Certified Analysts: GCFA

Latest Blog Posts

Investigating WMI Attacks
February 09, 2019 - 4:53 AM

Investigate and fight cyberattacks with SIFT Workstation
January 11, 2019 - 8:49 PM

Gamble? Not with your future
January 11, 2019 - 6:32 PM

Latest Tweets @sansforensics

. @hexacorn Blog: Beyond good ol' Run key, Part 104 https:// [...]
February 23, 2019 - 2:30 AM

This webcast will talk about the new version of @SOF_ELK an [...]
February 22, 2019 - 7:55 PM

The #FOR500: #WindowsForensics course arms students with the [...]
February 22, 2019 - 4:40 PM

Latest Papers

Evidence of Data Exfiltration via Containerised Applications on Virtual Private Servers
By Seth Enoka

Using Image Excerpts to Jumpstart Windows Forensic Analysis
By John Brown

Windows 10 as a Forensic Platform
By Ferenc Kovacs

"I had taken several other forensic courses prior to this one, but none of them or their instructors made understanding forensic methodologies and techniques as clear and understandable as Rob Lee and this course has."
- Nathon Heck, Purdue

"Rob Lee is a master of the subject matter. The material is presented in a way that is understandable. Rob is also charismatic enough to make the course enjoyable."
- Erik Ketlet, JP Morgan Chase

"A great course on timeline, registry, and restore point forensics. SANS is continuing to be the leader on teaching new techniques happening with forensics."
- Brad Garnett, Gibson County Sherrif's Dept.