The capacities of Ukrainian authorities to deal with computer forensic were enhanced through a specialised course on advanced windows forensics developed by the European Cybercrime Training and Education Group (ECTEG).

The training was conducted in Warsaw, between 6-10 July 2026 and brought together 22 representatives from the Security Service of Ukraine, the National Police of Ukraine, the State Bureau of Investigation, the Office of the Prosecutor General, and the National Academy of Internal Affairs.

This five-day course enhanced participants’ knowledge and capacities in digital forensics of collecting, recovering and analysing electronic evidence. Through a combination of expert-led lectures and practical laboratory exercises, delivered by ECTEG experts, investigators and prosecutors examined in detailed the internal structures of windows files, developed advanced skills in recovering file system metadata, analysing deleted and fragmented files, reconstructing damaged file systems and applying file carving techniques to recover electronic evidence.

The advanced programme also deepened participants’ understanding of both the capabilities and limitations of digital forensic tools through practical exercises in byte-level analysis and the use of open-source forensic solutions.

These skills will enable investigators to independently validate forensic findings, overcome technical limitations where appropriate, and prepare more accurate, reliable reports to support criminal investigations.

This training was conducted under the CyberUA project as part of the longstanding co-operation with ECTEG aiming to provide specialised technical training to strengthen the capacities of Ukrainian law enforcement authorities in cybercrime investigations and handling of electronic evidence.

• CyberUA project
• Cybercrime Programme Office of the Council of Europe (C-PROC)
• Convention on Cybercrime (Budapest Convention)
• European Cybercrime Training and Education Group (ECTEG)