homepage
Open menu
Start in DFIR Hero Banner

Build Your Skills in DFIR

Expert curated resources on how to build skills in Digital Forensics and Incident Response
DFIR Courses Training Formats
CoursesCertificationsTraining FormatsReviewsLearn More

Are you interested in taking a SANS training course? Watch this video to hear about one student’s favorite aspect of his DFIR training with SANS and what made it so valuable.

See below for featured Digital Forensics & Incident Response courses, view our free course demos, and find a training format that works for you.

DFIR Courses and Demos

There’s no better way to see our top instructors in action, nor to evaluate the course subject matter and difficulty level than through our course demos. Click on “Course Details” to see a demo and view the course’s availability in our different training formats. Just make sure you’re logged into your SANS portal account to access them. Here are some SANS Digital Forensics & Incident Response courses to get you started.
Digital Forensics and Incident Response
FOR308: Digital Forensics Essentials
The Digital Forensics Essentials course provides the necessary knowledge to understand the Digital Forensics and Incident Response disciplines, how to be an effective and efficient Digital Forensics practitioner or Incident Responder, and how to effectively use digital evidence.
Course Details
Digital Forensics and Incident Response
FOR498: Digital Acquisition and Rapid Triage
FOR498, a digital forensic acquisition training course, provides the necessary skills to identify the many and varied data storage mediums in use today, and how to collect and preserve this data in a forensically sound manner despite how and where it may be stored. It covers digital acquisition...
Certification:

  • GBFA

Course Details
Digital Forensics and Incident Response
FOR500: Windows Forensic Analysis
FOR500 builds comprehensive digital forensics knowledge of Microsoft Windows operating systems providing the means to recover, analyze, and authenticate forensic data, track user activity on the network, and organize findings for use in incident response, internal investigations, intellectual...
Certification:

  • GCFE

Course Details
Digital Forensics and Incident Response
FOR585: Smartphone Forensic Analysis In-Depth
FOR585 is continuously updated to keep up with the latest malware, smartphone operating systems, third-party applications, acquisition shortfalls, extraction techniques (jailbreaks and roots) and encryption. It offers the most unique and current instruction to arm you with mobile device forensic...
Certification:

  • GASF

Course Details

    GIAC Certifications for DFIR

    SANS helps you learn the skills you need to do the job. GIAC certifications validate your skills to employers so you can get the job.

    Hear from GIAC certification holders on how their certs have helped them in their careers.

    See GIAC Certs for DFIR

    Training Formats

    Find the style that best fits your needs, from our most flexible format to our most immersive.
    OnDemand Training
    OnDemand
    Flexible anytime, anywhere access to SANS training. Receive training from the same top-notch SANS instructors who teach at our live training events - bringing the SANS experience right to you.
    Learn About OnDemand
    Live Online Training
    Live Online
    Online training featuring scheduled live interactive streaming sessions direct from your SANS instructor plus real-time chat with peers for a fun and engaging online learning experience.
    View Live Online Schedule
    In-Person Training
    In-Person
    Immerse yourself in SANS courses taught by world-renowned faculty in select locations. Practice skills during hands-on labs, network with peers, meet your instructor face-to-face, and more.
    Find In-Person Events

    What Alumni Say About Their SANS Training Experience

    This training is providing me with the blueprint to develop the cyber forensics skills needed on the job.
    Anthony F.
    - US Federal Agency
    Within the first two days of training, I had enough knowledge to go back to work and solve two outstanding issues.
    Beau G.
    - Information Systems Solutions
    It is valuable because it is comprehensive, tool-agnostic, and immediately applicable. I will directly apply the techniques of searching for malware/spyware to a recent case I had when I get back to work.
    Daniel Mandrella
    - KPMG
    FOR508 is a treasure trove of extremely useful information about DFIR and threat hunting. The course content is worth its weight in gold, and you just can't get this information anywhere else.
    Andrew C.
    - US Military
    FOR585 is the best mobile forensics course I have ever taken. You're drinking from a fire hose every day, but now you're one step ahead of the bad guys.
    Todd Faulkner
    - Cisco Systems, Inc.
      Think DFIRENTLY

      Keep Exploring

      View more details about our course authors, instructors, certifications, and DFIR resources.
      Learn more about DFIR