e-DiFTA 2027 · First edition · European Digital Forensics Training Alliance
Hands-on digital forensics training in Prague
Eight specialised courses for law enforcement, military digital forensic personnel and private-sector investigators. Five days, one venue, 22–26 February 2027.
All courses run in parallel, Monday to Friday, with 35 training hours each. Every participant who passes receives an official certificate recognising the training hours.
Learn to use AI and large language models as investigative tools – and to recognise how criminals misuse them – with hands-on work on LLMs, RAG systems, AI agents and the EU AI Act.
Hands-on intermediate course in advanced Android and iOS analysis: OS internals, encryption, manual SQLite and plist parsing, cloud artefacts and validating what your tools report.
Acquire and analyse RAM from live machines: live forensics and incident response, memory imaging, Windows artefacts analysis from memory, password recovery and in-depth work with the various memory analysis frameworks.
Practical open-source intelligence for investigators: a secure OSINT environment, advanced search, SOCMINT, breach data, metadata, image verification, geolocation, the dark web and evidential reporting.
Expert-level Windows 11 forensics over five days: BitLocker, WSL and Sandbox, Registry and user activity, Helium apps, OneDrive, Chromium browsers and SQLite exploitation.
A 35-hour advanced course on extracting and analysing data from drones (UAS), their controllers and mobile apps – DJI, ArduPilot, PX4 and FPV – using non-destructive, court-ready workflows.
Investigate network intrusions and ransomware using host-based evidence: traffic artefacts, live triage, memory analysis, Windows event logs and Registry persistence, and attack timelines.
One week in Prague. Eight courses. Taught by examiners who work real cases.
e-DiFTA is an independent digital forensics training initiative organised by INsig2, Spyder Forensics and WINDIFE, bringing together practitioners from across Europe and beyond. It supports seasoned forensic examiners refining advanced techniques as well as professionals who are still building their investigative skills. Attendance is limited to law enforcement personnel, military personnel engaged in digital forensic activities and private-sector investigators.
Hands-on from day one
Labs and exercises on real artefacts and datasets, with open-source and leading commercial forensic tools.
Small, focused groups
Each course has a limited number of seats, so there is time for questions and one-to-one help.
Official certificate
Participants who pass receive an official e-DiFTA certificate recognising the training hours.
Practitioners only
Exclusively for law enforcement, military digital forensic personnel and private-sector investigators, so you learn alongside people doing the same work.
How it works
From registration to the first lab
Choose your course
Look through the eight courses and pick one per participant.
Register online
Fill in the form with your official work email and invoicing details. Registration is open until the training starts – from 24 January 2027, organisations with a purchase order (PO) and private individuals with full payment before the start.
Pay the invoice
Pay by bank transfer by 23 January 2027, or within 30 days after the event if your organisation sends a purchase order (PO). Your seat is reserved once payment or the PO is received and confirmed by email: first paid (or PO received), first confirmed.
Book your hotel
After confirmation you receive the booking link for the €90 participant rate, guaranteed for bookings made by 23 January 2027.
Schedule and fee
Five full days, 22–26 February 2027
All eight courses run in parallel at NH Prague City. Lunch and two coffee breaks are included every day.
Every day, the same rhythm
Monday to Friday, 22–26 February 2027. The same timetable for all eight courses: 7 training hours a day, 35 in total.
Mon22Feb
Tue23Feb
Wed24Feb
Thu25Feb
Fri26Feb
Morning session
Coffee break
Buffet lunch
Afternoon session
Coffee break
End of the training day
Registration fee
€2,500per participant full five-day course
5 days, 35 training hours of hands-on training (08:00–17:00)
Official certificate of successful completion, recognising the training hours
All training materials, training licences and computers provided
Buffet lunch and morning and afternoon coffee breaks
Registration is open until the training starts (from 24 January 2027: organisations with a purchase order, private individuals with full payment before the start). Seats are allocated on a “first paid (or PO received) – first confirmed” basis: your seat is reserved once payment or a purchase order (PO) is received, and confirmed by email. Pay by bank transfer by 23 January 2027, or within 30 days after the event if your organisation sends a purchase order (PO).
Registering several participants? Email training@e-difta.eu for a quotation or more information.
Travel and accommodation are not included. A discounted room rate is available at the event hotel.
VAT and invoicing · invoices are issued by WINDIFE, France
Private individuals
French VAT 20%
Organisations in France
French VAT 20%
Organisations outside France
No French VAT with a valid VAT number, TIN or EIN (reverse charge)
Room rate€90 per night, standard single room with breakfast, 12% VAT and city tax included
BookingLink and promotional code are sent after your registration is confirmed. The participant rate is guaranteed for bookings made by 23 January 2027; later bookings are subject to availability.
CancellationFree up to 14 days before the event, later one night is charged
Attendance is intended exclusively for law enforcement personnel, military personnel engaged in digital forensic activities and private-sector investigators. The courses suit both experienced forensic examiners and professionals who are still developing their investigative skills – check the prerequisites on each course page.
What is included in the fee?
Five days of hands-on training (35 training hours), an official certificate of successful completion recognising the training hours, a buffet lunch and morning and afternoon coffee breaks every day. All training materials, training licences and computers are provided by the organisers. Spyder Forensics courses also include a student manual and lab exercises.
Is VAT charged on the registration fee?
Invoices for e-DiFTA are issued in France by Winkler Digital Forensic Expertise (WINDIFE), Antibes, so French VAT rules apply:
Private individuals: French VAT at the standard rate of 20% applies when you register and are invoiced as a private individual.
Entities established in France: companies, agencies, organisations and public administrations established in France are charged French VAT at 20%.
Entities established outside France: companies, agencies, organisations and public administrations established outside France can be invoiced without French VAT. To benefit from this, a valid VAT number, Tax Identification Number (TIN) or EIN must be provided during registration, as it must appear on the invoice.
For entities established in the EU, the VAT treatment is based on Articles 283-2/283-3 of the French General Tax Code (CGI) under the reverse-charge mechanism. For entities established outside the EU, it is based on Article 259-1 of the CGI. When invoiced without French VAT, the recipient is responsible for declaring and accounting for any VAT or equivalent tax in its own country.
Can I register for more than one course?
No. All eight courses run in parallel from Monday to Friday, so each participant attends one course for the full week.
Is there a registration deadline?
No. Registration is open until the training starts on 22 February 2027. From 24 January 2027, organisations can register only with a purchase order (PO); private individuals can still register and pay the full fee by bank transfer before the training starts, as long as seats are available. If the course you choose is already full, you can still register: we will notify you as soon as possible, put you on the waiting list and let you know if a seat becomes available.
Do participants receive a certificate?
Yes. Every participant who passes the course receives an official e-DiFTA certificate confirming successful completion of the class and recognising the 35 training hours completed.
Mastering RAM and Volatile Data ends with a knowledge evaluation based on a real case scenario, and Advanced Drone Forensic Analysis (ADFA) ends with a student knowledge assessment.
Is there a special hotel rate?
Yes: €90 per night for a standard single room including breakfast, 12% VAT and city tax (CZK 50, about €2). Double occupancy costs €12 extra for the second breakfast plus €2 per night for the second city tax. The booking link and promotional code are sent after your registration is confirmed. The participant rate is guaranteed for bookings made by 23 January 2027; later bookings are subject to availability.
Seats are limited in every course
Seats are allocated on a “first paid (or PO received) – first confirmed” basis, and registration is open until the training starts (from 24 January 2027: organisations with a purchase order, private individuals with full payment before the start). Register for one course per participant and pay the invoice by bank transfer by 23 January 2027, or within 30 days after the event with a purchase order (PO).
