Content + Structure
Advanced network forensics, packet capture and analysis
- SAS
Network Forensics
The Network Forensics SAS teaches advanced network forensic capture and analysis. This includes network technologies, traffic interception, packet capture formats, analysis and decoding of protocols, reassembling packets/sessions, extracting application data, and network encryption.
Start your continuing education on 7 September 2026.
Factsheet
- Degree/Certificate Short Advanced Studies (SAS) in Network Forensics
- Duration 5 days
-
Schedule
07.–11.09.2026
08.30–16.30 - ECTS credits 3 ECTS-Credits
- Costs CHF 2'500
- Teaching language English
-
Location
Biel, Aarbergstrasse 46
Onsite course - School School of Engineering and Computer Science
- Next session September 2026
Short Advanced Studies (SAS)
Short Advanced Studies (SAS) are courses that take 30 to 160 hours (1 to 9 ECTS – can be credited towards DAS or MAS). Participants acquire in-depth, industry-relevant insights and skills on current topics in a short space of time. Students who do not wish to take SAS competency assessments are awarded a course certificate (no ECTS in that case).
Portrait
The digital transformation of society is affecting crime, criminals and criminal investigation. New cyber criminal methods using advanced technical tools and exploitation are an opportunity for criminals and a challenge for investigators. Technically complex illegal activities are being sold as services to less skilled criminals, increasing the challenge of fighting cybercrime. On the other hand, criminals face increasing challenges trying to hide and avoid attribution. The large amount of digital traces stored across multiple locations and devices creates an opportunity for criminal forensic investigators.
Crime scenes are also changing. With the growth of cybercrime, crime scenes are becoming virtual, global, and multi-jurisdictional. Investigating a transnational cyber crime scene requires investigative tools to remotely gather information, and also collaboration between entities in both the public and private sectors.
Modern physical crime scenes have a comprehensive array of digital evidence sources. In addition to PCs and notebooks, digital evidence traces can be found in mobiles, IoT devices, automobiles, smart control systems, data stored with cloud providers, social media, and distributed on servers across the Internet. With the increase in digital and online payment systems, financial transactions are also becoming an important digital evidence source, especially in financially motivated crimes like fraud, ransomware, and extortion.
Our unique Digital Forensics and Cyber Investigation (DFCI) Short Advanced Study (SAS) programs give you a wide range of practical skills needed for an exciting career combating, analyzing and investigating cyber criminal activity.
Career opportunities
The DFCI SAS programs prepare students for career opportunities in a variety of organizations who depend on forensic investigation capabilities. For example:
- Law enforcement – Federal agencies, KAPOs
- Military and government – NCSC, CERTs, cyber-troops
- Finance industry – fraud and cybercrime investigation teams
- Insurance industry – cyber insurance claims investigation
- Large enterprises – security and incident response teams
- Consultancy and audit – e-Discovery, accounting, "Big Four"
- IT security service providers and product vendors
- Private boutique digital forensic and investigation firms
Education goals
This continuing education program has practical learning objectives. Students completing a DFCI SAS will understand the concepts of modern digital forensics, they will have the knowledge and skills needed to understand cyber criminal activity, conduct cyber investigations, and collect digital forensic evidence.
The Network Forensics SAS teaches advanced network forensic capture and analysis. This includes network technologies, traffic interception, packet capture formats, analysis and decoding of protocols, reassembling packets/sessions, extracting application data, and network encryption.
Continuing education at a glance
Content
The Network Forensics SAS teaches advanced network forensic capture and analysis. The content includes:
- Network technologies
- Network infrastructure traffic interception
- Wired and wireless traffic interception
- Introduction to mobile data networks (LTE, xG)
- Packet capture file formats and containers
- Traffic and packet analysis
- Decoding and assembling protocol layers
- Extraction of application data
- Network encryption
Proof of proficiency
To receive 3 ECTS (European Credit Transfer and Accumulation System) academic credits, students must demonstrate their knowledge by successfully completing assignments, projects, and final exam as required by the lecturer. Students who attend all classes but do not complete the assessment work will receive a certificate of attendance equivalent to 40 CPE (Continuing Professional Education) hours.
Lecturer
Reto Inversini
Cyber Threat Analyst / Incident Responder Rail ISAC, SBB
Dozent BFH
Degree + Title
Short Advanced Studies (SAS) in «Network Forensics»
Requirements + admission
Find out which professionals this course is designed for and what requirements you need to meet.
Entrance Requirements
Admission into the DFCI SAS program requires one of the following qualifications:
- a bachelor’s degree or equivalent professional education degree in computer science, computer engineering, or related technical field,
- professional experience in digital forensics or IT investigation, and a related industry certification.
If applicant qualifications are unclear or inconclusive, further information or an interview may be requested.
Target audience
The DFCI SAS programs are designed for two groups of professionals:
- Experienced forensic investigators who want to increase their technical skills in digital forensics and cyber investigations.
- Experienced engineers and technicians who want to transition into the field of digital forensics and cyber investigations.
Infoevent and Course guidance
Do you have questions about continuing education? We will be happy to answer your questions.
Course guidance
Choosing a basic or continuing education programme is an important decision when planning your professional career. We will be happy to answer your questions and clarify your personal requirements for the desired continuing education during an individual consultation.
Location
This course is held on site at Aarbergstrasse 46 in Biel/Bienne.
Switzerland Innovation Park Biel/Bienne (SIPBB)
A location with many advantages
- Classrooms within two minutes walking distance from Biel/Bienne railway station
- Ideal train connections from Bern’s main railway station (every 15 minutes) and from Bern Wankdorf (every 30 minutes)
- State-of-the-art infrastructure in the new SIPBB building
- Various catering options in the immediate vicinity
- Innovation and networking events
And that’s not all! Biel/Bienne is…
- an innovation hotspot,
- a university city,
- an industrial and service city with numerous major players in the watchmaking, mechanical engineering, precision engineering and medical technology industries and major representatives of the communications and telecommunications sectors,
- bordered by Lake Biel and its wide range of sports and leisure facilities,
- a city that embodies bilingualism,
- a town with a vibrant cultural life.
Biel Aarbergstrasse 46 (Switzerland Innovation Park Biel/Bienne)
Digital Forensics & Cyber Investigation Short Advanced Studies
The Digital Forensics & Cyber Investigation (DFCI) professional courses offer a choice of Digital Forensics and Cyber Investigation modules. They are held as one-week full-time intensive courses, making it easier to attend and faster to complete. The courses are taught in English by internationally recognised experts in the field.