NEW! FOR308: Digital Forensics Essentials

The Digital Forensics Essentials course provides the necessary knowledge to understand the Digital Forensics and Incident Response disciplines, how to be an effective and efficient Digital Forensics practitioner or Incident Responder, and how to effectively use digital evidence. Now available via Live Online & OnDemand.

Last Chance for Summer Special Offers with OnDemand Training

Training that fits your schedule with hands-on Labs and support from GIAC-certified SMEs. More than 50 of SANS most popular courses available anytime, anywhere. Learn More Today!

Cyber Threat Intelligence Summit & Training

FREE Summit: Jan 21-22 | Training: Jan 25-30
SANS CTI Summit will provide you with specific analytical techniques and capabilities, through case studies and firsthand experience, that can be utilized to properly create and maintain threat intelligence in your organization. Join us for two days of in-depth threat intelligence talks and case studies, interactive discussions and focused breakouts sessions, and enjoy networking with leading experts, SANS instructors, and your peers in the CTI community.

Are you a LEO affected by training cuts?

SANS is proud to support U.S. Law Enforcement professionals experiencing hardship funding their training efforts. We have created special programs that can offer significant flexibility toward SANS DFIR courses. Check if you qualify!

You only have one chance to collect data properly

The FOR498: Battlefield Forensics & Data Acquisition course provides first responders and investigators alike with the advanced skills necessary to properly respond to, identify, collect, and preserve data from a wide range of storage devices and repositories, ensuring that the integrity of the evidence is beyond reproach. Now available via Live Online & OnDemand
1 2 3 4 5
DFIR Courses

Whether you're seeking to maintain a trail of evidence on host or network systems or hunting for threats using similar techniques, larger organizations are in need of specialized professionals who can move beyond first-response incident handling to analyze an attack and develop an appropriate remediation and recovery plan. Our DFIR Courses will teach you how to detect compromised systems, identify how and when a breach occurred, understand what attackers took or changed, and successfully contain and remediate incidents.
Read More


Every year the SANS Digital Forensics & Incident Response (DFIR) Faculty produces thousands of free content rich resources for the digital forensics community. These resources are aimed to provide you with the latest in research and technology available to help you streamline your investigations. Our number one priority is to support the DFIR community by not only providing content to solve even the most difficult problems investigators face daily, but also provide an open forum for community mentoring, development and support.
Read More

SIFT Workstation

Developed by an international team of forensics experts, the SIFT Workstation is available to the digital forensics and incident response community as a public service. SIFT features powerful cutting-edge open-source tools that are freely available and frequently updated and can match any modern DFIR tool suite. Thousands of individuals download the SIFT workstation yearly and many organizations had found SIFT to be the key investigative suite to use during their investigations.
Download it now

Keep up with the DFIR industry!

Follow us on social media or register for our Community List Service and Monthly DFIR Newsletter