SANS Computer Forensics Training, Incident Response

SANS Site Network
- Current Site
- Computer Forensics
- Choose a different site Help
- Training
- Certification
- Internet Storm Center
- Cyber Security Graduate School
- Security Awareness Training
- Penetration Testing
- Cyber Defense Foundations
- IT Audit
- Software Security

Community
- Blog
- Challenges
- Links
- SIFT Kit / Downloads
- Summit Archives
- Webcasts
- Whitepapers
- SANS Lethal Forensicator Coin
Training
- Events
- Courses »
  - Windows Forensics FOR408
  - Advanced Incident Response FOR508
  - Memory Forensics FOR526
  - Network Forensics FOR558
  - Mobile Forensics FOR563
  - Malware Analysis FOR610
- Summits
- Forensics Brochure
- Free Assessment
Certification
- GCFE - Forensic Examiner
- GCFA - Forensic Analyst
- GREM - Malware Analyst
- Certified Analysts
- GIAC Code of Ethics
- GIAC Homepage
Instructors
- SANS Instructors
- Author Statement
About
- About
- Press Room

Looking to purchase SANS digital forensics training?

Mission Statement

Every organization will eventually deal with cyber-crime. Fraud, intrusion, insider threats, phishing and other cyber-crimes are now a fact of life. If you are an IT or law enforcement professional and don't know how to look for and sort out these cases, your skills are becoming less valuable every day.

Community Resources

The SANS Computer Forensics and e-Discovery Community offers digital forensics professionals an opportunity to learn, dicuss, and share current developments in the field. It also provides information regarding forensics training, certification, and events.

Course Overview

Unpatched, unprotected computers connected to the Internet are compromised in less than 3 days. The Computer Forensics, Investigation and Response course from SANS will teach you techniques and tools for sucessful forensics investigations in a hands-on and practical way; for both Windows and Linux

"Headlines similar to these are now a reality as former students have emailed me regularly about how they were able to use their forensic skills in very real situations."
- Rob Lee, SANS Faculty Fellow

Latest Blog Posts

Latest Tweets @sansforensics

Sploited Blog: SANS Forensic Artifact 1: Open/Save MRU t.co/GpAvsSQb
October 10, 2012 - 3:25 AM

Linux Sleuthing: Addressing the iOS6 Address Book and SQLite [...]
October 10, 2012 - 12:40 AM

Hexacorn Blog: Skype worm strings & some metadata - Inf [...]
October 10, 2012 - 12:40 AM

Latest Papers

Grow Your Own Forensic Tools: A Taxonomy of Python Libraries Helpful for Forensic Analysis
By Terrence OConnor

Integrating Forensic Investigation Methodology into eDiscovery
By Colin Chisholm

Mastering the Super Timeline With log2timeline
By Kristinn Gudjonsson

"This course ROCKS! You can not call yourself a Forensics expert without taking the course from Rob Lee!."
- Ernie Hernandez, Prosoft

"Rob has insight that few others have and that alone is worth the cost of the the course."
- Chris Spurrier, Xerox Corp