Featured Digital Forensics and Incident Response Courses & Certifications

    DFIR Tools


    Digital Forensics and Incident Response Certifications

    It takes intuition and specialized skills to find hidden evidence and hunt for elusive threats. GIAC's Digital Forensics and Incident Response certifications encompass abilities that DFIR professionals need to succeed at their craft, confirming that professionals can detect compromised systems, identify how and when a breach occurred, understand what attackers took or changed, and successfully contain and remediate incidents. Keep your knowledge of detecting and fighting threats up to date - and your work role secure - with DFIR certifications.


    Lethal Forensicator Coins

    Hundreds of SANS Institute digital forensics students have stepped up to the challenge and emerged victorious. They've mastered the concepts and skills, beat out their classmates, and proven their prowess. These are the elite, the recipients of the SANS Lethal Forensicator Coin, an award given to a select few among the thousands of students who have taken any of the SANS Institute Digital Forensics or Incident Response (DFIR) courses. Lethal Forensicator Coins are awarded to those who show exceptional talent, make outstanding contributions to the field, or demonstrate leadership in the digital forensics profession and community. The coins are a challenge to win and an honor to receive. They are also intended to be rare.

    Are you a LEO affected by training cuts?

    SANS is proud to support U.S. Law Enforcement professionals experiencing hardship funding their training efforts. We have created special programs that can offer significant flexibility toward SANS DFIR courses.
    incident Response Graduate Certificate

    SANS.edu Graduate Certificate in Incident Response

    • Designed for working InfoSec and IT professionals
    • Highly technical 13-credit-hour program
    • Includes 4 industry-recognized GIAC certifications

    DFIR NetWars and Continuous

    An incident simulator with forensic, malware analysis, threat hunting, and incident response case scenarios to help you expand your DFIR capabilities.

    SANS DFIR Summit & Training 2024

    Summit: Aug 22-23 | Training: Aug 24-29 | 14 Top Courses Available Salt Lake City, UT & Live Online Join us this Summer for the must-attend DFIR event of the year! Don't miss the chance to learn from and connect with the industry's top practitioners who will share their latest digital forensics and incident response research, tools, case studies, and solutions.

    More Free Digital Forensics and Incident Response Resources


    The content was high quality and the exercises were made it easier to fully grasp the content.
    Kellon Benson
    - Central WA University
    The instructor and course materials are the best level, so people who have interest in Forensics should take the course and obtain a deeper knowledge.
    Yusuke Takahashi
    - LAC
    Extremely valuable training! Trainer added value due to his course knowledge & personal experience sharing.
    - Eu Council
    Very relevant to my daily IR work and highly recommend this to any DFIR or IR in general pros.
    Emile Smith
    - TVA
    This is top quality training that will return value immediately when returning to work.
    Nic Cargill
    This training is great and important to me because it gives me more knowledge to assist in my investigations.
    Christopher J.
    - GBI Georgia Bureau of Investigation
    The material is relevant, real world, and has effective hands on exercises.
    Dustin B.
    - SOCOM
    Getting hands on experience with the labs helps to cement concepts that were taught.
    Molly L.
    - NCFTA
    After two days, I'm excited to go back to work & use what I've learned.
    - GRDA
    It was great having you as an instructor! Your expertise & experience in the field is such a help during class, you keep things interesting!
    Brittany Pedulla
    - Kroll

      About Digital Forensics and Incident Response

      Whether you're seeking to maintain a trail of evidence on host or network systems or hunting for threats using similar techniques, larger organizations are in need of specialized professionals who can move beyond first-response incident handling to analyze an attack and develop an appropriate remediation and recovery plan. Our DFIR Curriculum will teach you how to detect compromised systems, identify how and when a breach occurred, understand what attackers took or changed, and successfully contain and remediate incidents.

      Every year the SANS Digital Forensics & Incident Response (DFIR) Faculty produces thousands of free content-rich resources for the digital forensics community. These resources are aimed to provide you with the latest in research and technology available to help you streamline your investigations. Our number one priority is to support the DFIR community by not only providing content to solve even the most difficult problems investigators face daily, but also provide an open forum for community mentoring, development and support.