As part of ongoing efforts to strengthen cybercrime investigative capabilities in Ukraine, the Council of Europe’s Cybercrime Programme Office (C-PROC) delivered two specialised training courses for Ukrainian law enforcement officials, on Live Data Forensics and Windows Malware Investigations.
These trainings were conducted under the CyberUA Project: Strengthening capacities on electronic evidence of war crimes and gross human rights violations in Ukraine, part of the Council of Europe’s Action Plan for Ukraine “Resilience, Recovery, and Reconstruction” (2023–2026), at the Polish Police Academy, between 7–11 and 14-18 July 2025.
The Live Data Forensics course enhanced participants' capacity to secure volatile electronic evidence during on-site operations, including procedures for live system interaction, legal considerations, and RAM analysis.
The Windows Malware Investigations course addressed major malware threats to national infrastructure, focusing on identification, mitigation, and compliance with international standards, including the Convention on Cybercrime (Budapest Convention).
Each course combined theory, hands-on exercises, and real-time scenarios. Practical modules included live system responses, static and dynamic malware analysis, and drafting forensic or malware reports.
Representatives from Ukrainian law enforcement agencies participated to our training courses, including the Security Service, State Bureau of Investigation, National Police, and the Office of the Prosecutor General. The participants engaged actively throughout the course and appreciated its practical orientation and well-structured methodology. Many expressed confidence that the knowledge and skills acquired will enhance their everyday work.
The CyberUA project remains committed to building sustainable, long-term capacity in cybercrime and electronic evidence handling for Ukrainian law enforcement authorities.
- CyberUA project
- The Convention on Cybercrime (Budapest Convention)
- Cybercrime Programme Office of the Council of Europe (C-PROC)
- ECTEG



