„Co-funded by the Prevention of and Fight against Crime Programme
of the European Union“
Training programme “Forensic investigation in a Virtual Environment and hidden crime information
detection”
The training programme is designed for law enforcement officers who perform criminal investigations of
virtual and cloud computing environments.
Law enforcement agents seeking to successfully investigate cybercrimes must know the basic virtual and
cloud computing environment operating principles, criminal concealment capabilities, cyber-crime
evidence collection techniques in virtual and cloud computing environments. The aim of this training
programme is to provide knowledge which would help to reduce international cybercrime damage by
stopping these crimes in a timely manner. The training programme includes an analysis of cyber security
vulnerabilities, cybercrime in cloud computing environments, practices applied in the EU and LT, and
experience in developing of training programmes.
This training programme covers the topics such as the main concepts of virtualisation and cloud computing,
challenges for virtualisation, forensic investigation of virtualisation technologies for personal use and
corporative use, basic on encrypting, steganography, data bases and virtualisation technologies for
cybercrime.
The topic on challenges for virtualisation includes application of virtualisation technologies, explanation
where are data, who does manage data, what are means for forensic investigation, how to investigate data
in the cloud.
The forensic investigation of virtualisation technologies for personal use is going into detail, how to identify
the use of virtualisation technologies at in-situ search and inspection, the most popular virtualisation
technologies for personal use (Google Drive, Dropbox, OneDrive, iCloud, Box, Spideroak, etc.), how to
collect information from typical virtualised environments, the most often used virtualised services (e-mail,
contacts, calendars, documents, spreadsheets, music, photos, videos, slideshows, fileshares, media
streaming, desktop apps/access), how the access rights are organised, users authentication, how an
additional information could be collected using available information (using other user accounts), the
commonly used virtualisation technologies with mobile access in accordance with mobile technology
groups (iPhone, iPad, Android, Windows Mobile, BlackBerry, Mobile Browser), the commonly used the
social internet services that could be used as virtualisation technologies (Facebook, Instagram, etc.),
collection of big data, the usage of remote access to forensic data storage, the typical problems and their
solutions scenarios.
The forensic investigation of virtualisation technologies for corporative use is focusing on the commonly
used virtualisation technologies in business, Citrix virtual environment and search of evidences in Citrix
virtual environment (XENServer), Vmware virtual environment and search of evidences in Vmware virtual
environment (ESXi), Microsoft virtual environment and search of evidences in Microsoft virtual
environment (Hyper-V), how to proceed at detection of the usage of virtualisation technologies at in-situ
search in company.
Encrypting topic includes the presentation of the methods and means of data encrypting potentially used
to hide the criminal information in computers and in virtual environment, methods and means for
detection, extraction and storage for further investigation of encrypted data and encrypted files.
1
„Co-funded by the Prevention of and Fight against Crime Programme
of the European Union“
Steganography topic focuses on the methods and means of steganography potentially used to hide the
criminal information in computers and in virtual environment, methods and means for detection,
extraction and storage for further investigation of data and files hidden by using steganography methods.
Data bases topic highlights an expertise of data bases.
Topic on vulnerability of IS backed out by data bases focuses on SQL injection, forensic of data bases
vulnerability and search crimes footprints.
Topic on virtualisation technologies for cybercrime explains the mechanisms of DDOS and anonymization.
The training programme is tailored both for in the class-training and learning remotely.
2