Hansken for Case Operators

The blended professional training for Hansken case operators

The Hansken course for case operators is designed for those who are (will be) involved in:

• creating cases in Hansken;
• import (upload) evidence files;
• extract traces.

What to expect from this course?

With this course you lay a solid foundation for the processing of evidence files in Hansken. All the skills you need to do your job with confidence as a Hansken case operator are covered. You learn to make evidence files that are quickly and easily accessible to users who are authorized to investigate the data.

What does the course look like?

The training consists of two parts (blended training):

1. The first section of the course is available online. Here you will learn all important fundamental skills. You can do this at your own pace and at a time that is convenient for you.
2. The second part of the training is a physical workshop. Here you can ask questions about the online part and issues you experience in your own case investigations. Here you also learn to work with more complex issues that are important to you as a Hansken case operator.

The online course

• Duration: 3-4 hours (own pace)
• 19 short modules (micro learnings)
• Practical exercises
• Created by colleagues

The physical workshop

The physical workshop is half a day in The Hague at the NFI, or live-online. You can attend the physical workshop if you have basic knowledge through your day-to-day job, or if you have completed the online course. Dates for the workshop can be found on the Hansken Community Portal. You can register for these workshops (and for the Portal) by sending an email to the Hansken contact person at your organization.

What do you need?

• Access to the e-learning (the e-learnings are available within your own organization or by a provider selected by your organization).
• Access to the Hansken SDK (optional).

Which skills/knowledge/functionalities will you master after the course?

• You can create a case.
• You can group evidence files by case, to make the right data available to the right users.
• You can place (upload) evidence files in Hansken.
• You configure, start and monitor the extraction process. You work together with case investigators and/ or digital experts.
• In the extraction process, Hansken sends traces iteratively to dozens of forensic tools for processing. Different forensic tools each have their own function in this process (e.g., extract emails from email databases, extract camera information from photos, determine keywords or calculate file attributes). After the training you know the function of the most important forensic tools.
• With a re-extraction you can replace or supplement the previously extracted data (e.g., with new or different forensic tools).
• When the extraction process is finished, you can check whether the extraction went well.
• You can make the data accessible for investigation.
• Because millions of tracks are often processed during an extraction process, multiple errors will generally occur in that process. You learn that errors can have different causes, for example because data is incomplete (e.g., part of an image or PDF), because the structure of the source data does not match the structure expected by a forensic tool (e.g., an incomplete e-mail database, a new version of a chat log) or due to environmental factors such as system overload. You know how the Hansken architecture works, what can be the causes of error messages and what possible follow-up steps are.