Certified Analysts: GNFA

Latest Blog Posts

Investigating WMI Attacks
February 09, 2019 - 4:53 AM

Investigate and fight cyberattacks with SIFT Workstation
January 11, 2019 - 8:49 PM

Gamble? Not with your future
January 11, 2019 - 6:32 PM

Latest Tweets @sansforensics

Here's a chance to strengthen your writing skills while bene [...]
February 20, 2019 - 8:24 PM

SANS #DFIR Blog: "Investigating WMI Attacks" https://t.co/N4 [...]
February 20, 2019 - 7:55 PM

Don't miss @PhilHagen webcast March 5th at 1:00 pm ET. Lear [...]
February 20, 2019 - 2:45 PM

Latest Papers

Evidence of Data Exfiltration via Containerised Applications on Virtual Private Servers
By Seth Enoka

Using Image Excerpts to Jumpstart Windows Forensic Analysis
By John Brown

Windows 10 as a Forensic Platform
By Ferenc Kovacs

"The class provided in-depth, real world, hands-on information."
- Robert Dale Drollinger, General Dynamic

"This course is filling in the blanks in my knowledge of how some things work. It is nice to know what the tools are doing."
- Douglas Couch, Purdue University

"A great course on timeline, registry, and restore point forensics. SANS is continuing to be the leader on teaching new techniques happening with forensics."
- Brad Garnett, Gibson County Sherrif's Dept.