Instructors

Rob Lee is an entrepreneur and consultant in the Washington, DC area, specializing in information security, incident response, and digital forensics. Rob is currently the curriculum lead and author for digital forensic and incident response training at the SANS Institute in addition to owning his own firm. Rob has more than 15 years of experience in computer forensics, vulnerability and exploit discovery, intrusion detection/prevention, and incident response.

Rob graduated from the U.S. Air Force Academy and served in the U.S. Air Force as a founding member of the 609th Information Warfare Squadron, the first U.S. military operational unit focused on information warfare. Later, he was a member of the Air Force Office of Special Investigations (AFOSI) where he led a team conducting computer crime investigations, incident response, and computer forensics. Prior to starting his own firm, he directly worked with a variety of government agencies in the law enforcement, U.S. Department of Defense, and intelligence communities as the technical lead for a vulnerability discovery and an exploit development team, lead for a cyber forensics branch, and lead for a computer forensic and security software development team. Rob was also a director for MANDIANT, a company focused on investigating advanced adversaries, such as the APT, for four years prior to starting his own business.

Rob co-authored the book Know Your Enemy, 2nd Edition. Rob earned his MBA from Georgetown University in Washington DC. He was awarded the Digital Forensic Examiner of the Year from the Forensic 4Cast Awards. Rob is an ardent blogger about computer forensics and incident response topics at the SANS Computer Forensic Blog. Rob is also a co-author of the MANDIANT threat intelligence report M-Trends: The Advanced Persistent Threat.

Listen to Rob discuss "DFIR Techniques using the SIFT Workstation" in this SANS webcast that every DFIR professional should listen to.

Type	Course / Location	Date	Register
Training Event	FOR408: Computer Forensic Investigations - Windows In-Depth SANS DFIRCON 2014 Monterey, CA	Mar 5, 2014 - Mar 10, 2014
Training Event	FOR408: Computer Forensic Investigations - Windows In-Depth SANS Northern Virginia 2014 Reston, VA	Mar 17, 2014 - Mar 22, 2014
Simulcast	FOR408: Computer Forensic Investigations - Windows In-Depth Online	Dec 12, 2013 - Dec 17, 2013
Simulcast	FOR408: Computer Forensic Investigations - Windows In-Depth Online	Mar 5, 2014 - Mar 10, 2014
Summit	FOR508: Advanced Computer Forensic Analysis and Incident Response SANS Forensics Prague 2013 Prague, Czech Republic	Oct 6, 2013 - Oct 13, 2013
Training Event	FOR508: Advanced Computer Forensic Analysis and Incident Response October Singapore 2013 Singapore, Singapore	Oct 21, 2013 - Nov 2, 2013
Training Event	FOR508: Advanced Computer Forensic Analysis and Incident Response SANS London 2013 London, United Kingdom	Nov 16, 2013 - Nov 25, 2013
Training Event	FOR508: Advanced Computer Forensic Analysis and Incident Response SANS Cyber Defense Initiative 2013 Washington, DC	Dec 12, 2013 - Dec 19, 2013
Training Event	FOR508: Advanced Computer Forensic Analysis and Incident Response SANS Security East 2014 New Orleans, LA	Jan 20, 2014 - Jan 25, 2014

*Course contents may vary depending upon location, see specific event description for details.