SANS Digital Forensics and Incident Response Blog

Introductory Offers for New Computer Forensics Courses at SANSFIRE 2009

Hello SANSForensic Blog Reader

As the lead author and faculty fellow for the popular computer forensics course SEC 508: Computer Forensics, Investigation, and Response, I wanted to let you know about three brand new digital forensic training courses offered at SANS to help you further your knowledge of digital forensics for both entry-level analysts and seasoned practitioners. All three of these courses are being offered for the first time at SANSFIRE 2009 from June 13-22, 2009 in Baltimore, MD.

Introductory offers for these new computer forensic courses:

Half Price for co-workers!!

Register for Computer Forensic and E-Discovery Essentials SEC 408 or Network Forensics SEC 558 (see below) by Tuesday, May 6, and you can enroll a co-worker for the same class for half price by entering the following discount code "FORENSICFRIEND". In order to realize the savings, just be sure to enter the name of your friend that will be paying normal pricing for the event in the "Comments" section of the registration form.

Special For Law Enforcement!!

If you are a local law enforcement officer and you enroll for Computer Forensic and E-Discovery Essentials SEC 408 or Network Forensics 558 you can bring another local law enforcement officer to the same course for 1/4 price. This special is for the first 16 registrants so act soon. Please email if you are law enforcement and would like to take part in this deal.

The NEW Forensic Courses:

Security 408: Computer Forensic and E-Discovery Essentials ( -

Computer Forensic and E-discovery Essentials (SEC408)This brand new course focuses on the essentials that a forensic investigator must know to investigate core computer crime incidents successfully utilizing the industries top tools: Access Data's FTK and Guidance Software's EnCase.

**** As a part of this course you will take home with you a version of the SANS Investigative Forensic Toolkit (SIFT) with aTableau USB/Firewire Write Blocker Acquisition Kit.****

Security 558: Network Forensics ( -

Learn how to recover and analyze evidence "on the move" from network-based devices such as web proxies, firewalls, IDS, and routers.

Security 606: Data Recovery Forensics ( -

Learn how to recover data from dead and damaged hard drives, corrupt file systems, and more.

These courses provide the skills you'll need to be successful in facilitating investigations and building stronger cases. In case you haven't been to SANS before, I am offering you a free 30-minute on-line
module from the industry-recognized course SEC508: Computer Forensics, Investigation, and Response to help you better understand the kind of instruction that you'll receive in all of our classes at SANSFIRE 2009 and to help you to start to conduct better forensic work today. Simply go to the link below and click on the "Free Demo" button on the right:

If you like the topics covered in the brief descriptions above, you can sign up to attend any of these classes at SANSFIRE 2009 by going to:

If you are unable to attend SANSFIRE 2009 but would like to get this training, consider attending the SANS WhatWorks in Forensics and Forensic Summit 2009 July 7-8 in Washington DC with training courses held before and after the Summit. (

And don't forget to tell your friends and colleagues about these new SANS course offerings.

Best regards,
Rob Lee
SANS Forensic Curriculum Lead and Faculty Fellow