Instructors

To say that digital forensics is central to Heather Mahalik's life is quite the understatement. Heather has worked on high-stress and high-profile cases, investigating everything from child exploitation to Osama Bin Laden's media. She has helped law enforcement, eDiscovery firms, and the federal government extract and manually decode artifacts used in solving investigations around the world. All told she has more than 14 years of experience in digital forensics, including eight years focused on mobile forensics - there's hardly a device or platform she hasn't researched or examined or a commercial tool she hasn't used.

These days Heather is the Director of Forensic Engineering at ManTech CARD.  At the SANS Institute she is a senior instructor and the course lead for FOR585: Advanced Smartphone Forensics. As if that isn't a full enough schedule, Heather also maintains www.smarterforensics.com, where she blogs and hosts work from the digital forensics community. She is the co-author of Practical Mobile Forensics (1st and 2nd editions), currently a best seller from Pack't Publishing, and the technical editor for Learning Android Forensics from Pack't Publishing.

Heather is passionate about digital forensics because she loves always having to learn something new. "This field moves so quickly. It is literally impossible to get bored," she says. "If you find yourself bored, branch into another realm of digital forensics. The possibilities are endless and so is the fun! I love digging for artifacts and solving the puzzle."

Heather particularly likes working on mobile and third-party applications, a focus of her work. "I love cracking and hacking into apps that are supposed to be secure," she explains.

She cites her role as a SANS instructor as one of the most fulfilling achievements of her career. Heather loves it when students reach out to tell her that, thanks to her course, they put a criminal away for many years. As she says: "Nothing compares to knowing that the effort you put into writing and maintaining a course makes the world a better and safer place. SANS gives me the opportunity to share that with others."

Heather's background in digital forensics and e-discovery covers smartphone, mobile device, and Windows forensics, including acquisition, analysis, advanced exploitation, vulnerability discovery, malware analysis, application reverse-engineering, and manual decoding, as well as instruction on mobile devices, smartphones, and computers covering Windows, Linux and Macintosh operating systems.

What's her favorite topic to teach from that impressive résumé? "Decrypting and decoding the unparsed data!" she says. "I spend almost 90 percent of my day job trying to crack into the tough stuff, and my experience naturally flows into the classroom."

Heather previously led the mobile device team for Basis Technology, where she focused on mobile device exploitation in support of the federal government. She also worked as a forensic examiner at Stroz Friedberg and the U.S. State Department Computer Investigations and Forensics Lab, where she handled a number of high-profile cases. She has also developed and implemented forensic training programs and standard operating procedures.

Outside of work, Heather puts her passions into being a mom, cooking, reading, riding her horse, and drinking fine wine and bourbon.

Summary of Qualifications:

• 14+ years of experience in digital forensics, with eight years focused on mobile forensics
• Co-author of Practical Mobile Forensics (1st and 2nd editions), currently a best seller from Pack't Publishing.
• Co-author the Advanced Smartphone Forensics Poster, also from Pack't Publishing.

Get to Know Heather Mahalik:

• Heather's blog
• Australian Women in Security Network blog interview
• Interview with Paul's Security Weekly
• Listen to Heather's webcast "iPhone Forensics - Separating the Facts from Fiction. A Technical Autopsy of the Apple/FBI Debate"
• Listen to Heather's webcast "To Trust or Not to Trust: The Relationship Between You and Your Mobile Forensics Tools"
• Listen to Heather's webcast "Smartphone Forensics Moves Fast. Stay Current or You May Miss Relevant Evidence!"

Here's what students are saying about SANS Senior Instructor Heather Mahalik:

• "I have been working with phones since 2009, and Heather very casually showed me how much I don't know. Excellent!" - Harbin Combee, Metropolitan Police Department, Washington, DC
• "I am learning so much, it's exciting. Heather is an excellent instructor. Very smart. Knows her stuff." - Tris Matthews, Goodhue County Sheriff's Office
• "Heather is a great instructor. The only downside will be not being able to bring her back to my office so we can pick her brain every day!" - C. McCollom, Clark County Sheriff's Office
• "Smartphone Forensics course is the only unbiased course in the world for mobile forensics, it is for those who really want to take their skill to the next level and go beyond what their vendor/tool gives them. Heather is an incredible instructor, regarding mobile forensics, she knows it." - David Bernal, SCTIUM

SANS Instructor Endorsements:
"Heather's cool demeanor and patience with her students shows across the board.  Her expertise shows in her passion for teaching and her interactions with her students.  Her work and connections in government space save lives and are critically important to our nation's security.  I feel very fortunate to have her as part of our DFIR instructor family." Rob Lee, SANS Fellow and DFIR Curriculum Lead

"Heather is one of the most knowledgeable and engaging instructors I've ever had the chance to learn from, let alone work with.  Her ability to present complex topics at an understandable level without compromising the technical details is amazing.  In the classroom, she brings the concepts home with extensive real-world experience - you'll never wonder why a topic is getting coverage - it's because you also know the impact to prior casework. Whether you take one of Heather's classes live in person, live online, or via recording, you'll get a solid learning experience." Phil Hagen, FOR572 author and Certified Instructor