Ovie Carroll

For Ovie Carroll, digital forensics is all about the hunt for evidence in digital places that are hiding critical clues, followed by deep analysis to prove something that the evidence was never intended to prove. That's why Ovie, a cybercrime expert and veteran law enforcement officer, loves teaching the SANS FOR500 Windows Forensic Analysis course.

More About Ovie


"I love exposing students to how exciting digital investigative analysis is," Ovie says. "My passion is for digital evidence and digital investigative analysis. I leverage my abilities, expertise, and my current experience with the U.S. Department of Justice to see across investigative activities around the world, use that vantage point to see the whole picture of where we are in digital investigative analysis and cybercrime fighting, and identify the future challenges in both investigative practices and the courts. And I try to bring all of that to my students."

Ovie's students are clearly getting what he's bringing - many of them finish his classes with renewed career plans. "They leave my class saying that they originally had no intention of going into digital evidence but now see it is more exciting than any other aspect of cybercrime fighting or incident response," he says.

Ovie's teaching philosophy centers on sharing and demonstrating his passion for digital investigative analysis. Drawing on 31 years of law enforcement and cyber investigation experience, his dynamic presentations not only deliver the technical material but also show how each digital artifact can be used to help solve cases.

Ovie's career in digital forensics has its roots in his years-long interest in computers - how they work and how they can and are being used in everyday life. Of particular interest is how companies are collecting, manipulating, analyzing, and monetizing people's every behavior online. "I am always interested in investigating how we can possibly tap into the information computers and companies are collecting to use it for good and to bring justice to victims," he explains.

In addition to teaching digital forensics at SANS and co-authoring the FOR500 Windows Forensic Analysis course, Ovie is the Director of the Cybercrime Lab of the Computer Crime and Intellectual Property Section (CCIPS) at the Department of Justice (DOJ). The lab provides advanced computer forensics, cybercrime investigation, and other technical assistance to DOJ prosecutors to support implementation of the department's national strategies for digital evidence and to combat electronic penetration, data theft, and cyberattacks on critical information systems. He also teaches two classes as an adjunct professor at George Washington University in Washington, DC.

Prior to joining the DOJ, Ovie was a Special Agent in Charge overseeing the Technical Crimes Unit of the Postal Inspector General's Office, where he was responsible for all computer intrusion investigations within the postal service network infrastructure and for providing all digital forensic analysis in support of criminal investigations and audits. He also served as a special agent in the Air Force Office of Special Investigations, investigating computer intrusions and working both general crimes and counterintelligence as well as conducting investigations into offenses including murder, rape, fraud, bribery, theft, and gangs and narcotics.

Computers are front and center in Ovie's free time as well, but he also enjoys plenty of offline activities, including public speaking, scuba diving, travel, and meeting new people.