Tribal Justice Agencies

DF205 Intermediate Digital Forensic Analysis: SQLite Primer

Mobile devices dominate the intake list, and the desks of most digital forensics analyst globally. Devices are becoming more secure, with an increase in security the need for detailed analysis is increasing as well. SQLite is a self-contained, serverless database engine. It is found on nearly every operating system and dominates iOS, Android, and macOS as one of the most prevalent and relevant data storage mechanisms. Rather than hope our forensic tools support the newest applications or be tethered to how a certain utility parses data we can arm ourselves with the skills and techniques needed to conquer the analysis of nearly any application.

What is SQLite and how to identify and analyze logically
Recognizing relevant locations of valuable data within SQLite database.
Develop skills needed for crafting custom SQLite queries.
Learn how to recognize and decode a variety of common timestamp formats.
Learn how to perform SQLite analysis with automation.

FC105 Financial Records Examination and Analysis

This course covers the acquisition, examination, and analysis of many types of financial records, including bank statements and checks, wire transfer records, and business records. Topics include recognizing and investigating common indicators of fraud, using spreadsheets to facilitate analysis and pattern recognition, and financial profiling. There is a strong focus on presenting financial evidence in multiple modalities: spreadsheet data outputs, graphic representations, and written/oral presentations.

*Introduction to analysis. Best practices. Finding patterns. Indicators of fraud. Presenting your findings.
*Financial records. Bank records. Business documents.
*Financial profiling. Methods of profiling. Reasons to create a profile. Creating a profile.
*Hands-on experience. Work a mock financial case as part of an investigative team.

FC101 Financial Investigations Practical Skills

This course provides hands-on investigative training at a basic level. Students develop the practical skills, insight, and knowledge necessary to manage a successful financial investigation from start to finish, including the acquisition and examination of financial records, interview skills, and case management and organization. Additional topics include forgery and embezzlement, financial exploitation of the elderly, working with spreadsheets, financial profiling, and state-specific statutes and legal issues.

*Emerging issues. Current trends in various types of financial crimes. Recent cases and their implications.
*Financial records. Learn to obtain and manage bank records, including basic spreadsheeting skills.
*Working with data. Extract leads and draw conclusions from bank records and other financial data.
*Hands-on experience. Work a mock financial case as part of an investigative team.

Tradecraft and Value of a Public Safety Cyber Attack

The Public Safety Threat Alliance Intelligence team will walk through the most frequent and impactful attack paths observed by threat actors targeting public safety organizations around the world. Using the MITRE ATT&CK matrix, we will breakdown the tradecraft observed targeting emergency services, and detail the importance of understanding the critical steps of the kill chain. Additionally, we will unveil insights from the criminal underground to highlight what they believe are the most valuable aspects of public safety.

Breaking the Triage Myth: The importance of Time to First Evidence

Digital forensics veterans Alan McConnell and Jeff Bell will discuss the importance of triage in investigations and its role in quickly finding and prioritizing evidence in this webinar. We will get into the idea of true triage, which centers on quickly locating evidence and moving the investigation forward FAST. We will discuss some of the issues with current thoughts regarding triage and how thorough block level hashing can help solve them. True triage tools utilizing cutting-edge technologies can drastically improve case turnaround times, cut investigator time on scene, and cut costs while simultaneously clearing out evidence backlogs. We will demonstrate some of the available technologies that can facilitate your digital forensics investigations and present real-world instances of the advantages we have discussed. Come learn how to conduct more efficient investigations at this training event by employing true triage with cutting-edge technology.

The Brain Behind The Badge

Throughout your career, training is an essential part of your job which gives you the ability to react without having to "think" about what you are doing. Brain science is the reason WHY some reactions are different, and it occurs unconsciously. Why do you remember colors, smells, sounds, tastes, or textures but cannot remember how many times you fired your weapon or the exact timeline of certain events? Why does unintentional recall happen when we hear a certain noise? Why does our "thinking brain" shut down, as do many bodily functions, when we are stressed? Why do we sometimes lose the ability to put words to situations and react only with our "senses"? During this session, we will look at what actually happens in your brain and how it impacts you, your career, and your family and how you can create a plan to offset stressors and mitigate stress.

Securities Fraud and Tax Fraud and Money Laundering, Oh My! - A Case Study Endeavor

Prosecutors from the New York State Attorney General's Office will go through a nationwide case study involving a near-decade long Ponzi scheme perpetrated on sophisticated investors. We will take a look at how the fraud started, and went undetected for so long, while reviewing the elements of securities fraud, tax fraud and money laundering.

FC122 Intellectual Property Theft Training

This course introduces the problem of intellectual property theft and provides tools, techniques, and resources for investigating and prosecuting these crimes. A combination of lecture, discussion, and interactive exercises illustrates the potential dangers and economic repercussions of counterfeit products, as well as best practices and techniques for investigating IP theft. Students are provided with a state-specific folder that includes relevant statutes, sample organizational documents for IP investigations, and additional resources for investigators and prosecutors.

This course is presented in collaboration with the National Association of Attorneys General (NAAG).
Awareness. Types of IP crimes. The criminals who commit these crimes. Impacts and dangers.
Investigation. Online and traditional techniques. Working with brand experts and the private sector. Large amounts of evidence. Resources.
Statutes. Prosecutorial theories. State-specific discussion.
Hands-on experience. Work with real counterfeit products. Identify fakes with expert guidance.

FC102 Tools and Techniques for Financial Investigations

This course provides an overview of the actions investigators can take at the outset of a financial crime investigation. Students learn to ask critical questions, gather documentation, and analyze information for leads. Topics include obtaining and working with financial records, red flags in financial cases, money laundering, investigative strategies for different types of financial crimes, and commingled funds.

IA102 Introduction to Link Analysis

This course introduces analysts to the broader concepts of connecting the dots through link analysis. A critical portion of conducting a successful analytical investigation is the ability to link together and understand the complexities of the connectedness between people and organizations. Introduction to Link Analysis (ILA) expands on the basic principles of link and association analyses explored in the Foundations of Intelligence Analysis Training (FIAT) while building a framework for more advanced methods such as social network analysis.

Expanding basic knowledge of link and association analysis
Explaining the process of social network analysis
Understanding the visual mapping and mathematical components associated with link and social network analyses

Pages