Locked Shields Forensics Challenge Workshop


Locked Shields Forensics Challenge Workshop


16-18 May 2017


Tallinn, Estonia

This 3‐day workshop will be organised after Locked Shields. The workshop will be based on in‐depth analysis of the Locked Shields Forensic Challenge Scenario. 


The aim of the workshop is to exercise forensics practitioners’ ability in intrusion analysis. A hands‐on  lab‐developed from the Locked Shields forensic inject scenario leads analysts through the challenges and solutions. They will identify where the initial targeted attack occurred and which systems were compromised. 

Target Audience 

Locked Shields Blue Team members and/or national representatives. 


In prepared virtual lab environment, every student will be tasked to perform

  • Malicious traffic analysis
  • Ntfs file system analysis
  • File analysis
  • Various OS artefacts analysis
  • User behaviour analysis
  • Malware identification

There will be mix of hands‐on activities, lectures and group discussions. 


This workshop is NOT for decision‐makers, leaders, or administrative personnel. It is a highly technical workshop of instruction designed for technicians who actively engage in hands‐on digital forensic activities as part of their duties. 

Registration info

Please register for the course by visiting the NATO CCD COE website and completing the provided registration form before the deadline. Should you have any questions, please contact: events -at- ccdcoe.org. 
* Before registering, please check the up‐to‐date course information on the NATO CCD COE website