This is a Spyder Forensics class. This course covers the use various applications and utilities to successfully identify, process, understand and exploit numerous database structures found on iOS, Android, Windows, and Apple systems. Students will gain knowledge of how relational databases function in the storage of records and fields of information to support a front-end application. SQLite will be covered in detail where the attendee will learn how to recover deleted information from Free Pages and unallocated space within the primary and journal files using scripting techniques. Additional databases will then be examined including ESE, LevelDB’s and Binary Plists.

The IACIS Advanced Mobile Device Forensics Training Program is a 36-hour course of instruction, offered over five (5) consecutive days. Take your mobile forensics investigative skills to the next level with our comprehensive course on Advanced Mobile Device Forensics. This class is designed for seasoned forensic examiners and investigators and will equip you with an intricate understanding of Android and iOS file systems.

The IACIS Advanced Mobile Device Forensics Training Program is a 36-hour course of instruction, offered over five (5) consecutive days. Take your mobile forensics investigative skills to the next level with our comprehensive course on Advanced Mobile Device Forensics. This class is designed for seasoned forensic examiners and investigators and will equip you with an intricate understanding of Android and iOS file systems.

The IACIS Applied Scripting Forensic course is a 36-hour intermediate-level course that equips you with practical skills and knowledge to exploit data using various scripting languages. Through instructor-led and hands-on exercises, students will learn to extract data from diverse sources using scripting languages like RegEx, SQLite, Batch, BASH, Python, and PowerShell. Using Linux, we will explore alternate command-line extraction techniques to further exploit unstructured file data. Students will learn to create scripts to extract meaningful and relevant information to support case examinations where automated processes fail to decipher the data. They will use real-world data examples to practice their new skills and ultimately deepen their scripting knowledge beyond standard forensic tools.

Magnet AXIOM Examinations (AX200) is ideal for those who require intermediate-level training with a digital investigation platform that covers cases involving smartphones, tablets, computers, and cloud data in a single collaborative interface. This course is the perfect entry point for examiners who are new to AXIOM. This course is taught by Magnet Forensics and is a four day course.

This class will give you access to the BCFE two week training course as well as automatic admission into the CFCE Certification Cycle. All 2025 BCFE students will receive a laptop computer, write-blocker, USB thumb drive, Forensic Explorer Dongle, training manuals, and other equipment to take home with them at the successful conclusion of the training event. This course will be taught using Windows 11 operating system on the student and suspect images. (Equipment specifics subject to change)

The IACIS CADET (Collecting and Admitting Digital Evidence at Trial) course is a 36-hour class designed for attorneys who deal with computer forensic evidence in criminal cases. After completing this course, attorneys will have a greater understanding of the digital forensic investigative process, including how to collaborate with investigative partners to obtain and preserve digital evidence, how to present this evidence to a lay audience and ensure its admissibility at trial, and how to anticipate and overcome common defenses to digital findings. The course will cover topics that arise throughout the lifespan of a criminal case, ranging from investigation to appeal. This course is intended to introduce computer forensics and related legal issues. No previous knowledge of computer forensics or significant trial experience is expected.

The IACIS Computer Forensics: Real World (Formerly Applied Computer Forensics (ACF)) course is a 36-hour course of instruction taking students through a realistic case scenario built on the Windows 10 Operating System. This class uses the latest versions of the major and emerging forensic tools on the market, to look at different artifacts and lets you determine the strengths and weaknesses of each tool. The class is led by users of the tools (rather than vendor trainers) and examines a real world type case giving students the opportunity to evaluate the software in a unique, open, and honest environment.

The IACIS Cyber Incident Forensic Response (CIFR) class focuses on teaching the combined lists of investigation concepts.  CIFR uses a real network environment in the classroom to simulate a corporate network, integrating actual network and domain architecture into the instruction to increase realism. Students interact with Windows and Linux VMs in the class and are shown how their actions are presented at the local, domain, and SIEM logging levels. The class has a large number of labs, based on a belief the student learns better by doing the task vs reading about the task in bullets on a slide presentation.

This course will provide the student with the understanding of how to accomplish effective investigation of Darknet sites and users. The course will allow Law enforcement to step up their investigative skills to meet the new challenges offered by the anonymity of the Darknet. STRICTLY Law Enforcement, Government, Armed Forces and Police ONLY. This course is taught by Spyder Forensics.

The IACIS Enterprise Cyber Incident Forensic Response (ECIFR) class is a natural follow-on for the IACIS CIFR class. It is an expansion of skills from analyzing a small number of systems using traditional imaging + manual analysis processes, to introducing and building skills that allow the student to analyze systems at scale, building and implementing toolsets to analyze systems spread across the network.

This course is designed to help forensic examiners who lack an understanding of Linux artifacts as well as how to leverage Linux tools for conducting forensic exams. To meet this goal, the students will learn Linux operating system fundamentals and gain proficiency with command line and bash shell scripting to accomplish forensic tasks. This knowledge will be leveraged to learn strategies for analyzing Linux systems. This course assumes the student has some experience doing Windows investigations but little or no experience using and/or analyzing Linux. The only prerequisite for the class is a willingness to type commands rather than click their mouse.

The IACIS Mobile Device Forensics Training Program is a 36-hour course of instruction, offered over five (5) consecutive days. This program will expand the students existing mobile forensic knowledge and skillset. It is designed to provide students with intermediate to advanced skills needed to detect, decode, decrypt, and analyze evidence recovered from mobile devices during mobile device investigations.

The IACIS Mobile Device Forensics Training Program is a 36-hour course of instruction, offered over five (5) consecutive days. This program will expand the students existing mobile forensic knowledge and skillset. It is designed to provide students with intermediate to advanced skills needed to detect, decode, decrypt, and analyze evidence recovered from mobile devices during mobile device investigations.

The course is designed for supervisors or managers who are responsible for supervising a digital forensics unit or laboratory. Topics include understanding digital forensics, managing a multi-generational environment, training and certification of examiners, case and evidence management, and developing quality practices.

This course is taught by SUMURI. The Best Practices in Mac Forensics (MFSC-101) course shows you how and why you are missing evidence using non-native forensic solutions and how to find what is missed by using a Mac to process a Mac.

The Advanced Practices in Mac Forensics (MFSC-201) course provides unparalleled vendor-neutral and tool-agnostic instruction in advanced topics relating to the forensic use and analysis of Apple hardware, technologies, and applications. It is highly recommended that registrants take MFSC-101 before enrolling in MFSC-201. This is because MFSC-201 assumes prior knowledge of Mac Forensics and only offers a limited review of topics covered in MFSC-101. Therefore, it is important for registrants to have experience in Mac Forensics to fully benefit from the MFSC-201 course. To be eligible for SUMURI's CFME certification process, both MFSC-101 and MFSC-201 must be successfully completed. This course is taught by Sumuri, LLC

Open-source intelligence (OSINT) is a 40-hour course of instruction offered over five (5) consecutive days. This program involves the methodical collection and analysis of data gathered from publicly available sources. This encompasses Open-Source Information, Publicly Available Information (PAI), and Commercially Available Information (CAI), which include legally accessible information about individuals or organizations. Utilized effectively by law enforcement agencies, cybersecurity experts, and forensic computer examiners, OSINT techniques enable the parsing of vast datasets to enhance investigative outcomes, solve more cases, and conduct thorough investigations.

The IACIS “Preparing for Lab Accreditation” (PLA) is a three-day course of instruction. This course is designed for examiners, supervisors, managers, and executives that have the responsibility to develop and implement policies and procedures within a digital forensic unit or laboratory in their efforts to obtain accreditation.

This course is designed for the law enforcement professional that needs to leverage volatile memory to find evidence that does not exist on disk. The class will progress just like an investigation.

The WFE Training Program champions a forensic tool-independent approach to learning. This approach allows for a deeper exploration of the underlying subject matter than might be afforded in other programs which are designed to complete a particular task or view/extract a particular artifact. The WFE Training Program is designed to build on and expand the students existing forensic knowledge and skillset and is not an entry level class. Prospective students should reference the “Prerequisites” section elsewhere in this document for additional information about expectations for students.