Stay ahead of cyber threats with immersion-style training in Reston, VA! Save $150 thru 1/29.


To attend this webcast, login to your SANS Account or create your Account.

Automating DFIR Getting closer to the find evidence button

  • Monday, June 22nd, 2015 at 11:00 AM EDT (15:00:00 UTC)
  • David Cowen
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!


Learn how to speed up your analysis, automate the boring parts of DFIR and be a better examiner. This webinar will walk you through the basics of how to access, extract and parse data from forensic images with python and pytsk.

Hear more from David at the upcoming DFIR Summit & Training in Austin, July 7-8th.

Why should you attend?

  • DFIR-Focused Training - Seven DFIR courses with top-rated industry expert instructors.
  • FOR408, FOR508, FOR526, FOR572, FOR610, SEC504 and the NEW FOR578
  • Summit Talks - Two days of trending talks with over 30 expert DFIR speakers.
  • DFIR NetWars - Two nights of hands-on, interactive learning enabling you to develop and master the skills needed to excel. Free when you register for a class!
  • Networking - Opportunities for real discussions with the best leaders in the community.
  • Register Today to learn what the experts know and get the training and knowledge you need to advance your DFIR career.

    Speaker Bio

    David Cowen

    David Cowen is the award winning blog author of the Hacking Exposed Computer Forensics blog, the author of Hacking Exposed: Computer Forensics (1st, 2nd and upcoming 3rd editions), Infosec Pro Guide to Computer Forensics, and the Anti Hacker Toolkit 3rd edition with over 15 years of digital forensic experience.

    Need Help? Visit our FAQ page or email

    Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.