homepage
Open menu
Contact Sales

Digital Forensics and Incident Response

Courses & Certifications Resources & Tools
News & UpdatesCoursesCertificationsDFIR NetWarsSANS DFIR Summit & Training 2024InstructorsFree ResourcesAbout

Latest News & Updates

FOR589: Cybercrime Intelligence
New
New
Course
FOR589: Cybercrime Intelligence
The cybercrime threat landscape is constantly evolving due to technological advancements, increased investments by nation-states in offensive cyber operations, and a cybercrime ecosystem that spawns new threat actors daily by reducing the barriers for novice criminals to collaborate with more sophisticated ones. FOR589 provides an in-depth exploration of the cybercrime underground, detailing a wide array of tactics and techniques that cybercriminals use to target organizations. Moreover, FOR589 offers more than 20 labs and a final exercise that will equip analysts with the skills to extend their organization's defenses, proactively gather critical information, trace cryptocurrency proceeds of crime and generate the actionable intelligence required to protect their organization before an attack occurs. 20 Labs + Final CTF
read more
FOR577: Linux Incident Response and Threat Hunting FOR577: Linux Incident Response and Threat Hunting
New
Course
FOR577: LINUX Incident Response and Threat Hunting
FOR577 teaches the skills needed to identify, analyze, and respond to attacks on Linux platforms and how to use threat hunting techniques to find the stealthy attackers who can bypass existing controls. The course addresses today's incidents by teaching the hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to combat real-world breach cases. 23 hands-on labs
read more

Featured Digital Forensics and Incident Response Courses & Certifications

New
FOR577: LINUX Incident Response and Threat Hunting
New
FOR528: Ransomware and Cyber Extortion
Major Update
FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
Certification:

  • GCFA
Major Update
FOR500: Windows Forensic Analysis
Certification:

  • GCFE
FOR578: Cyber Threat Intelligence
Certification:

  • GCTI
Major Update
FOR509: Enterprise Cloud Forensics and Incident Response
Certification:

  • GCFR
FOR608: Enterprise-Class Incident Response & Threat Hunting
Certification:

  • GEIR
FOR710: Reverse-Engineering Malware: Advanced Code Analysis
    See All DFIR Courses & Certifications

    DFIR Tools

    SIFT_Workstation_370x200.png
    SIFT Workstation
    Why SIFT? The SIFT Workstation is a group of free open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings. It can match any current incident response and forensic tool suite. SIFT demonstrates that advanced incident response capabilities and deep dive digital forensic techniques to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.
    Download SIFT
    Zimmerman_s_Tools_370x200.png
    EZ Tools
    SANS Certified Instructor and Former FBI Agent Eric Zimmerman provides several open source command line tools free to the DFIR Community. These open source digital forensics tools can be used in a wide variety of investigations including cross validation of tools, providing insight into technical details not exposed by other tools, and more. Over the years, Eric has written and continually improve over a dozen digital forensics tools that investigators all over the world use and rely upon daily.
    EZ Tools
    REMnux_370x200.png
    REMnux
    REMnux® is a free Linux toolkit for assisting malware analysts with reverse-engineering malicious software. It strives to make it easier for forensic investigators and incident responders to start using the variety of freely-available tools that can examine malware, yet might be difficult to locate or set up. The heart of the project is the REMnux Linux distribution based on Ubuntu. This lightweight distro incorporates many tools for analyzing Windows and Linux malware, examining browser-based threats such as obfuscated JavaScript, exploring suspicious document files and taking apart other malicious artifacts.
    REMnux: A Linux Toolkit for Reverse-Engineering and Analyzing Malware
    SOF-ELK_370x200.png
    SOF-ELK
    SOF-ELK® is a “big data analytics” platform focused on the typical needs of computer forensic investigators/analysts and information security operations personnel. The platform is a customized build of the open source Elastic stack, consisting of the Elasticsearch storage and search engine, Logstash ingest and enrichment system, Kibana dashboard frontend, and Elastic Beats log shipper (specifically filebeat). With a significant amount of customization and ongoing development, SOF-ELK® users can avoid the typically long and involved setup process the Elastic stack requires. Instead, they can simply download the pre-built and ready-to-use SOF-ELK® virtual appliance that consumes various source data types (numerous log types as well as NetFlow), parsing out the most critical data and visualizing it on several stock dashboards.
    SOF-ELK
    Landing_Page_Cert.jpg

    Digital Forensics and Incident Response Certifications

    It takes intuition and specialized skills to find hidden evidence and hunt for elusive threats. GIAC's Digital Forensics and Incident Response certifications encompass abilities that DFIR professionals need to succeed at their craft, confirming that professionals can detect compromised systems, identify how and when a breach occurred, understand what attackers took or changed, and successfully contain and remediate incidents. Keep your knowledge of detecting and fighting threats up to date - and your work role secure - with DFIR certifications.

    Learn More
    470x382-coins.png

    Lethal Forensicator Coins

    Hundreds of SANS Institute digital forensics students have stepped up to the challenge and emerged victorious. They've mastered the concepts and skills, beat out their classmates, and proven their prowess. These are the elite, the recipients of the SANS Lethal Forensicator Coin, an award given to a select few among the thousands of students who have taken any of the SANS Institute Digital Forensics or Incident Response (DFIR) courses. Lethal Forensicator Coins are awarded to those who show exceptional talent, make outstanding contributions to the field, or demonstrate leadership in the digital forensics profession and community. The coins are a challenge to win and an honor to receive. They are also intended to be rare.
    Learn More
    470x382Law_Enforcement_Appreciation_Programs_(1).png

    Are you a LEO affected by training cuts?

    SANS is proud to support U.S. Law Enforcement professionals experiencing hardship funding their training efforts. We have created special programs that can offer significant flexibility toward SANS DFIR courses.
    Learn More
    incident Response Graduate Certificate

    SANS.edu Graduate Certificate in Incident Response

    • Designed for working InfoSec and IT professionals
    • Highly technical 13-credit-hour program
    • Includes 4 industry-recognized GIAC certifications
    Learn More at a Free Info Session

    DFIR NetWars and Continuous

    An incident simulator with forensic, malware analysis, threat hunting, and incident response case scenarios to help you expand your DFIR capabilities.
    370x200_DFIR_NetWars.jpg
    DFIR NetWars Tournaments
    DFIR NetWars are an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk associated when working real life incidents. It is unique in that it provides time-limited challenges that can be used to test the skills you've mastered, and at the same time, help you identify the skills you are missing.
     View Schedule
    370x200_DFIR_Coinslayer.jpg
    DFIR Netwars – The Coin Slayer!
    Created by popular demand, this tournament will give you the chance to win a fortune of DFIR coinage! To win the new course coins, you must answer all questions correctly from all four levels of one or more of the eight DFIR domains: Windows Forensics, Advanced Incident Response and Threat Hunting, Smartphone Analysis, Mac Forensics, Advanced Network Forensics, Malware Analysis, and DFIR NetWars. Take your pick or win them all!
    370x200_DFIR_NetWars2.jpg
    DFIR Netwars Continuous
    Learn how to solve unique, in-depth challenges through interactive case scenarios designed to help you gradually build your DFIR skillset, right from home. DFIR NetWars Continuous is an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk associated with working on real-life incidents.
     Register Now

    SANS DFIR Summit & Training 2024

    Summit: Aug 22-23 | Training: Aug 24-29 | 14 Top Courses Available Salt Lake City, UT & Live Online Join us this Summer for the must-attend DFIR event of the year! Don't miss the chance to learn from and connect with the industry's top practitioners who will share their latest digital forensics and incident response research, tools, case studies, and solutions.
    Learn More & Register

    Learn DFIR Skills With These Experts

    Learn more about Faculty Fellow, Heather Mahalik Barnhart.

    Heather Mahalik Barnhart

    Fellow
    To say that digital forensics is central to Heather Mahalik Barnhart's life is quite the understatement. Heather has worked on high-stress and high-profile cases, investigating everything from child exploitation, homicides to Osama Bin Laden's media.
    Learn Why
    View All Instructors Become an Instructor

    More Free Digital Forensics and Incident Response Resources

    Reviews

    The content was high quality and the exercises were made it easier to fully grasp the content.
    Kellon Benson
    - Central WA University
    The instructor and course materials are the best level, so people who have interest in Forensics should take the course and obtain a deeper knowledge.
    Yusuke Takahashi
    - LAC
    Extremely valuable training! Trainer added value due to his course knowledge & personal experience sharing.
    Verreet
    - Eu Council
    Very relevant to my daily IR work and highly recommend this to any DFIR or IR in general pros.
    Emile Smith
    - TVA
    This is top quality training that will return value immediately when returning to work.
    Nic Cargill
    This training is great and important to me because it gives me more knowledge to assist in my investigations.
    Christopher J.
    - GBI Georgia Bureau of Investigation
    The material is relevant, real world, and has effective hands on exercises.
    Dustin B.
    - SOCOM
    Getting hands on experience with the labs helps to cement concepts that were taught.
    Molly L.
    - NCFTA
    After two days, I'm excited to go back to work & use what I've learned.
    TK
    - GRDA
    It was great having you as an instructor! Your expertise & experience in the field is such a help during class, you keep things interesting!
    Brittany Pedulla
    - Kroll

      About Digital Forensics and Incident Response

      Whether you're seeking to maintain a trail of evidence on host or network systems or hunting for threats using similar techniques, larger organizations are in need of specialized professionals who can move beyond first-response incident handling to analyze an attack and develop an appropriate remediation and recovery plan. Our DFIR Curriculum will teach you how to detect compromised systems, identify how and when a breach occurred, understand what attackers took or changed, and successfully contain and remediate incidents.

      Every year the SANS Digital Forensics & Incident Response (DFIR) Faculty produces thousands of free content-rich resources for the digital forensics community. These resources are aimed to provide you with the latest in research and technology available to help you streamline your investigations. Our number one priority is to support the DFIR community by not only providing content to solve even the most difficult problems investigators face daily, but also provide an open forum for community mentoring, development and support.