AFP-FIN
Digital Forensics & Investigation
The AFP-FIN track trains digital investigators and forensic analysts specialised in African banking and financial environments. It covers post-incident investigation, collection of legal evidence, analysis of digital fraud and preparation of court files under WAEMU, CEMAC and OHADA legislation. The ACRC Cyber Range has dedicated forensic environments.
Who it is for
- Digital investigators and forensic analysts at financial institutions
- CERT/CSIRT team members responsible for incident response
- Inspectors and auditors specialised in digital fraud
- Judicial police officers and judges handling financial cybercrime
Certification levels
AFP-FIN Foundation
- Prerequisites
- Basic knowledge of systems and networks
- Total duration
- 3 days (21h)
- Exam format
- 50-question multiple-choice test + disk image analysis (3h, Cyber Range)
- Practical exam location
- ACRC Cyber Range
- Validity
- 3 years (recertification required)
Curriculum
- 3h
Legal framework of digital forensics in Africa (law of evidence, OHADA, national legislation)
Lecture
- 3h
Core principles: chain of custody, integrity, admissibility of evidence
Lecture + exercise
- 5h
Windows forensics: acquiring and analysing disk images
Cyber Range lab
- 4h
Analysis of logs and system artefacts (Event Logs, Prefetch, Registry)
Cyber Range lab
- 4h
Basic network forensics: PCAP capture, analysis of suspicious traffic
Cyber Range lab
- 2h
Writing a forensic report admissible in court
Writing workshop
Skills acquired
- Acquire digital evidence while preserving the chain of custody
- Analyse a disk image and extract forensic artefacts
- Write a forensic report admissible in African jurisdictions
- Respect the WAEMU/CEMAC/OHADA legal framework for digital investigation
AFP-FIN Practitioner
- Prerequisites
- AFP-FIN Foundation or incident response experience
- Total duration
- 5 days (35h)
- Exam format
- Full investigation of a simulated banking environment (8h, Cyber Range) + forensic report
- Practical exam location
- ACRC Cyber Range
- Validity
- 3 years (recertification required)
Curriculum
- 6h
Forensic investigation of a banking incident: insider fraud, ransomware, APT
Cyber Range lab
- 5h
Forensics of Linux systems and banking production servers
Cyber Range lab
- 5h
Mobile forensics: smartphones, mobile banking apps, SIM cards
Cyber Range lab
- 5h
Financial malware analysis: dynamic behaviour, IOC extraction
Cyber Range sandbox lab
- 4h
Investigating SWIFT/BEC fraud: analysis of suspicious transactions
Anonymised real practical case
- 4h
Memory forensics (RAM dump) and volatile artefacts
Cyber Range lab
- 3h
Expert testimony and presenting evidence in court
Court simulation
- 3h
Revision and preparation for the exam investigation
Coaching
Skills acquired
- Conduct a full forensic investigation of a major banking incident
- Analyse financial malware and extract IOCs using a sandbox
- Investigate SWIFT/BEC fraud and attacks on mobile banking
- Testify as a forensic expert before an African court
AFP-FIN Expert
- Prerequisites
- AFP-FIN Practitioner + 3 years in forensic investigation
- Total duration
- 5 days (35h) + advanced investigation report
- Exam format
- Major post-crisis forensic exercise (ROOM#42 + Cyber Range, 24h) + full expert report
- Practical exam location
- ACRC: Cyber Range & ROOM#42
- Validity
- 3 years (recertification required)
Curriculum
- 6h
Cloud forensics: AWS/Azure/GCP applied to African banking systems
Cyber Range lab
- 5h
Cryptocurrency investigation and blockchain tracing (financial cybercrime)
Specialised lab
- 5h
OT/SCADA forensics: investigating ATMs, HSMs and embedded systems
Cyber Range lab
- 5h
Coordinating multi-site, multi-jurisdiction investigations (African judicial cooperation)
Simulation
- 4h
AI forensics: model manipulation, poisoned data
Foresight seminar
- 6h
Major post-crisis investigation exercise (ROOM#42 + Cyber Range coordination)
Integrated exercise
- 4h
Defence of the expert forensic report before a joint panel (ACRC + judges)
Oral examination
Skills acquired
- Conduct forensic investigations on banking cloud and OT infrastructure
- Trace cryptocurrency flows linked to financial cybercrime
- Coordinate a multi-jurisdiction forensic investigation in Africa
- Write expert reports recognised in African court proceedings
AFP-FIN Instructor
- Prerequisites
- AFP-FIN Expert + ACRC accreditation
- Total duration
- 3 days (21h)
- Exam format
- Forensic session delivered before a panel + assessment of Cyber Range environments
- Practical exam location
- ACRC Cyber Range
- Validity
- 3 years (recertification required)
Curriculum
- 4h
Teaching forensics: ethics, safety of training environments, legality
Seminar
- 7h
Building and maintaining forensic environments (Cyber Range): disk images, network captures, lab malware
Technical workshop
- 10h
Delivering and certifying AFP-FIN
Demonstration
Skills acquired
- Train financial forensic investigators across the entire AFP-FIN track
- Maintain the forensic environments of the ACRC Cyber Range
- Contribute to the AFP-FIN framework as technology and law evolve
Registration request
Leave your details: the ACRC team will confirm the dates and practical details of the next session.
AFP-FIN · Digital Forensics & Investigation
Other tracks
- AFP-RARisk Analyst
- AFP-PEPentester / Ethical Hacker
- AFP-GouvInformation Security Governance
- AFP-DGExecutives & Board Members: Cyber Leadership
- AFP-ACPInformation Security Audit & Permanent Control
- AFP-DSIChief Information Officer
- AFP-RSSIChief Information Security Officer
- AFP-CTICyber Threat Intelligence
- AFP-DPOData Protection & Privacy
- AFP-AIArtificial Intelligence for Cybersecurity & Professional Effectiveness
- AFP-EXLExecutive Leadership, Impact & Influence in Cybersecurity
- AFP-GAILeveraging GenAI in Your Cyber Job
- AFP-CISO101CISO 101: Taking Up the CISO Role
