The First Generation of Digital Forensics Specialists Graduates at WB3C with International Diplomas

12.06.2026

Fourteen police investigators from five countries across the region obtained a university qualification in digital forensics and cybercrime investigations, while their institutions received specialised equipment worth €150,000.

Fourteen police investigators from Albania, Bosnia and Herzegovina, Kosovo*, Montenegro and Serbia have successfully completed the first university-level Digital Forensics programme organised by the Western Balkans Cyber Capacity Centre (WB3C) in partnership with the University of Technology of Troyes (UTT), one of France's leading public higher education institutions in technology, engineering and cybersecurity.

The graduation ceremony marked the completion of an intensive educational programme that ran from February 2025 to May 2026, combining academic instruction, practical training, independent research and thesis development. The programme represents the first university qualification of its kind organised by WB3C and one of the region's most significant initiatives aimed at strengthening law enforcement capacities to combat high-tech crime.

The French Training Model Brought to WB3C Classrooms

A unique feature of the programme is that it is based on the original N'Tech Investigator curriculum developed by the French Gendarmerie for the training of its own high-tech crime investigators.

The curriculum has been used for years within French police and gendarmerie structures and was transferred in its entirety to WB3C classrooms, enabling participants from the Western Balkans to follow the same course content, methodology and practical exercises as investigators in France.

The programme was delivered in cooperation with the University of Technology of Troyes (UTT), which oversees the academic component and is recognised as one of France's leading centres for education and research in digital forensics, cybercrime and technological solutions for law enforcement.

1,400 Hours of Training and 60 ECTS Credits

Throughout the programme, participants completed approximately 1,400 hours of theoretical and practical instruction, corresponding to 60 ECTS credits, equivalent to one full academic year of study.

The curriculum covered:

Digital forensics and preservation of electronic evidence;
Cybercrime investigations and legal aspects of digital investigations;
OSINT and CyberPatrol methodologies;
Computer networks, programming and data analytics;
Information security;
Cybercrime psychology;
Investigative methodologies;
Analysis of electronic communications and digital traces.

Particular emphasis was placed on practical work involving real investigative scenarios and the use of specialised forensic tools routinely employed by cybercrime units.

Successful Defence of Final Theses

At the conclusion of the programme, all participants sat for a final examination and defended their professional theses before a panel composed of French professors and instructors involved in programme delivery.

All 14 participants successfully defended their theses and obtained the Professional Bachelor License qualification awarded by the University of Technology of Troyes, demonstrating the high level of expertise and commitment they maintained throughout the fifteen-month programme.

The qualification they earned is internationally recognised and certifies specialised knowledge in digital forensics and cybercrime investigations.

€150,000 Donation of Digital Forensics Equipment

To ensure that newly acquired knowledge can be immediately applied in operational work, WB3C donated specialised digital forensic equipment worth €150,000 to the high-tech crime units from which the graduates originate.

The donation includes:

Data extraction licences;
Write-blocker devices used to preserve the integrity of digital evidence;
High-performance computers for forensic analysis;
Equipment for the storage and analysis of digital evidence;
Additional specialised forensic tools and accessories.

This represents the first equipment donation made by WB3C since its establishment.

Bojan Miranović, on Behalf of the Police Administration of Montenegro: Knowledge, Equipment and Cooperation Are Key to Successfully Combating Cybercrime

The ceremony was attended by Bojan Miranović, Head of the Unit for Combatting High-Tech Crime at the Police Administration of Montenegro, whose officers were among the programme participants.

Addressing the graduates, Miranović emphasised that the programme represents a strategic investment in strengthening the capacities of law enforcement agencies across the region to detect, document and prosecute cybercrime.

He stressed that modern threats require highly specialised expertise, continuous professional development and access to advanced tools, noting that the combination of quality training and appropriate equipment enables law enforcement agencies to respond effectively to growing challenges in the digital domain.

He also highlighted the importance of regional cooperation fostered through the programme, underlining that cybercrime does not recognise national borders and that professional networks, mutual trust and direct communication among investigators are essential for successful international investigations.

French Expertise for a Safer Region

The programme was delivered by French professors, experts and practitioners, including Reza El Galai, UTT's leading expert in digital forensics and cybercrime investigations; Marc Terouanne, specialist investigator in new technologies and cybercrime; and Ljuban Petrović, a digital forensics and cybersecurity expert with international experience gained in Germany, including work with Siemens.

By combining the academic excellence of the University of Technology of Troyes with the operational experience of the French Gendarmerie, the programme provided participants with access to the latest methodologies, techniques and tools used by some of Europe's most advanced cybercrime investigation systems.

WB3C Supporting the Region's Cyber Resilience

For WB3C and its partners, the programme demonstrates that long-term investment in education, equipment and international cooperation creates sustainable capacities that contribute to a safer digital environment and a stronger institutional response to cyber threats.

The programme is of particular importance to the Western Balkans in the context of the region's European integration aspirations, as it contributes to strengthening law enforcement capacities and raising cyber resilience levels necessary for alignment with European security standards, combating cybercrime, and fulfilling obligations under Chapter 24, while supporting the region's integration into the broader European security and cyber ecosystem.

Key Facts

Programme: Digital Forensics for Police Investigators
Organisers: WB3C and the University of Technology of Troyes (UTT), France
Duration: February 2025 – May 2026
Training Volume: Approximately 1,400 hours
Academic Value: 60 ECTS credits
Number of Graduates: 14
Participating Countries: Albania, Bosnia and Herzegovina, Kosovo*, Montenegro and Serbia
Value of Equipment Donation: €150,000
Significance: The first university-level Digital Forensics programme organised by WB3C and the first equipment donation made by the Centre.

* This designation is without prejudice to positions on status and is in line with UNSCR 1244 and the ICJ Opinion on the Kosovo Declaration of Independence.

Other news and events

OSINT and the dark web: supporting anti-drug investigations

This week at WB3C, we concluded a four-day OSINT – Dark Web training for anti-drug police units, coming from law enforcement units from across the Western Balkans. The course was designed for police officers working in drug units and joining a WB3C training for the first time.
The focus was practical: how publicly available information can support internet-based investigations, from identifying potential threats and collecting digital evidence to producing actionable intelligence for operational decision-making.
Over four days, participants worked through the fundamentals of OSINT, evidence preservation, online protection and anonymisation, social-network investigations, investigative checks, the dark web, and structured data-collection planning. Particular attention was given to preserving the integrity of digital evidence and navigating online environments safely and securely.
The training was delivered by Nicholas Michee from OFAST, France, together with Cyril CORRIAS, WB3C’s cybercrime trainer. Combining specialist anti-drug investigation experience with cybercrime expertise, they guided participants through the technical and investigative aspects of using open-source information and online environments in support of operational work.
Thank you to Nicholas Michee and our partners at OFAST, France, for their cooperation and expertise, and to Cyril Corrias for his contribution to the training. Thank you also to the participating officers for four days of focused practical work and professional exchange.

“We just got hacked!”

Yesterday, we wrapped up “We just got hacked”, a basic three-day technical training on incident response for entry level system administrators and cybersecurity specialists from regional public institutions to work through what happens after a security alert becomes a real incident: how to triage it, identify what matters first, analyse logs, trace the likely attack vector and examine suspicious files for indicators of compromise.

Participants worked with the MITRE ATT&CK framework, connecting investigative findings with attacker tactics and techniques, and looking at how those findings can be translated into practical hardening and preventive measures. The objective was not simply to understand how an incident happened, but to use that analysis to reduce the organisation’s exposure to similar attacks in the future.
The training was delivered by Jakub Bajera and Krzysztof Chudzik from NASK – Naukowa i Akademicka Sieć Komputerowa / Research and Academic Computer Network, Poland. We also thank our funding partners at URSIV, Urad Vlade Republike Slovenije za informacijsko varnost for their continued support to WB3C and to the development of cybersecurity capacities across the Western Balkans.
Certificates are awarded by Jean-Pierre Bonnet, JP BNT, our new WB3C colleague working across cybercrime and cybersecurity.

WB3C meets critical infrastrucutre operators in Prishtina

During a recent mission to Prishtina, WB3C joined CIVIPOL colleagues working on a Gap and Needs Assessment related to the protection of critical infrastructure and public spaces.
While the CIVIPOL assessment focused particularly on the institutional and legislative framework, including the role of the Ministry of Interior and alignment with the EU Critical Entities Resilience (CER) Directive, WB3C used the opportunity to engage directly with critical infrastructure operators and better understand their operational needs.
Together with Shkumbin Saneja from the Ministry of Digitalisation and Public Administration, WB3C met representatives from several key sectors: Arijeta Pajaziti Qerimi and Uran Thaci from energy, Adelina Dumani-Hulaj from Prishtina International Airport, Gazmend Gashi from transport/aviation, Arianit Maraj from telecommunications and Arbnor Imeri from the banking sector.
The discussion provided a useful cross-sector view of existing gaps, operational needs and capacity-building priorities. Despite the differences between sectors, a number of common areas of interest emerged.
This forms part of a wider regional process. WB3C will continue meeting key critical infrastructure stakeholders across the Western Balkans to better understand both sector-specific and shared needs, and to use these findings to shape a training and capacity-building plan tailored to the realities operators are facing.
This work is being carried forward in synergy with our partners under the EU-funded CEPS project, linking institutional assessments with the operational perspective of those responsible for running and protecting critical services.