A self-described Mac nerd, Sarah Edwards is a forensic analyst, author, speaker, and both author and instructor of SANS FOR518: Mac Forensic Analysis. She has been a devoted user of Apple devices for many years and has worked specifically in Mac forensics since 2004, carving out a niche for herself when this area of forensics was still new. Although Sarah appreciates digital forensics in all platforms, she has a passion for working within Apple environments and is well known for her work with cutting-edge Mac OS X and iOS, and for her forensic file system expertise.
Sarah's dynamic classroom and presentation skills have been heralded by both her students and colleagues. She keeps students interested and engaged. Sarah has more than 12 years of experience in digital forensics, and her passion for teaching is fueled by the ever-increasing presence of Mac devices in today's digital forensic investigations. Given the complexity of most cases and the high probability that an OS X or iOS will be a part of an investigation, deep knowledge of these Operating Systems is crucial to ensure that forensic analysts grasp all the information required in a case and not omit valuable data.
"Apple devices will continue to grow in popularity, and digital forensic investigators and analysts must start paying more attention to them," Sarah explains. "Windows analysis is the base education in the field of digital forensics, and any additional skills you can acquire set you apart from the crowd, whether it is Mac, mobile, memory, or malware analysis."
Sarah has worked with federal law enforcement agencies on a variety of high-profile investigations in such areas as computer intrusions, criminal cases, counter-intelligence, counter-narcotics, and counter-terrorism. Her research and analytical interests include Mac forensics, mobile device forensics, digital profiling, and malware reverse engineering.
A frequent presenter, Sarah has spoken at industry conferences including Shmoocon, Enfuse (formerly known as CEIC), DEF CON, BSides New Orleans, BSides Las Vegas, and the SANS DFIR Summit. She has a bachelor's degree in information technology from the Rochester Institute of Technology and a master's in information assurance from Capitol College. Beyond her deep interest in digital forensics and anything Mac, Sarah loves cooking, reading tech books, traveling anywhere, and "making things work".
Here's What Students Are Saying about SANS Certified Instructor Sarah Edwards:
- "Sarah knows her stuff. This course gets better each day. Very useful information. Well-formed course." - Anthony Cifaretto, Verizon
- "Sarah gave another great day of presentations - her knowledge is impressive." - Ben Keck, Ciena
- "Very comprehensive in-depth coverage of the course topic. Excellent reference materials as a take- away." - Jennifer Barnes, Indiana State Police
- "Sarah Edwards has spent the last several months putting the (FOR518) material together and I have to say that it is fantastic. The content is very detailed and provides excellent information. I have a fair amount of experience investigating Apple systems. In fact, Apple products appear to be the core (get it?) of what we do these days. As such I would not have expected to learn as much as I did but there were times this week when my jaw dropped at one of Sarah's revelations or one of Hal Pomeranz's demonstrations. I learned a great deal and am delighted at the fact that I was able to attend." - Lee Whitfield, 4:cast
SANS Instructor Endorsements:
"Sarah's expertise in authorship and instructing has led to the successful addition of the FOR518 Mac course to our lineup. Sarah's classroom and presentation skills continuously pull in record scores. She is absolutely the best at her trade." - Rob Lee, SANS Fellow and DFIR Curriculum Lead
"Sarah is clearly the Mac subject-matter expert who has designed a top-notch course. She handles student questions with the expertise and grace of the seasoned instructor she is." - Ovie Carroll, SANS Certified Instructor
"Sarah did an amazing job producing an incredibly detailed technical course on Mac Forensics. And then she shows up every time to teach and knocks it out of the park. Students can't help but respond to her total mastery of the material and enthusiasm for the subject matter." - Hal Pomeranz, SANS Fellow
- More than 12 years of Mac forensics experience
- More than 8 years' experience teaching in digital forensics
- FOR518 Mac Forensics Analysis course and author statement
Get to Know Sarah Edwards"