homepage
Open menu
Talk with an expert

Digital Forensics and Incident Response

Courses & Certifications Resources & Tools
News & UpdatesCoursesCertificationsDFIR NetWarsSANS DFIR Summit & Training 2024InstructorsFree ResourcesAbout

Latest News & Updates

FOR589: Cybercrime Intelligence
New
New
Course
FOR589: Cybercrime Intelligence
The cybercrime landscape is perpetually evolving, driven by technological advancements, increased investments by nation-states in offensive cyber operations, and a dynamic cybercrime ecosystem that continuously lowers the barriers for novice criminals to collaborate with more sophisticated actors. FOR589 offers a comprehensive exploration of the cybercrime underground, detailing a broad spectrum of tactics and techniques used by cybercriminals to target organizations. This course includes over twenty hands-on labs and a final capstone exercise, equipping analysts with the skills necessary to enhance their organization's defenses, proactively gather critical intelligence, trace cryptocurrency proceeds of crime, and generate actionable insights to protect their organization preemptively.
read more
FOR577: Linux Incident Response and Threat Hunting FOR577: Linux Incident Response and Threat Hunting
New
Course
FOR577: LINUX Incident Response and Threat Hunting
FOR577 teaches the skills needed to identify, analyze, and respond to attacks on Linux platforms and how to use threat hunting techniques to find the stealthy attackers who can bypass existing controls. The course addresses today's incidents by teaching the hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to combat real-world breach cases. 23 hands-on labs
read more

Featured Digital Forensics and Incident Response Courses & Certifications

New
FOR577: LINUX Incident Response and Threat Hunting™
New
FOR528: Ransomware and Cyber Extortion™
Major Update
FOR508™: Advanced Incident Response, Threat Hunting, and Digital Forensics™
Certification:

  • GCFA
Major Update
FOR500: Windows Forensic Analysis™
Certification:

  • GCFE
FOR578: Cyber Threat Intelligence™
Certification:

  • GCTI
Major Update
FOR509: Enterprise Cloud Forensics and Incident Response™
Certification:

  • GCFR
FOR608: Enterprise-Class Incident Response & Threat Hunting™
Certification:

  • GEIR
FOR710: Reverse-Engineering Malware: Advanced Code Analysis™
    See All DFIR Courses & Certifications

    Digital Forensics and Incident Response Courses by Job Role

    Download DFIR Job Roles Poster Full Course List

    DFIR Tools

    SIFT_Workstation_370x200.png
    SIFT Workstation
    Why SIFT? The SIFT Workstation is a group of free open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings. It can match any current incident response and forensic tool suite. SIFT demonstrates that advanced incident response capabilities and deep dive digital forensic techniques to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.
    Download SIFT
    Zimmerman_s_Tools_370x200.png
    EZ Tools
    SANS Certified Instructor and Former FBI Agent Eric Zimmerman provides several open source command line tools free to the DFIR Community. These open source digital forensics tools can be used in a wide variety of investigations including cross validation of tools, providing insight into technical details not exposed by other tools, and more. Over the years, Eric has written and continually improve over a dozen digital forensics tools that investigators all over the world use and rely upon daily.
    EZ Tools
    REMnux_370x200.png
    REMnux
    REMnux® is a free Linux toolkit for assisting malware analysts with reverse-engineering malicious software. It strives to make it easier for forensic investigators and incident responders to start using the variety of freely-available tools that can examine malware, yet might be difficult to locate or set up. The heart of the project is the REMnux Linux distribution based on Ubuntu. This lightweight distro incorporates many tools for analyzing Windows and Linux malware, examining browser-based threats such as obfuscated JavaScript, exploring suspicious document files and taking apart other malicious artifacts.
    REMnux: A Linux Toolkit for Reverse-Engineering and Analyzing Malware
    SOF-ELK_370x200.png
    SOF-ELK
    SOF-ELK® is a “big data analytics” platform focused on the typical needs of computer forensic investigators/analysts and information security operations personnel. The platform is a customized build of the open source Elastic stack, consisting of the Elasticsearch storage and search engine, Logstash ingest and enrichment system, Kibana dashboard frontend, and Elastic Beats log shipper (specifically filebeat). With a significant amount of customization and ongoing development, SOF-ELK® users can avoid the typically long and involved setup process the Elastic stack requires. Instead, they can simply download the pre-built and ready-to-use SOF-ELK® virtual appliance that consumes various source data types (numerous log types as well as NetFlow), parsing out the most critical data and visualizing it on several stock dashboards.
    SOF-ELK
    Landing_Page_Cert.jpg

    Digital Forensics and Incident Response Certifications

    It takes intuition and specialized skills to find hidden evidence and hunt for elusive threats. GIAC's Digital Forensics and Incident Response certifications encompass abilities that DFIR professionals need to succeed at their craft, confirming that professionals can detect compromised systems, identify how and when a breach occurred, understand what attackers took or changed, and successfully contain and remediate incidents. Keep your knowledge of detecting and fighting threats up to date - and your work role secure - with DFIR certifications.

    Learn More
    470x382-coins.png

    Lethal Forensicator Coins

    Hundreds of SANS Institute digital forensics students have stepped up to the challenge and emerged victorious. They've mastered the concepts and skills, beat out their classmates, and proven their prowess. These are the elite, the recipients of the SANS Lethal Forensicator Coin, an award given to a select few among the thousands of students who have taken any of the SANS Institute Digital Forensics or Incident Response (DFIR) courses. Lethal Forensicator Coins are awarded to those who show exceptional talent, make outstanding contributions to the field, or demonstrate leadership in the digital forensics profession and community. The coins are a challenge to win and an honor to receive. They are also intended to be rare.
    Learn More
    470x382Law_Enforcement_Appreciation_Programs_(1).png

    Are you a LEO affected by training cuts?

    SANS is proud to support U.S. Law Enforcement professionals experiencing hardship funding their training efforts. We have created special programs that can offer significant flexibility toward SANS DFIR courses.
    Learn More
    incident Response Graduate Certificate

    SANS.edu Graduate Certificate in Incident Response

    • Designed for working InfoSec and IT professionals
    • Highly technical 13-credit-hour program
    • Includes 4 industry-recognized GIAC certifications
    Learn More at a Free Info Session

    DFIR NetWars and Continuous

    An incident simulator with forensic, malware analysis, threat hunting, and incident response case scenarios to help you expand your DFIR capabilities.
    370x200_DFIR_NetWars.jpg
    DFIR NetWars Tournaments
    DFIR NetWars are an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk associated when working real life incidents. It is unique in that it provides time-limited challenges that can be used to test the skills you've mastered, and at the same time, help you identify the skills you are missing.
     View Schedule
    370x200_DFIR_Coinslayer.jpg
    DFIR Netwars – The Coin Slayer!
    Created by popular demand, this tournament will give you the chance to win a fortune of DFIR coinage! To win the new course coins, you must answer all questions correctly from all four levels of one or more of the eight DFIR domains: Windows Forensics, Advanced Incident Response and Threat Hunting, Smartphone Analysis, Mac Forensics, Advanced Network Forensics, Malware Analysis, and DFIR NetWars. Take your pick or win them all!
    370x200_DFIR_NetWars2.jpg
    DFIR Netwars Continuous
    Learn how to solve unique, in-depth challenges through interactive case scenarios designed to help you gradually build your DFIR skillset, right from home. DFIR NetWars Continuous is an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk associated with working on real-life incidents.
     Register Now

    SANS Cyber Threat Intelligence Summit & Training 2025

    Summit: Jan 27-28 | 10 Courses: Jan 29 - Feb 3  Alexandria, VA & Live Online Join us for our 13th Annual SANS Cyber Threat Intelligence Summit -- an event devoted solely to the tradecraft of cyber threat analysis and intelligence. Gain fresh perspectives and insights from leading practitioners who will share the latest real-world case studies, innovative techniques, and practical solutions designed to challenge CTI assumptions and deepen your understanding.
    Learn More & Register

    Learn DFIR Skills With These Experts

    Learn more about Faculty Fellow, Heather Barnhart.

    Heather Barnhart

    Fellow
    To say that digital forensics is central to Heather Barnhart's life is quite the understatement. Heather has worked on high-stress and high-profile cases, investigating everything from child exploitation, homicides to Osama Bin Laden's media.
    Learn Why
    View All Instructors Become an Instructor

    More Free Digital Forensics and Incident Response Resources

    Reviews

    The content was high quality and the exercises were made it easier to fully grasp the content.
    Kellon Benson
    - Central WA University
    The instructor and course materials are the best level, so people who have interest in Forensics should take the course and obtain a deeper knowledge.
    Yusuke Takahashi
    - LAC
    Extremely valuable training! Trainer added value due to his course knowledge & personal experience sharing.
    Verreet
    - Eu Council
    Very relevant to my daily IR work and highly recommend this to any DFIR or IR in general pros.
    Emile Smith
    - TVA
    This is top quality training that will return value immediately when returning to work.
    Nic Cargill
    This training is great and important to me because it gives me more knowledge to assist in my investigations.
    Christopher J.
    - GBI Georgia Bureau of Investigation
    The material is relevant, real world, and has effective hands on exercises.
    Dustin B.
    - SOCOM
    Getting hands on experience with the labs helps to cement concepts that were taught.
    Molly L.
    - NCFTA
    After two days, I'm excited to go back to work & use what I've learned.
    TK
    - GRDA
    It was great having you as an instructor! Your expertise & experience in the field is such a help during class, you keep things interesting!
    Brittany Pedulla
    - Kroll

      About Digital Forensics and Incident Response

      Whether you're seeking to maintain a trail of evidence on host or network systems or hunting for threats using similar techniques, larger organizations are in need of specialized professionals who can move beyond first-response incident handling to analyze an attack and develop an appropriate remediation and recovery plan. Our DFIR Curriculum will teach you how to detect compromised systems, identify how and when a breach occurred, understand what attackers took or changed, and successfully contain and remediate incidents.

      Every year the SANS Digital Forensics & Incident Response (DFIR) Faculty produces thousands of free content-rich resources for the digital forensics community. These resources are aimed to provide you with the latest in research and technology available to help you streamline your investigations. Our number one priority is to support the DFIR community by not only providing content to solve even the most difficult problems investigators face daily, but also provide an open forum for community mentoring, development and support.