Group Purchasing
Group Purchasing

Heather Barnhart

FellowDFIR Curriculum Lead and Head of Faculty at SANS Institute

Specialities

Digital Forensics and Incident Response

Heather Barnhart

About Heather Barnhart

Heather Barnhart is the DFIR Curriculum Lead and Head of Faculty at SANS Institute, where she shapes the future of digital forensics and incident response training. She is also Dean of Faculty at the SANS Technology Institute, the premier college for cybersecurity. A SANS Fellow, she is recognized for advancing smartphone forensics and Windows artifact analysis, helping investigators uncover critical evidence in today’s most complex cases.

Her career spans law enforcement, government, and industry; she previously served as Senior Director of Forensic Research at Cellebrite and now consults there as a digital forensics expert. Across nearly two decades in DFIR, Heather has worked high-profile matters, including analysis of Osama Bin Laden’s digital media and digital evidence tied to the Idaho murders case, experience that informs her practical, case-driven teaching. Her contributions have been featured in the SANS blog “Inside the Idaho Murder: How Digital and DNA Forensics Uncovered Truth”, as well as in mainstream outlets such as People and ABC 20/20. These cases, combined with her broader work in crimes against children, fraud, counterterrorism, and homicide, give her unmatched perspective in teaching practitioners how to handle real-world investigations.

At SANS, Heather leads and teaches SANS FOR585: Smartphone Forensic Analysis In-Depth and SANS FOR500: Windows Forensic Analysis, and co-authored SANS SEC403: Secrets to Successful Cybersecurity Presentation. Drawing on years of work decoding smartphone artifacts and breaking down encrypted apps, she built FOR585 to give students hands-on skills in acquiring, decoding, and interpreting iOS and Android data in real-world investigations. Her Windows expertise, ranging from registry forensics to uncovering traces in event logs, file systems, and the USN journal, directly fuels the labs and case scenarios in FOR500, preparing students to reconstruct user activity and support both incident response and criminal prosecutions.

She is co-author of the widely used book, “Practical Mobile Forensics”, a technical editor for “Learning Android Forensics” and “SQLite Forensics”, and co-author of SANS posters and white papers. A frequent keynote speaker at SANS DFIR Summits, Techno Security, and RSA Conference, where for the past seven years she has been a panelist on the keynote session “The Five Most Dangerous New Attack Techniques…and What to Do About Each”, Heather emphasizes clarity, repeatable workflows, and confidence, ensuring her students leave ready to solve the next case that lands on their desk.

Qualifications Summary
  • Certifications: GIAC: GIAC Advanced Smartphone Forensics (GASF), GIAC Certified Forensic Examiner (GCFE); IACIS: Certified Forensic Computer Examiner (CFCE); OpenText: EnCase Certified Examiner (EnCE); Cellebrite: Cellebrite Certified Operator (CCO), Cellebrite Certified Physical Analyst (CCPA)
  • DFIR Curriculum Lead and Head of Faculty, SANS Institute; SANS Fellow
  • Consultant, Digital Forensics Expert, Cellebrite; formerly Senior Director of Forensic Research, Cellebrite
  • Investigated high-profile digital evidence including Osama Bin Laden’s media and the Idaho murders case
  • Co-author of “Practical Mobile Forensics”; technical editor for “Learning Android Forensics and SQLite Forensics”
  • Awards: Mirror Review, The 10 Influential Women Leaders of 2023
  • Education: Bachelor of Science, West Virginia University; Leadership Principles, Harvard Business School Online (2021)

Press & Media