Last Day to Save $200 on Cyber Security Training at SANS Scottsdale 2019!

DFIR Challenge Coin - A Badge Of Honour

Learn the story behind SANS' DFIR Challenge Coin and discover how to secure your own.

SANS Lethal Forensicator Coin is awarded to Digital Forensic and Incident Response students who demonstrate remarkable skill, or contribute a great deal to the forensics community.

The Coins are beautifully designed, tough to earn and highly prized by those who carry them.

DFIR Coins

History Of SANS DFIR Coin

SANS DFIR Coin is officially named the Lethal Forensicator Coin. The Coin was created by Rob Lee - the curriculum lead and primary author of SANS' Digital Forensics Incident Response family of courses.

Along with other accolades, Rob founded the Information Warfare Squadron - the first US military unit focussed on information warfare.

The term Forensicator was itself created on 1st April 2007, during a security podcast created by two SANS Instructors - Ovie Carroll and Brett Padres. The two talked about a new forensics tool called Forensicator Pro, a piece of software that promised to completely automate the process of creating a forensic report. Forensicator Pro was, of course, an April Fools' prank.

Though originally a joke, the term stuck and took on a life of its own. A Forensicator became a byword for people who conduct forensic examinations.

Words change, language grows and, Lethal Forensicators evolved to become a term for people who can detect and eradicate the most advanced threats.

What Does SANS DFIR Coin Signify?

The Forensicator Coin is a symbol of belonging. It signifies being part of an elite group and is a badge of honour. It demotes that the holder possess the finest DFIR skills. The Coins show the holder's commitment to lifelong learning and professional improvement.

How Can I Earn A DFIR Forensicator Coin?

There several ways in which a student can earn a Forensicator Coin:

  • Scoring first place in a SANS Training Challenge that demands forensic talent (these sessions include those held during DFIR courses FOR500, FOR508, FOR558, and FOR563).
  • At the Instructor's discretion during a Training Event.
  • Write a GIAC gold paper that forwards the digital forensic field.
  • Contribute six published pieces to the SANS Digital Forensics blog.
  • Speak at a SANS Digital Forensics Summit (this does not apply to vendor talks).
  • Nomination by another SANS Coin holder.

Groups can be eligible to receive a DFIR Coin too. To be considered, the group must help further the field of digital forensics. This can mean contributing research, knowledge, and capabilities to the wider forensic community.

SANS provide Private Training to groups of 25 or more students. To explore this training option email emea@sans.org or read our Testimonials for more information.

Please contact dfir-coins@sans.org with any questions relating to DFIR Coins.


Training Events Offering DFIR Courses
Event Dates Register
SANS SEC504 Stuttgart February 2019 Feb 04 - Feb 09, 2019  
SANS FOR610 Madrid February 2019 (in Spanish) Feb 11 - Feb 16, 2019  
SANS London February 2019 Feb 11 - Feb 16, 2019  
SANS Zurich February 2019 Feb 18 - Feb 23, 2019  
SANS Riyadh February 2019 Feb 23 - Feb 28, 2019  
SANS Brussels February 2019 Feb 25 - Mar 02, 2019  
SANS London March 2019 Mar 11 - Mar 16, 2019  
SANS Munich March 2019 Mar 18 - Mar 23, 2019  
SANS SEC504 Paris March 2019 (in French) Mar 18 - Mar 23, 2019  
SANS Jeddah March 2019 Mar 23 - Mar 28, 2019  
SANS Madrid March 2019 Mar 25 - Mar 30, 2019  
SANS Cyber Security Middle East Summit Apr 04 - Apr 11, 2019  
SANS London April 2019 Apr 08 - Apr 13, 2019  
SANS Riyadh April 2019 Apr 13 - Apr 18, 2019  
SANS FOR585 Madrid April 2019 (in Spanish) Apr 22 - Apr 27, 2019  
SANS Muscat April 2019 Apr 27 - May 02, 2019  
SANS Stockholm May 2019 May 13 - May 18, 2019  
SANS Milan May 2019 May 13 - May 18, 2019  
SANS Dublin May 2019 May 13 - May 18, 2019  
SANS Amsterdam May 2019 May 20 - May 25, 2019  
SANS Krakow May 2019 May 27 - Jun 01, 2019  
SANS London June 2019 Jun 03 - Jun 08, 2019  
SANS Zurich June 2019 Jun 03 - Jun 08, 2019  
SANS Paris July 2019 Jul 01 - Jul 06, 2019  
SANS Munich July 2019 Jul 01 - Jul 06, 2019  
SANS London July 2019 Jul 08 - Jul 13, 2019  
SANS Pen Test Hackfest Europe 2019 Jul 22 - Jul 28, 2019  
SANS Prague August 2019 Aug 12 - Aug 17, 2019  
SANS Amsterdam August 2019 Aug 19 - Aug 24, 2019  
SANS Copenhagen August 2019 Aug 26 - Aug 31, 2019  
SANS Brussels September 2019 Sep 02 - Sep 07, 2019  
SANS Paris September 2019 Sep 16 - Sep 21, 2019  
SANS Rome September 2019 Sep 16 - Sep 21, 2019  
SANS London September 2019 Sep 23 - Sep 28, 2019  
Online Training: SANS OnDemand
Event Dates Register
OnDemand - Various Courses Anytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice