to 25 students. Travel to the NCFI on Sunday, January 5, 2020 and return on Friday, February 7, 2020.

 

Mobile Device Examiner (MDE)

A 4-week course in which law enforcement personnel learn investigative methodologies and techniques in digital evidence extrapolation and analysis of mobile devices. Graduates return home

with issued equipment necessary to perform forensic examinations.

 

MDE 20-01

Date: January 6-31, 2020

This class is limited to 25 students. Travel to the NCFI on Sunday, January 5, 2020 and return on Friday, January 31, 2020.

 

Network Intrusion Response Program (NITRO)

A 3-week intermediate course designed to train investigators on effective methods in the identification and collection of volatile data in response to network-based crime. Graduates return

home with issued equipment to respond to network intrusions.

 

NITRO 20-01

Date: January 6-24, 2020

This class is limited to 17 students. Travel to the NCFI on Sunday, January 5, 2020 and return on Friday, January 24, 2020.

 

 

Advanced Examiner Courses

These courses are designed for individuals who currently conduct digital forensic exams or network intrusion investigations, and who have a solid understanding of digital forensics.

 

Advanced Forensics Training (AFT)

A 2-week course for experienced forensic examiners focused on advanced digital forensic data recovery.

 

AFT 20-01

Date: December 9-20, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, December 8, 2019 and return on Friday, December 20, 2019.

 

AFT 20-02

Date: January 13-24, 2020

This class is limited to 25 students. Travel to the NCFI on Sunday, January 12, 2020 and return on Friday, January 24, 2020.

 

Advanced Mobile Device Examiner (AMDE)

A 5-day course for experienced mobile device examiners who will gain advanced investigative

methodologies and techniques in digital evidence extraction and analysis of mobile devices.

 

AMDE 20-01

Date: October 21-25, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, October 20, 2019 and return on Friday, October 25, 2019.

 

AMDE 20-02

Date: November 4-8, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, November 3, 2019 and return on Friday, November 8, 2019.

 

AMDE 20-03

Date: November 18-22, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, November 17, 2019 and return on Friday, November 22, 2019.

 

AMDE 20-04

Date: January 20-24, 2020

This class is limited to 25 students. Travel to the NCFI on Sunday, January 19, 2020 and return on Friday, January 24, 2020.

 

Mac Forensics Training (MFT)

A 2-week course for experienced examiners, focused on investigative tools and techniques utilized in digital evidence recovery in a Mac environment.

 

MFT 20-01

Date: December 2-13, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, December 1, 2019 and return on Friday, December 13, 2019.

 

 

Prosecutor/Judge Courses

These courses are designed for Prosecutors and Judges to effectively prosecute and preside over cases involving digital forensic evidence.

 

NOTE: Please direct all prosecutor and judicial officials to the below links to complete application for consideration to attend the courses offered below. The nomination period will end on Friday, July 12, 2019.

 

Prosecutors: https://ncfi.knack.com/digitalevidenceforprosecutors#home/

Judges: https://ncfi.knackhq.com/judge-form#home/

 

Digital Evidence for Prosecutors (DEP)

A 5-day course, which affords prosecutors techniques utilized in cybercrime investigations,

and how to effectively present before the court digital evidence gathered from computers,

mobile devices, virtual storage networks, and other sources.

 

DEP 20-01

Date: October 7-11, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, October 6, 2019 and return on Friday, October 11, 2019.

 

DEP 20-02

Date: November 18-22, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, November 17, 2019 and return on Friday, November 22, 2019.

 

DEP 20-03

Date: December 9-13, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, December 8, 2019 and return on Friday, December 13, 2019.

 

DEP 20-04

Date: January 27-31, 2020

This class is limited to 25 students. Travel to the NCFI on Sunday, January 26, 2020 and return on Friday, January 31, 2020.

 

Advanced Digital Evidence for Prosecutors (ADEP)

A 5-day course, which offers prosecutors an advanced look into criminal investigations that encompass digital evidence analytics, encryption, electronic communications, and social and

cellular networks.

 

ADEP 20-01

Date: October 21-25, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, October 20, 2019 and return on Friday, October 25, 2019.

 

ADEP 20-02

Date: January 13-17, 2020

This class is limited to 25 students. Travel to the NCFI on Sunday, January 13, 2020 and return on Friday, January 17, 2020.

 

Digital Evidence for Judges (DEJ)

A 5-day course that provides judicial officials understanding and insight regarding criminal

investigations which contain digital evidence from computers, mobile devices, virtual storage

networks, and other sources.

 

DEJ 20-01

Date: November 4-8, 2019

This class is limited to 25 students. Travel to the NCFI on Sunday, November 3, 2019 and return on Friday, November 8, 2019.

 

 

This list for all offered classes can also be found on the NCFI public website, www.ncfi.usss.gov.

 

 

All courses offered at the NCFI are solely for state and local law enforcement officers, prosecutors, and judges. All invitational travel, hotel reservations, and class logistics is coordinated by the NCFI.

 


View News
PROD just calling to init appData