SANS Lethal Forensicator Coins

Lethal Forensicator Coins are awarded to those who show exceptional talent, make outstanding contributions to the field, or demonstrate leadership in the digital forensics profession and community. The coins are a challenge to win and an honor to receive. They are also intended to be rare.

Challenges for the Coins are held on the final day of each course. Students must successfully overcome several obstacles, directly compete against fellow students, and prove their proficiency during timed, hands-on incidents. The obstacles, competitions, and hands-on scenarios have been created by SANS's top instructors, who are digital forensics practitioners, subject-matter experts, experienced teachers, and industry leaders in their own right. At the end of the challenge the instructor announces the winner(s) and awards them their coins. 

Holders of the Lethal Forensicator Coins are properly trained incident responders or investigators who sometimes represent the only defense an organization has in place during a compromise or a complex digital investigation. These analysts know what they are up against and continually strive to further not only their own knowledge, but also the knowledge of the entire digital forensics field. They are proactive in sharing their experience and encouraging learning through participation in the community. They stay ahead of the curve by constantly seeking new knowledge. Often, they are the leaders in the digital forensics and incident response community.

History of the SANS Challenge Coins

SANS Challenge Coins were initially created to recognize students who demonstrate exceptional talent, make outstanding contributions, or serve as leaders in the digital forensics profession and community. The coin is meant to be an honor, and it is intended to be rare. The SANS Institute uses the coins to identify and honor those who excel at detecting and eradicating threats, understand the critical importance of cybersecurity, and continually strive to further not only their own knowledge but also that of the entire digital forensics field. They proactively share their experience and encourage learning through participation in the community, and they are typically leaders in the digital forensics and incident response community.

History of the Word "Forensicator"

The term "forensicator" was coined by BJ Lachner and popularized when it was used in the legendary "Forensicator Pro" Cyberspeak Podcast on 1 April 2007 with SANS instructor Ovie Carroll and Brett Padres. In that tongue-in-cheek podcast, Ovie and Brett described a tool called "Forensicator Pro" that would put forensic analysts out of business and was "viewed by many in the community as the end of human involvement in computer forensics examinations." As Brett described it: "Basically you press a button, you point it at an image, and the tool outputs a full forensic examination and report that is perfect." The episode was released as an April Fools' Day joke about what many in the field call "Nintendo Forensics" that rely too much on automated examinations versus traditional analysis, resulting in poor reports. But to this day, Brett and Ovie still receive emails asking where "Forensicator Pro" can be purchased and downloaded!

The term "forensicator" stuck and today is used by many computer forensics and incident response firms to describe individuals who essentially perform the same type of work as the mythical "Forensicator Pro" would have done. The forensicator label has grown in popularity among digital forensic professionals in the workplace, at conferences, and while sharing a cold one with a friend. Here are a few examples:

• HolisticInfosec.org write-up on the SANS SIFT Workstation 2.0 (PDF)
• @forensicator on Twitter
• Definition of forensicator on Urban Dictionary

"Coin Check" Challenge

Initiated by one coin holder to another, a coin check typically begins by a challenger holding his or her coin in the air or slamming it on a table and yelling "coin check!" All who are challenged must respond by showing their coins to the challenger within 10 seconds, and whoever fails to do so must buy everyone a round of drinks. If all the challenged coin holders produce their coin, the challenger must buy the round of drinks. (By the way, if you accidentally drop your coin and it makes an audible sound on impact, then you've "accidentally" initiated a coin check. And, there are no exception to the rules!)