SANS Lethal Forensicator Coins

Hundreds of SANS Institute digital forensics students have mastered the concepts and skills, beat out their classmates, and proven their prowess. These are the elite, the recipients of the SANS Lethal Forensicator Coins, awards given to a select few among the thousands of students who have taken any SANS DFIR courses.

Lethal Forensicator Coins are awarded to those who show exceptional talent, make outstanding contributions to the field, or demonstrate leadership in the digital forensics profession and community. The coins are a challenge to win and an honor to receive. They are also intended to be rare.

Challenges for the Coins are held on the final day of each course. Students must successfully overcome several obstacles, directly compete against fellow students, and prove their proficiency during timed, hands-on incidents. The obstacles, competitions, and hands-on scenarios have been created by SANS's top instructors, who are digital forensics practitioners, subject-matter experts, experienced teachers, and industry leaders in their own right. At the end of the challenge the instructor announces the winner(s) and awards them their coins. 

Holders of the Lethal Forensicator Coins are properly trained incident responders or investigators who sometimes represent the only defense an organization has in place during a compromise or a complex digital investigation. These analysts know what they are up against and continually strive to further not only their own knowledge, but also the knowledge of the entire digital forensics field. They are proactive in sharing their experience and encouraging learning through participation in the community. They stay ahead of the curve by constantly seeking new knowledge. Often, they are the leaders in the digital forensics and incident response community.

DFIR Coins

Lethal Forensicator Coin Holders

Already been awarded a coin in the Digital Forensics & Incident Response Curriculum? Find your name on our list of winners.

DFIR Course Challenge Coins


DFIR Challenge Coin Back Design

Each Lethal Forensicator Challenge Coin features the same back design, it shows digital forensicators fighting evil in their superhero form.

DFIR NetWars Coin

DFIR NetWars

Staying up to date on the latest challenges in the digital forensics field demands analytical skills that cannot be gained by just reading a textbook. Just like firefighters could never learn the skills to combat a fire by just studying theory, incident responders, threat hunters, and digital forensic investigators must test their skills in action, as they do with DFIR NetWars.

Legacy Coin

Legacy SANS DFIR Challenge Coin

The original DFIR Lethal Forensicator coin has been retired with the release of the class-specific coins listed above. However, the holders of this coin are still as worthy of respect for their accomplishments. If you encounter a holder of this coin in the field, you've found an original.

History of the SANS Challenge Coins

SANS Challenge Coins were initially created to recognize students who demonstrate exceptional talent, make outstanding contributions, or serve as leaders in the digital forensics profession and community. The coin is meant to be an honor, and it is intended to be rare. The SANS Institute uses the coins to identify and honor those who excel at detecting and eradicating threats, understand the critical importance of cybersecurity, and continually strive to further not only their own knowledge but also that of the entire digital forensics field. They proactively share their experience and encourage learning through participation in the community, and they are typically leaders in the digital forensics and incident response community.

History of the Word "Forensicator"

The term "forensicator" was coined by BJ Lachner and popularized when it was used in the legendary "Forensicator Pro" Cyberspeak Podcast on 1 April 2007 with SANS instructor Ovie Carroll and Brett Padres. In that tongue-in-cheek podcast, Ovie and Brett described a tool called "Forensicator Pro" that would put forensic analysts out of business and was "viewed by many in the community as the end of human involvement in computer forensics examinations." As Brett described it: "Basically you press a button, you point it at an image, and the tool outputs a full forensic examination and report that is perfect." The episode was released as an April Fools' Day joke about what many in the field call "Nintendo Forensics" that rely too much on automated examinations versus traditional analysis, resulting in poor reports. But to this day, Brett and Ovie still receive emails asking where "Forensicator Pro" can be purchased and downloaded!

The term "forensicator" stuck and today is used by many computer forensics and incident response firms to describe individuals who essentially perform the same type of work as the mythical "Forensicator Pro" would have done. The forensicator label has grown in popularity among digital forensic professionals in the workplace, at conferences, and while sharing a cold one with a friend. Here are a few examples:

"Coin Check" Challenge

Initiated by one coin holder to another, a coin check typically begins by a challenger holding his or her coin in the air or slamming it on a table and yelling "coin check!" All who are challenged must respond by showing their coins to the challenger within 10 seconds, and whoever fails to do so must buy everyone a round of drinks. If all the challenged coin holders produce their coin, the challenger must buy the round of drinks. (By the way, if you accidentally drop your coin and it makes an audible sound on impact, then you've "accidentally" initiated a coin check. And, there are no exception to the rules!)

Ways to Earn Lethal Forensicator Coins

There are other ways to win the DFIR Challenge coins besides being an exceptional DFIR student or winning the classroom challenges. Any GOLD GCFA, GREM, GCFE holder who has written a published white paper that has furthered the field of research in Digital Forensics receives a coin, as do SANS Digital Forensics Blog authors who have written six published entries over a one-year span. In addition, speakers and panelists who participate in a SANS Digital Forensic Summit are awarded coins (vendors and vendor-related speakers are not eligible). Finally, any coin holder can nominate an individual in the digital forensics field who has contributed knowledge, tools, or service.