Train From Home on Your Schedule with OnDemand - Special Offers Available Now


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Automating DFIR Getting closer to the find evidence button

  • Monday, June 22, 2015 at 11:00 AM EDT (2015-06-22 15:00:00 UTC)
  • David Cowen

You can now attend the webcast using your mobile device!



Learn how to speed up your analysis, automate the boring parts of DFIR and be a better examiner. This webinar will walk you through the basics of how to access, extract and parse data from forensic images with python and pytsk.

Hear more from David at the upcoming DFIR Summit & Training in Austin, July 7-8th.

Why should you attend?

  • DFIR-Focused Training - Seven DFIR courses with top-rated industry expert instructors.
  • FOR408, FOR508, FOR526, FOR572, FOR610, SEC504 and the NEW FOR578
  • Summit Talks - Two days of trending talks with over 30 expert DFIR speakers.
  • DFIR NetWars - Two nights of hands-on, interactive learning enabling you to develop and master the skills needed to excel. Free when you register for a class!
  • Networking - Opportunities for real discussions with the best leaders in the community.
  • Register Today to learn what the experts know and get the training and knowledge you need to advance your DFIR career.

    Speaker Bio

    David Cowen

    David Cowen is the award winning blog author of the Hacking Exposed Computer Forensics blog, the author of Hacking Exposed: Computer Forensics (1st, 2nd and upcoming 3rd editions), Infosec Pro Guide to Computer Forensics, and the Anti Hacker Toolkit 3rd edition with over 15 years of digital forensic experience.

    Need Help? Visit our FAQ page or email

    Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.