Between 9 and 11 June 2026, the CyberSEE joint project of the European Union and the Council of Europe organised the Regional workshop on basic digital forensics – from evidence acquisition to analysis and reporting, in Dürres, Albania. The event brought together 24 practitioners from law enforcement and forensic departments across South-East Europe and Türkiye, offering a platform to exchange good practices and enhance operational skills through hands-on exercises and open discussions, with a joint focus on understanding and applying forensic methodologies for secure laboratory management, legal identification, collection, and preservation of digital evidence, as well as the practical analysis of digital artefacts and forensic imaging.
On the first day, the activity covered the fundamentals of digital forensics – lab infrastructure, evidence identification and acquisition, forensic imaging, hashing, and chain of custody – through hands-on exercises using open-source tools. Attendees practised media sanitisation, encrypted disk detection, live RAM acquisition, and artefact examination, and received introductory sessions on mobile, Linux, and network forensics, including browser history, email headers, and wireless forensics.
The second day delved into anti-forensics methods, with practical exercises on steganography, metadata manipulation, anonymity techniques, and data recovery. A session on reporting good practices followed, and participants applied their accumulated knowledge in a scenario-based investigation, receiving feedback and working collaboratively. Operational challenges and cases from participants’ investigative experience were highlighted, discussed, and analysed collectively.
The final day concluded the investigation scenarios and open discussions based on the cases and challenges presented by the participants, allowing them to reflect on lessons learned and consider how to integrate new skills into their daily work.
Overall, the workshop strengthened participants’ abilities in forensic lab management, evidence acquisition and analysis, reporting, and collaborative investigation, reinforcing regional peer networks and promoting shared standards. The emphasis was not only on learning forensic methodologies but also on applying them to realistic investigative scenarios using various forensic tools.
One of the most valuable aspects of the event was seeing participants collaborate to address challenges, test investigative approaches, and develop their analytical skills. As the workshop progressed, operational challenges and cases from participants’ investigative experience were highlighted, discussed, and analysed collectively, providing them with further opportunities to apply new skills and explore the complexities of digital investigations.
The CyberSEE project remains committed to supporting the region’s criminal justice authorities in responding to evolving cyber-enabled threats, including through capacity building activities in line with the Convention on Cybercrime (Budapest Convention) and its Second Additional Protocol, providing structured methodologies for tackling complex cybercrime cases and ensuring the lawful handling of electronic evidence.
Cybercrime Programme Office (C-PROC)