SANS Digital Forensics and Incident Response Blog: Author - Rob Lee

SANS Computer Forensic/IR Summit on 7-8 July: Last Call

Computer Forensic and Incident Response Blog Readers:

Two years ago SANS had only one course, 900 certified individuals, and no summits planned. In 2009 we have expanded to 6 forensics and IR courses, created a real curriculum path to follow, brought in more industry known expert instructors, planned two summits, maintain over 1500 certified, and GCFA is about to become accredited under ANSI 17024. We have come far, but our work is not done yet.

We are only a few weeks away from the Computer Forensic


Forensic/IR Summit 2008 Archive Presentations

by Rob Lee

In preparation for the upcoming SANS Forensic and Incident Response Summit 2009 in DC we had not officially released the presentations to the public from last year's summit in Las Vegas. SANS has agreed to publishing the archive today from last October 2008.

This year's summit is larger, has more speakers/panelists, more content, and more education and discussion surrounding current events in Digital Forensics and the Incident Response community.

Don't Forget about the 2009 SANS Forensic/IR Summit Courses

Advanced Filesystem Recovery and Memory Forensics

SANS Forensic/IR Summit Panel Questions Posted

The WhatWorks in Forensics and Incident Response Summit 2009

The panels for the Forensic and Incident Response Summit have been posted. Each panelist will help answer these critical questions and present their answers to the audience. Then the attendees will be able to ask their own questions to the panel via a question and answer session. The panels are one of the many great reasons to attend the 2009 Forensic/IR Summit.

This event should not be missed.

Regsiter NOW!!


User Panel: Essential Incident Response Techniques:

Panelists will tell which incident response tools and techniques they regularly use, what


Webcast Today 5/19: SANS Forensic/IR Summit 09 Panel Preview

Webcast Today 5/19 @ 1PM EDT

Webcast Panel: SANS Forensic/IR Summit 09 Preview: Essential Incident Response Techniques


Forensic Summit Link:

Featuring: Harlan Carvey, Dave Hull, Chris Pogue

Rob Lee - Moderator

Webcast Panel: Essential Incident Response Techniques: Panelists will tell which incident response tools and techniques they regularly use, what worked and what didn't work, and they will share the lessons they learned.

Harlan Carvey - Senior Incident Responder, IBM ISS; Author of "Windows Forensic Analysis" and the blog

SANS Computer Forensic Essentials Course and Training

SANS is shifting from one forensic course(SEC508) to two core courses (SEC408, SEC508) to build the most complete curriculum available in the computer forensic community. Our forensic curriculum is listed here:

I would highly recommend if you are recommending SANS to your peers and it is their first computer forensic course with SANS or if they primarily investigate Windows based operating systems, they should first attend SEC408, Computer Forensic Essentials . ( If you have taken