SANS Digital Forensics and Incident Response Blog

Top 7 reasons why Boston's SANS Digital Forensics is going to rock

Computer Forensic Investigations and Incident Response (FOR508)

7. Dave has more than 15 years of experience in IT and info sec, including 12 years working in a large research university network at a time when firewalls were frowned upon and compromise was commonplace. In addition to corporate and public sector work, Dave has been consulting on digital forensics cases for five years and teaches from that experience. Follow Dave on Twitter:

6. Regardless of experience level, students will take away a deeper understanding of digital forensics. This class will make you a better analyst.

5. Community SANS courses have a smaller class size. Smaller classes mean more time one-on-one with the instructor. It is like having your personal Digital Forensics Sensei named Dave.

4. Dave tells stories from his own experience in order to emphasize different aspects of the material including one breach of PCI data that may not have been a breach at all or what Michael Cloppert recently referred to as an "uncident" in his Uncident Response post.

3. Legal day! One day of the course is entirely dedicated to the law and what digital forensics investigators should know before performing case work. You'll learn critical aspects of the law and how they apply to digital forensics as well as the importance of policy and how it can make or break a case.

2. A little something extra. In addition to all the great course content, Dave brings some tools of the trade to the classroom so students can take a look at some of the elements of an examiner's kit. He also brings copies of some excellent digital forensics books for students to take a look at.

1. It's Boston during the week of St. Patrick's Day! Don't get too carried away, you'll want to be back in the classroom on Thursday morning for a look at Windows artifacts every practitioner should know.

0. On day six, you will apply the material as you take on the computer forensics challenge exercise.

Whether you're new to the field of digital forensics, or have been at it for a few years, this course will equip you with the tools, techniques and understanding to become a top-notch analyst and you'll have fun doing it. See you in Boston!

REGISTER NOW! Class Size is Limited!


Posted February 9, 2010 at 7:27 PM | Permalink | Reply


I am actually considering taking this in Boston but had heard somewhere that the content is being updated by Rob Lee for Orlando. Just wondering if this is true and if so will the Boston class cover the new material?

Posted February 10, 2010 at 2:26 AM | Permalink | Reply

Dave Hull

Perhaps Rob will chime in on this as I do not know the update schedule. A major update to the material was just released and I was actually the first to teach the new material during the last week in January. I've been through several revisions of the material over the last two plus years and this was by far the most comprehensive update that I've seen. Though the fundamentals of digital forensics have remained constant for years, the details are constantly changing. That said, at some point, you've got to dive in. I hope to see you in Boston. :-)

Posted February 11, 2010 at 2:39 AM | Permalink | Reply


thanks Dave
Just pinged Rob on Securabit podcast via IRC ''" he says new material should be a go for Boston! Now to get training $ in order ''" see you there!

Posted February 11, 2010 at 1:34 PM | Permalink | Reply

Dave Hull

Awesome Tim. Looking forward to it!