The most trusted source for computer security training, certification and research.



select a course
Global Information Assurance Certification

Very intense. I have never been to a conference where we received so much information and so much more to learn post-conference.
-Paul Abels, UPS

FORENSICS 408

Computer Forensic Essentials

6 CPE Credits Per Day
NOTE: This course has recently changed from the SECURITY discipline to the new FORENSICS discipline. All content remains the same.

Master computer forensics. Learn essential investigation techniques.

With today's ever-changing technologies and environments, it is inevitable that organizations will deal with some form of cybercrime. These forms include, but are not exclusive to, fraud, insider threat, industrial espionage, and phishing. In order to help solve these cases, organizations are hiring digital forensic professionals and calling cybercrime law enforcement agents to fight and solve these cyber crimes.

SANS Security 408: Computer Forensic Essentials focuses on the essentials that a forensic investigator must know to investigate core computer crime incidents successfully. You will learn how computer forensic analysts focus on collecting and analyzing data from computer systems to track user-based activity that could be used internally or in civil/criminal litigation.

This course covers the fundamental steps of the in-depth computer forensic methodology so that each student will have the complete qualifications to work as a computer forensic investigator in the field helping solve and fight crime.

This course is the first course in the SANS Computer Forensic Curriculum. If this is your first computer forensics course with SANS we recommend that you start here.

FIGHT CRIME. UNRAVEL INCIDENTS... ONE BYTE AT A TIME.

You will Receive with this Course

Free SANS Investigative Forensic Toolkit (SIFT) Essentials

As a part of this course you will receive a SANS Investigative Forensic Toolkit (SIFT) Essentials with a Tableau Write Block Acquisition Kit. The entire kit will enable each investigator to accomplish proper and secure examinations of SATA, IDE, or Solid State Drives (SSD). The toolkit consists of:

  • Tableau T35e Write Blocker Kit
    • One Tableau T35e Write Blocker (Read-Only)
    • IDE Cable/Adapters
    • SATA Cable/Adapters
    • FireWire and USB Cable Adapters
    • Forensic Notebook Adapters (IDE/SATA)
    • HELIX Incident Response & Computer Forensics Live CD
  • SANS Windows XP Forensic Analysis VMware Workstation
  • Course DVD: Loaded with case examples, tools, and documentation

SANS Computer Forensic Website - forensics.sans.org

The learning does not end when class is over. SANS Computer Forensic Website is a community-focused site offering digital forensics professionals a one-stop forensic resource to learn, discuss and share current developments in the field. It also provides information regarding SANS forensics training, GIAC certification, and upcoming events. Visit http://forensics.sans.org. New content is added regularly, so please visit often. In addition, do not forget to share this information with your fellow forensic professionals.

The level of expertise is unprecedented. People like Ed are hard to find!
-Steve O'Brien, City of Bend

Training Events By Course

FORENSICS 408 :: Computer Forensic Essentials
SANS 2010 Orlando, FL March 06, 2010 - March 15, 2010
SANS at FOSE, GovSec and US Law 2010 Washington, DC March 23, 2010 - March 25, 2010
The 2010 European Community Digital Forensics and Incident Response Summit London, United Kingdom April 14, 2010 - April 20, 2010
Community SANS Nashville 2010 Nashville, TN May 03, 2010 - May 07, 2010
SANS Toronto 2010 Toronto, ON May 05, 2010 - May 10, 2010
SANS Security West 2010 San Diego, CA May 07, 2010 - May 15, 2010
SANS Singapore 2010 Singapore, Singapore May 17, 2010 - May 22, 2010
SANSFIRE 2010 Baltimore, MD June 06, 2010 - June 14, 2010
SANS vLive! - FOR 408 - Rob Lee Webcast Classroom Training, VA June 08, 2010 - August 24, 2010
Community SANS Salt Lake City Forensics 2010 Salt Lake City, UT June 14, 2010 - June 18, 2010
SANS Secure Europe - Amsterdam 2010 Amsterdam, Netherlands June 21, 2010 - July 03, 2010
SANS Rocky Mountain 2010 Denver, CO July 12, 2010 - July 17, 2010
SANS Middle East 2010 Dubai, United Arab Emirates October 09, 2010 - October 28, 2010