Carlos Cajigas is a digital forensics and incident response (DFIR) professional with more than two decades of experience spanning both law enforcement and the private sector. A native of San Juan, Puerto Rico, he began his career with the West Palm Beach Police Department, where he advanced from patrol officer to detective, eventually specializing in computer crime investigations and digital forensics. Today, Carlos serves as Chief Technology Officer of Covert Bit Forensics and as a SANS Principal Instructor, where he teaches SANS FOR500: Windows Forensic Analysis and SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics.
His teaching is grounded in investigative and technical expertise. In FOR500, Carlos draws on his background in forensic examinations and evidence handling to guide students through the collection, analysis, and interpretation of data from Windows systems. In FOR508, he applies his incident response and threat hunting experience to advanced labs on intrusion analysis, adversary tracking, and detection strategies. By blending investigative techniques with enterprise-level tradecraft, Carlos equips his students with the skills required to investigate and respond to cyber incidents across diverse environments.
Beyond his work with SANS, Carlos is an active contributor to the DFIR community. He maintains a forensic blog and a YouTube channel focused on helping practitioners adopt Linux-based open-source tools as practical complements to commercial forensic suites. On GitHub, he shares Velociraptor VQL scripts, automation for remote evidence collection with KAPE, and Python scripts for IP reputation and geolocation checks, reflecting his commitment to advancing accessible tools for investigators worldwide.
Carlos’s credentials include EnCE (EnCase Certified Examiner), CDFE (Certified Digital Forensics Examiner), CFCE (Certified Forensic Computer Examiner), GCFA (GIAC Certified Forensic Analyst), GCFE (GIAC Certified Forensic Examiner), GCIH (GIAC Certified Incident Handler), GASF (GIAC Advanced Smartphone Forensics), and GREM (GIAC Reverse Engineering Malware), and he is an FDLE-certified instructor (Florida Department of Law Enforcement). He is an active member of IACIS (International Association for Computer Information Systems) and the Miami Electronic Crimes Task Force. Through his teaching, research, and community contributions, Carlos Cajigas continues to shape the future of digital forensics and incident response.
Member of IACIS and Miami Electronic Crimes Task Force
Students Say
Slide 1 of 3
[Carlos] showed us a few tips and tricks with the labs, which was an added bonus! Carlos is a great instructor, his ability to show other examples on the fly and switch between windows in the online environment is very impressive.
Slide 2 of 3
Carlos is incredibly engaging, articulate, and keeps all of the material interesting.
Slide 3 of 3
Carlos does an excellent job of explaining the subjects, and if we don't understand something at first, he will ensure we do.
Slide 1 of 0
(1/0)
Upcoming Training Courses
Here are upcoming opportunities to train with this expert instructor.
Intermediate - FOR508 - Digital Forensics and Incident Response, Artificial Intelligence
