Rocheston Certified Cybercrime Investigator (RCCI)

When customers lose money to a fake message, an account is taken over, or a fraudster abuses a payment channel, the organisation behind the service must find out how it happened and protect others from the same attack. RCCI training prepares professionals for that work. The Rocheston Certified Cybercrime Investigator (RCCI) course is a five-day programme in digital forensics, evidence acquisition, chain of custody, timeline reconstruction and court-ready reporting, with strong coverage of fraud and online crime.

The investigation tracks reflect the threats users face most often. Financial Cybercrime covers online banking fraud, card fraud, money laundering and cryptocurrency analysis. Identity, Social Media and Online Abuse covers identity theft, cyberstalking, extortion, harassment and privacy violations. Enterprise Cybercrime covers phishing, data breaches and insider threats. Mobile devices, cloud services and web applications are covered too, since that is where much customer-facing evidence lives.

The method behind every case stays the same. Learners first handle evidence lawfully and record its chain of custody. Next, they create and verify forensic images and analyse logs, files and metadata, then build a timeline that shows how the incident unfolded. They finish with a report that managers, legal teams or authorities can rely on. The Operation Silent Trace capstone tests the full method on a simulated breach that starts with phishing and credential theft.

All labs run on Rocheston Winston OS, using only simulated, redacted or legally permitted material.

For banks, telecom operators and digital service providers, these skills support faster, better-evidenced investigations. That helps them recover losses where possible, close weaknesses and protect customer trust. Explore related options in our Rocheston programmes section.

Course Structure and Key Details

The five-day RCCI course moves from legal foundations to specialised fraud and online crime investigations. Day 1 covers cybercrime, law, ethics, evidence handling, privacy and chain of custody. Day 2 covers incident response, containment, forensic imaging and hash verification. On Day 3, learners analyse file systems, deleted data, the registry, logs and metadata and build timelines of events. Day 4 is devoted to specialised investigations, including fraud, phishing, insider threats, cloud, mobile, dark web, cryptocurrency and social media. Day 5 focuses on court-ready reporting, the Operation Silent Trace capstone and exam preparation.

Rocheston organises the content into six investigation tracks with more than 50 specialisations. Alongside the financial, identity and enterprise tracks, Device and Network Forensics covers mobile devices, network traffic, wireless and VoIP evidence. Cloud, Web and Database Evidence covers cloud storage, web applications, databases and geolocation. Emerging Technology extends to IoT devices, industrial control systems and wearables.

In the capstone, learners investigate a simulated breach involving phishing, credential theft, unauthorised file access and possible exfiltration. They deliver a chain-of-custody form, evidence inventory, acquisition notes, timeline, findings report with executive summary and court-readiness checklist.

Practical work takes place in Rocheston Winston OS, a forensic lab environment preloaded with investigation tools. Rocheston offers the course as live instructor-led training, blended learning, or self-paced study on Cyberclass. Our Dar es Salaam team can confirm what is available for your group.

Recommended prerequisites are basic cybersecurity concepts, operating systems and file systems, networking basics, logs and user activity, basic incident response, and awareness of the legal sensitivity of evidence. RCCI is not a beginner IT course, and law enforcement experience is not required.

The exam consists of 100 questions across multiple-choice, true/false, and short-answer formats, with a two-hour time limit and a 70% pass mark, and is proctored online through Ramsys. A Rocheston certificate is issued after passing, and it can be verified through Rocheston Roxy. Rocheston suggests RCCE Level 2, CCO or RCAI for further study.

Course Objective

1. Investigate online banking, card and mobile payment fraud using structured forensic methods.
2. Trace phishing campaigns from the initial message to credential theft and account misuse.
3. Examine identity theft, extortion and social media abuse cases while respecting privacy obligations.
4. Collect and analyse evidence from mobile devices, cloud services and web applications.
5. Preserve digital evidence with forensic imaging, hash verification and chain of custody.
6. Reconstruct events into timelines that show how a crime against users unfolded.
7. Identify money laundering and cryptocurrency indicators in financial investigations.
8. Report findings clearly for management, legal teams, and authorities.