Project description
Being the initial actors in contact with potential electronic evidence, Law Enforcement First responders (patrol police officers, detectives, border and tax controllers) are crucial within the forensic process, influencing the efficiency of criminal investigations. This self-paced e-learning package focuses on essential IT forensics and IT crime knowledge for first-line police officers without IT expertise.
The deliverable also solves the ever-challenging “pre-requisite” topics required before residential training, while providing a common sound reference for all Law Enforcement First responders and attendees to advanced-level IT forensics courses.
With an expected audience of over 1.5 million first-line officers in Europe, this course package is available free of cost to all Law Enforcement Agencies (LEA), enabling additional organisation or country-related content to be included.
The training materials are kept up-to-date and maintained by a core group of EU LEA cybercrime experts, allowing to:
- Identify and seize potential electronic evidence, including “live data” forensics.
- Gain awareness on digital forensics, cybercrime, the Internet and its services, the Internet of Things, encryption/decryption, the dark web, cryptocurrencies, and other topics.
- Assist victims of crimes facilitated by the use of new technologies when taking a complaint (asking specific crime-related questions), starting a criminal case, and providing first help and basic advice on these types of crimes.
- Advise on how to use the NOMORERANSOM tools and other non-commercial solutions.
- Facilitate communication, reporting and further investigation, by explaining the types of traces that can be recovered by specialised forensic examiners and how they may contribute to investigative processes.
- Serve as a repository or knowledge base of cyber essentials.
Topics covered
The training addresses key issues encountered on the field, including networks, the Internet of Things, devices and technologies (mobile devices, etc.), e-evidence and first responder guidelines, online child sexual abuse and exploitation, cryptocurrencies, the dark web, Open Source Investigations (OSINT). It includes ‘serious games’ that combine skills and topics to solve online exercises in a gamified environment.
Background and history
An ECTEG flagship initiative, eFirst came to life in 2013 to provide First responders with basic knowledge of digital forensics tools and practices, combining live data forensics with general awareness and understanding of cyber-dependent and cyber-enabled crimes.
This initial version was translated into over 14 EU languages (plus some additional ones via international partners), and localised to match national guidelines and refer to each country’s legal framework. Numerous forces and Units deployed it in the EU and beyond, including CEPOL (via LEED e-learning platform), Brussels Local Police (Belgium), Polícia de Segurança Pública (Portugal), Baden-Wuerttemberg State Police College (Germany), Norwegian Police University College (Norway), Bundeskriminalamt (BKA – Germany), French Customs (France), An Garda in cooperation with University College Dublin (Ireland), Public Prosecutors Office (Netherlands), Latvian Police (Latvia), Polish Police (Poland), Finnish Police University College (Finland), Belgian Federal Police (Belgium), Council of Europe (via Glacy+ and iProceeds projects), Thailand (thanks to the cooperation with UNODC).
Development: eFirst 2.0, 2.1 versions and next steps
In 2023, a team of cybercrime experts from Law Enforcement Agencies in the European Union began updating and optimising the product.
The eFirst 2.0 version, launched in November 2024, features indispensable content updates, a streamlined training path, up-to-date electronic evidence good practices, improvements in the interface and seizure tips requested by the end-users. As of January 2026, the 2.1 version is available, incorporating two new “serious games”, a revamped module on Lawful Decryption, and many tweaks to keep pace with digital trends in cybercrime investigations and techniques.
The next steps for 2026 involve:
- Translation with an internal system and native reviewers into EU languages and further localisation, with regular update cycles.
- Translation in other non-EU languages, by international partners, to aid in an inclusive and global fight against cybercrime.
Development: eFirst Judicial version
Since summer 2026, a spin-off product for Magistrates, Judges and Prosecutors, in cooperation with Eurojust and the European Judicial Cybercrime Network (EJCN) is available. It incorporates procedural and legal aspects into the existing content. Once installed, it can also be used as a knowledge base or repository.
Project partners and contributors
These LEAs have collaborated in developing the training material (first version and updates):
- Polícia de Segurança Pública (Portugal)
- Portuguese Judicial Police (Portugal)
- Portuguese National Guard (Portugal)
- Polish Cybercrime Bureau (Poland)
- Politie Academie (Netherlands)
- Swedish Cyber Crime Center (Sweden)
- Swedish Customs (Sweden)
- An Garda Schíochána (Ireland)
- Baden-Wuerttemberg State Police College (Germany)
- Guardia Civil (Spain)
- Polizia di Stato (Italy)
- Servizio Polizia Postale e delle Comunicazioni (Italy)
- Hellenic Police (Greece)
- Danish Police (Denmark)
- Finnish Police University College (Finland)
- Universidad Autónoma de Madrid (Spain)
- Romanian Police (Romania)
- Romanian Prosecutor Office (Romania)
- French Gendarmerie (France)
- Cypriot Police (Cyprus)
- Norwegian Police University College (Norway)
- Antwerp Local Police (Belgium)
- Brussels Local Police (Belgium)
- Hessen Police Academy (Germany)
- Eurojust and EJCN – EU Judicial Authorities
The project’s continuity is also possible thanks to funding from the European Commission and the kind support of University College Dublin, Europol, CEPOL, the Council of Europe, OSCE and UNODC.
Languages
The main version is developed in English. Localised versions in EU and additional languages will be produced after summer 2026.
The translation process begins with testing 3 languages: French, Portuguese, and Polish, and will follow LEAs’ requests for the following language versions.
These translations will be added when they become available, as they imply checks by native speakers of each language.