Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

Jim Clausing

Principal InstructorTechnical Consultant, Network Security Architect at AT&T

Specialities

Digital Forensics and Incident Response

Connect with Jim

Jim Clausing
Jump to:

About Jim Clausing

Jim Clausing first caught an attacker in 1981 after discovering a Trojan login program planted on his college's only computer. That experience sparked a career spanning more than 45 years dedicated to understanding how attackers operate and helping organizations defend against them.

Press & Media

More From Jim

  • sigs.pyGenerate md5, sha1, sha256, sha512, sha3-384 signatures from files (potentially recursively)
  • mac_robber.pymac_robber rewritten in python
  • docker_mount.pyScript to read-only mount docker layered filesystems (currently supports underlying aufs and overlay2)
  • tln_parse.pyPython script to replace parse.exe in Mari's KAPE mini-timeline workflow to give me good yyyy-dd-mm UTC timestamps

Students Say

  • Slide 1 of 3
    Jim takes the time to explain complex concepts and make sure that everyone is on the same page.
    Tatiana MonroeFOR610 Student
  • Slide 2 of 3
    Jim was a great instructor; really good delivery of the content, well paced, and lots of opportunity to ask questions.
    Ben WaltonU.S. Federal Agency
  • Slide 3 of 3
    The speed at which Jim moves is perfect. I really enjoy his teaching style.
    Tatiana MonroeFOR610 Student
Slide 1 of 0

Virtual Events

Explore content featuring this instructor’s insights and expertise.

Free Resources

Review relevant educational resources made with contribution from this instructor.

docker_mount.py

Open Source ToolsDigital Forensics and Incident Response
  • 17 Jun 2025
  • Jim Clausing

mac_robber.py

Open Source ToolsDigital Forensics and Incident Response
  • 17 Jun 2025
  • Jim Clausing

sigs.py

Open Source ToolsDigital Forensics and Incident Response
  • 16 Jun 2025
  • Jim Clausing

tln_parse.py

Open Source ToolsDigital Forensics and Incident Response
  • 16 Jun 2025
  • Jim Clausing

A few Ghidra tips for IDA users, part 2 - strings and parameters

BlogDigital Forensics and Incident Response
  • 22 Apr 2019
  • Jim Clausing

A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code

BlogDigital Forensics and Incident Response
  • 16 Apr 2019
  • Jim Clausing