28th OLAF Digital Forensics and Analysts training

DFAT is financed by the European Union Anti-Fraud Programme (UAFP). This programme is implemented by the European Commission (OLAF).

ABOUT OLAF

The European Anti-Fraud Office (OLAF) is the central service of the Commission that according to its mandate and mission is in charge of protecting EU revenue and expenditure through independent administrative investigations into instances of suspected fraud, corruption and any other illegal activity involving EU funds. OLAF is also responsible for investigating serious misconduct by EU staff and members of the EU Institutions.

Besides its investigative work, OLAF coordinates the implementation of the Commission Anti-Fraud Strategy and develops fraud risk analysis and anti-fraud policy measures to support all Commission services in preventing and fighting fraud and irregularities as well as in building a legal framework for better protection of the EU budget

ABOUT INsig2

INsig2 is a company specialized in digital forensics solutions and services. It provides a wide range of services, from consulting and education to equipping laboratories. The company focuses on developing and delivering customized digital forensics courses through their training center, online, and on-site.

With over 5000 hours of training experience, INsig2 has trained numerous law enforcement agencies worldwide and since 2004 delivered expert services to both the private and public sectors. INsig2 offers a range of digital forensics courses from basic to advanced, tailored to meet specific requirements.

FIRST WEEK, COURSE AGENDA

  • Date: 17.-21.11.
  • Classroom: Zurich

Day 1: Basic Computer Forensics, 17.11.

8:00 - 9:00
Opening ceremony for all groups
9:00 - 10:00
Introduction to the course

Introduction to digital forensics

10:00 - 10:30
Coffee break
10:30 - 12:00
Introduction to digital forensics

Computer components and interfaces

12:00 - 13:00
Lunch
13:00 - 14:45
Digital forensic process overview

First responder and crime scene

14:45 - 15:15
Coffee break
15:15 - 17:00
Numbering systems

RAM capture and analysis

19:00
International evening - first week

Day 2: Basic Computer Forensics. 18.11.

8:00 - 10:00
Day 1 review

Validation and acquisition of evidence and hashing

10:00 - 10:30
Coffee break
10:30 - 12:00
Boot sequence

Encryption

12:00 - 13:00
Lunch
13:00 - 14:45
Encryption

Forensic Boot Media

14:45 - 15:15
Coffee break
15:15 - 17:00
Disk structures
19:00 - 22:00
Dinner

Day 3: Basic Computer Forensics, 19.11.

08:00 - 10:00
Day 2 review

Disk structures

10:00 - 10:30
Coffee break
10:30 - 12:00
FAT file system
12:00 - 13:00
Lunch
13:00 - 14:45
FAT file system
14:45 - 15:15
Coffee break
15:15 - 17:00
FAT file system
19:00 - 22:00
Dinner

Day 4: Basic Computer Forensics, 20.11.

08:00 - 10:00
Day 3 review

FAT file system

10:00 - 10:30
Coffee break
10:30 - 12:00
ExFat file system
12:00 - 13:00
Lunch
13:00 - 14:45
ExFat file system

NTFS file system

14:45 - 15:15
Coffee break
15:15 - 17:00
NTFS file system
19:00 - 22:00
Dinner

Day 5: Basic Computer Forensics, 21.11.

08:00 - 10:00
Day 4 review

NTFS file system

10:00 - 10:30
Coffee break
10:30 - 12:00
NTFS file system
12:00 - 13:00
Lunch
13:00 - 14:45
NTFS file system
14:45 - 15:15
Coffee break
15:15 - 17:00
NTFS file system
19:00 - 22:00
Dinner
  • Date: 17. - 21.11.
  • Classroom: Cairo 1

Day 1: Password extraction and data decoding, 17.11.

08:00 - 09:00
Opening ceremony for all groups
09:00 - 10:00
Course and participants introduction

Password analysis

10:00 - 10:30
Coffee break
10:30 - 12:00
Entropy, Encryption, Hashing and passwords
12:00 - 13:00
Lunch
13:00 - 14:45
Hash tables

Mainstream password recovery tools

14:45 - 15:15
Coffee break
15:15 - 17:00
John The Ripper
19:00
International evening - first week

Day 2: Password extraction and data decoding, 18.11.

08:00 - 10:00
Day 1 review

Hashcat

10:00 - 10:30
Coffee break
10:30 - 12:00
Hashcat

Full disk encryption and File based encryption

12:00 - 13:00
Lunch
13:00 - 14:45
BitLocker
14:45 - 15:15
Coffee break
15:15 - 17:00
VeraCrypt
19:00 - 22:00
Dinner

Day 3: Password extraction and data decoding, 19.11.

08:00 - 10:00
Day 2 review

Windows passwords and decryption

10:00 - 10:30
Coffee break
10:30 - 12:00
Windows artifacts
12:00 - 13:00
Lunch
13:00 - 14:45
Ram analysis
14:45 - 15:15
Coffee break
15:15 - 17:00
Ram analysis
19:00 - 22:00
Dinner

Day 4: Password extraction and data decoding, 20.11.

08:00 - 10:00
Day 3 review

Password managers Two-factor authentication

10:00 - 10:30
Coffee break
10:30 - 12:00
Open source intelligence sources and knowledge
12:00 - 13:00
Lunch
13:00 - 14:45
Data breaches
14:45 - 15:15
Coffee break
15:15 - 17:00
Web browsers passwords
19:00 - 22:00
Dinner

Day 5: Password extraction and data decoding, 21.11.

08:00 - 10:00
Default passwords
10:00 - 10:30
Coffee break
10:30 - 12:00
Final exam
12:00 - 13:00
Certification ceremony
13:00 - 14:00
Lunch
  • Date: 17.-21.11.
  • Classroom: Cairo 2

Day 1: UAV (Drone) Forensics, 17.11.

08:00 - 09:00
Opening ceremony for all groups
09:00 - 10:00
Course and student introductions
10:00 - 10:30
Coffee break
10:30 - 12:00
Deep dive into UAV Forensics and how it impacts forensic examination
12:00 - 13:00
Lunch
13:00 - 14:45
Learn of the components and functionality associated with sUAS
14:45 - 15:15
Coffee break
15:15 - 17:00
Learn how UAVs fly and how blackbox data is recorded
19:00
International evening - first week

Day 2: UAV (Drone) Forensics, 18.11.

08:00 - 10:00
Extraction techniques from all components of sUAS
10:00 - 10:30
Coffee break
10:30 - 12:00
Exercises in the extraction of data from the aircraft
12:00 - 13:00
Lunch
13:00 - 14:45
Exercises in the extraction of data form mobile device app and internal storage media on the aircraft and other devices
14:45 - 15:15
Coffee break
15:15 - 17:00
Triaging a sUAS collection for data extensive review
19:00 - 22:00
Dinner

Day 3: UAV (Drone) Forensics, 19.11.

08:00 - 10:00
Interpretation of UAV data files and their storage locations
10:00 - 10:30
Coffee break
10:30 - 12:00
Reading flight logs and visualization of the flight data
12:00 - 13:00
Lunch
13:00 - 14:45
Examination of media files hosted on the UAV and SD storage
14:45 - 15:15
Coffee break
15:15 - 17:00
Introduction to examination of data from the mobile device
19:00 - 22:00
Dinner

Day 4: UAV (Drone) Forensics, 20.11.

08:00 - 10:00
Advanced analysis of data contained in the mobile device app
10:00 - 10:30
Coffee break
10:30 - 12:00
Linking data contained in the Mobile device app and flight logs on the UAV
12:00 - 13:00
Lunch
13:00 - 14:45
Comparisons of data located on an Android and Apple devices
14:45 - 15:15
Coffee break
15:15 - 17:00
Analysis of PixHawk controllers
19:00 - 22:00
Dinner

Day 5: UAV (Drone) Forensics, 21.11.

08:00 - 10:00
Analysis of smart controllers and advanced data links (5G comms)
10:00 - 10:30
Coffee break
10:30 - 12:00
Final Exam
12:00 - 13:00
Certification ceremony
13:00 - 14:00
Lunch

SECOND WEEK, COURSE AGENDA

  • Date: 24.-28.11.
  • Classroom: Zurich

Day 1: Basic Computer Forensics, 24.11.

8:00 - 10:00
Day 5 review

Windows artifacts

10:00 - 10:30
Coffee break
10:30 - 12:00
Windows artifacts
12:00 - 13:00
Lunch
13:00 - 14:45
Windows artifacts

Windows registry

14:45 - 15:15
Coffee break
15:15 - 17:00
Windows registry

File Headers and Carving

19:00
International evening - second week

Day 2: Basic Computer Forensics. 25.11.

8:00 - 10:00
Day 6 review

Compound files File metadata

10:00 - 10:30
Coffee break
10:30 - 12:00
SQLite database

Browser artifacts

12:00 - 13:00
Lunch
13:00 - 14:45
Browser artifacts
14:45 - 15:15
Coffee break
15:15 - 17:00
Browser artifacts

Email Artifacts

19:00 - 22:00
Dinner

Day 3: Basic Computer Forensics, 26.11.

08:00 - 10:00
Day 7 review

Peer-to-Peer File Sharing Cloud Artifacts

10:00 - 10:30
Coffee break
10:30 - 12:00
Cloud Artifacts
12:00 - 13:00
Lunch
13:00 - 14:45
Cloud Artifacts
14:45 - 15:15
Coffee break
15:15 - 17:00
Mac Triage
19:00 - 22:00
Dinner

Day 4: Basic Computer Forensics, 27.11.

08:00 - 10:00
Day 8 review

Mac Triage

10:00 - 10:30
Coffee break
10:30 - 12:00
Linux triage
12:00 - 13:00
Lunch
13:00 - 14:45
Linux triage
14:45 - 15:15
Coffee break
15:15 - 17:00
Linux triage
19:00 - 22:00
Dinner Cruise Experience

Day 5: Basic Computer Forensics, 28.11.

08:00 - 10:00
Day 9 review

Forensic reports

10:00 - 10:30
Coffee break
10:30 - 12:00
Final Exam
12:00 - 13:00
Certification ceremony
13:00 - 14:00
Lunch
  • Date: 24.-28.11.
  • Classroom: Madrid

Day 1: Macintosh Forensics Basic Course, 24.11.

08:00 - 09:00
Opening ceremony for all groups
09:00 - 10:00
Kick-Off & macOS Usage
10:00 - 10:30
Coffee break
10:30 - 12:00
Introduction to macOS
12:00 - 13:00
Lunch
13:00 - 14:45
Live Triage & First Response
14:45 - 15:15
Coffee break
15:15 - 17:00
macOS File System, Snapshots & Encryption
19:00
International evening - second week

Day 2: Macintosh Forensics Basic Course, 25.11.

08:00 - 10:00
CTF review & Mac Acquisition
10:00 - 10:30
Coffee break
10:30 - 12:00
Mac Forensic Workstation, Imaging Formats & Mac Disk Images
12:00 - 13:00
Lunch
13:00 - 14:45
Mounting Disk Images
14:45 - 15:15
Coffee break
15:15 - 17:00
Processing Macs with Forensic Tools
19:00 - 22:00
Dinner

Day 3: Macintosh Forensics Basic Course, 26.11.

08:00 - 10:00
CTF review & SQLite and Plist Analysis
10:00 - 10:30
Coffee break
10:30 - 12:00
macOS Native Apps
12:00 - 13:00
Lunch
13:00 - 14:45
macOS Native Apps
14:45 - 15:15
Coffee break
15:15 - 17:00
Sync Data & iOS Backups
19:00 - 22:00
Dinner

Day 4: Macintosh Forensics Basic Course, 27.11.

08:00 - 10:00
CTF review & macOS System Artifacts
10:00 - 10:30
Coffee break
10:30 - 12:00
App and Device Activities
12:00 - 13:00
Lunch
13:00 - 14:45
Apple AI & Deleted Files
14:45 - 15:15
Coffee break
15:15 - 17:00
Extended Metadata
19:00 - 22:00
Dinner Cruise Experience

Day 5: Macintosh Forensics Basic Course, 28.11.

08:00 - 10:00
Decoding Macs with Forensic Tools & manual Analysis
10:00 - 10:30
Coffee break
10:30 - 12:00
Final exam
12:00 - 13:00
Certification ceremony
13:00 - 14:00
Lunch
  • Date: 24.-28.11.
  • Classroom: Cairo 1

Day 1: Data Science, 24.11.

08:00 - 09:00
Opening ceremony
09:00 - 10:00
Data Sources & Data Types
10:00 - 10:30
Coffee break
10:30 - 12:00
Preparation of (Structured) Data I
12:00 - 13:00
Lunch
13:00 - 14:45
Data Visualization and Visual Analytics
14:45 - 15:15
Coffee break
15:15 - 17:00
Exercises – Data Preparation and Visualization
19:00
International evening - second week

Day 2: Data Science, 25.11.

08:00 - 10:00
Recap Day 1

ETL / ELT

10:00 - 10:30
Coffee break
10:30 - 12:00
Data Structuring & Data Engineering I (relational data)
12:00 - 13:00
Lunch
13:00 - 14:45
Practical Lessons

SQL

14:45 - 15:15
Coffee break
15:15 - 17:00
Exercises

SQL, Data Ingestion, Joins...

19:00 - 22:00
Dinner

Day 3: Data Science, 26.11.

08:00 - 10:00
Recap Day 2

Data Science Project Workflow

10:00 - 10:30
Coffee break
10:30 - 12:00
Bulk Operations on Data, Distributed & Cloud Computing
12:00 - 13:00
Lunch
13:00 - 14:45
Practical Lessons

Working with pandas Dataframes, addressing remote services via API

14:45 - 15:15
Coffee break
15:15 - 17:00
Exercise

Benford’s Law for detecting suspicious money transfers

19:00 - 22:00
Dinner

Day 4: Data Science, 27.11.

08:00 - 10:00
Recap Day 3

Data Science & Data Engineering II (noSQL)

10:00 - 10:30
Coffee break
10:30 - 12:00
Processing unstructured Data
12:00 - 13:00
Lunch
13:00 - 14:45
Practical Lessons

Document data bases and Named Entity Recognition

14:45 - 15:15
Coffee break
15:15 - 17:00
Exercise

Using NER for indexing large text corpora in document databases

19:00 - 22:00
Dinner Cruise Experience

Day 5: Data Science, 28.11.

08:00 - 10:00
Course Recap, Open Questions

(Optional) Outlook on (Generative) AI

10:00 - 10:30
Coffee break
10:30 - 12:00
Final Exam
12:00 - 13:00
Certification ceremony
13:00 - 14:00
Lunch
  • Date: 24.-28.11.
  • Classroom: Cairo 2

Day 1: Tableau Desktop Fundamentals & Intermediate, 24.11.

8:00 - 9:00
Opening ceremony for all groups
9:00 - 10:00
Introduction to the course

Tableau desktop installation Getting started with Tableau

10:00 - 10:30
Coffee break
10:30 - 12:00
Setting up connections and data sources

Simplifying and sorting data Organizing data

12:00 - 13:00
Lunch
13:00 - 14:45
Viewing options and distribution

Specific values review

14:45 - 15:15
Coffee break
15:15 - 17:00
Using multiple measures in a view
19:00
International evening - second week

Day 2: Tableau Desktop Fundamentals & Intermediate, 25.11.

8:00 - 10:00
Day 1 review

Showing the relationship between numerical values Introducing data connection options

10:00 - 10:30
Coffee break
10:30 - 12:00
Data customization

Changing data types

12:00 - 13:00
Lunch
13:00 - 14:45
Data connection options: unions and joins

Data extracts

14:45 - 15:15
Coffee break
15:15 - 17:00
Analyzing data with quick table calculations

Parameters creation and appliance Creating simple calculated fields

19:00 - 22:00
Dinner

Day 3: Tableau Desktop Fundamentals & Intermediate, 26.11.

8:00 - 10:00
Day 2 review

Table calculation review Advanced table calculations

10:00 - 10:30
Coffee break
10:30 - 12:00
Highlighting data with reference lines

Creating and using parameters

12:00 - 13:00
Lunch
13:00 - 14:45
Creating visualizations

Marks Card options

14:45 - 15:15
Coffee break
15:15 - 17:00
Mapping data geographically
19:00 - 22:00
Dinner

Day 4: Tableau Desktop Fundamentals & Intermediate, 27.11.

8:00 - 10:00
Day 3 review

Comparing measures

10:00 - 10:30
Coffee break
10:30 - 12:00
Defining data subsets
12:00 - 13:00
Lunch
13:00 - 14:45
Viewing distributions

Dashboard and stories

14:45 - 15:15
Coffee break
15:15 - 17:00
Exporting options
19:00 - 22:00
Dinner Cruise Experience

Day 5: Tableau Desktop Fundamentals & Intermediate, 28.11.

8:00 - 10:00
Day 4 review

Crosstabs and images for reports

10:00 - 10:30
Coffee break
10:30 - 12:00
Final exam
12:00 - 13:00
Certification ceremony
13:00 - 14:00
Lunch

ABOUT PRAGUE

The 28th OLAF DFAT will take place from 17th– 28th of November 2025. in Prague, Czech Republic. Situated on the Vltava river, Prague is home to about 1.4 million people and it is the capital and largest city of the Czech Republic. The city is home to a number of well-known cultural attractions including Prague Castle, Charles Bridge, Old Town Square with the Prague astronomical clock, the Jewish Quarter, Petřín hill and Vyšehrad. Since 1992, the historic center of Prague has been included in the UNESCO list of World Heritage Sites.

ARRIVAL AND HOTEL DETAILS

Upon arrival at Prague airport or Prague Central Rail station, you will be met by a representative of T.M.D. Travel with the OLAF sign at the exit hall.

For the return transfer, participants will be informed at the hotel and also by e-mail. Contact number for transfers: +385913014013 (Darinko Marković).

Slika
Hotel and training venue

NH Prague City

Mozartova 261/1, 15000 Prague Czech Republic

The Training venue will be in a Hotel NH Prague City. With a large conference area and only a 20-minute walk to the city center, the hotel is in an ideal position for conducting DFAT courses during the day and some exploring and sightseeing in the afterhours. Each participant will be accommodated with an individual room with free wifi, inclusive of breakfast, lunch (inlc. one soft drink), and dinner (incl. one soft drink, beer or wine). Additionally, during the classes, there will be two coffee breaks every day.

SEE ON MAP

TRAINING FACILITIES

Training facilities include four fully equipped, air-conditioned training rooms, one with space for up to 50 participants, and three rooms with space for 20 participants. Right outside each room is the area for coffee breaks and networking.

CONTACT INFO

Project team

INsig2: Martin Bedić, +385916052967, ma**********@****g2.com

T.M.D. Travel: Darinko Marković, +385 913014013, tm********@******om.hr

Important numbers

Universal emergency number: 112

Ambulance (Emergency): 155

Police: 158

Fire Brigade: 150

International code for Czech Republic: +420

Social events

1

International evening, 17.11. - FIRST WEEK

Only for: Basic Computer Forensics, Password Extraction and Data Decoding, UAV (Drone) Forensics

At the International Evening, participants will introduce their countries by offering traditional food and drinks. Each country's place will be marked with a flag. In addition to the individual country displays, there will also be a buffet dinner included as part of the event.

2

Dinner on the River, 20.11.

Only for: Password Extraction and Data Decoding, UAV (Drone) Forensics

During this event, guests will enjoy a private boat evening with a buffet dinner and drinks. During the evening, participants will have time to socialize and enjoy the scenery. The boat, built in 1963, has a unique stylish interior and a pleasant atmosphere. It offers great views of Prague from the indoor salon and the open deck, making it a perfect place for dinner, drinks, and a relaxed evening on the river.

3

International evening, 24.11. - SECOND WEEK

Only for: Basic Computer Forensics, Data Science, macOS Forensics Basic, Tableu Desktop Fundamentals & Intermediate

At the International Evening, participants will introduce their countries by offering traditional food and drinks. Each country's place will be marked with a flag. In addition to the individual country displays, there will also be a buffet dinner included as part of the event.

4

Dinner Cruise Experience, 27.11.

Only for: Basic Computer Forensics, Data Science, macOS Forensics Basic, Tableu Desktop Fundamentals & Intermediate

On this event, participants will enjoy a private evening cruise. A buffet dinner and drinks will be served on board and guests will have the opportunity to socialize and enjoy the panoramic views. The boat is one of the biggest on the Vltava river. After its most recent full renovation, it features stylish interiors and an attractive design. It has a bar on board and plenty of space to move between decks. Perfect for enjoying dinner, drinks, and the views of the city during an evening on the river.

RESTRICTIONS

It is not allowed to take photos or record during the sessions.

ADDITIONAL INFORMATION

Any personal expenses incurred by participants at the venue, such as at the hotel bar or for other amenities not included in the OLAF package, should be settled directly by the participant at the time of purchase.

 

Sharing any information about the course on social media is forbidden.