Two Days Left to Get a GIAC Certification Attempt Included with SANS Online Training!

Digital Forensics Security Training Events

A SANS DFIR Training Event is a training session led by a skilled and respected SANS Instructor. Our hands on Events are held in major cities around the world and focus on cyber criminals' latest tactics and methods.

Train with a SANS Instructor to pass your DFIR GIAC exam.

Hands On Learning

SANS' DFIR Curriculum is designed to teach the tools, techniques and exploits hackers are using right now to break into systems. We teach how to forensically analyse these attacks and compose an advanced stead fast response.

SANS Digital Forensics and Incident Response Training features hands on lab exercises. Courses cover areas from the forensic analysis of Windows, Mac, networks, smartphones and system memory.

See our full DFIR Course list at the end of this page.

In a SANS Training Event students conduct forensic examinations on live systems and live data. Our focus is on teaching ethical forensic techniques, performing work safely and in a way that produces evidence that could be presented in court.

Expect to investigate the command prompt, mastering industry's leading applications and prying open files.

DFIR Courses Built to be Remembered

Some Courses at Training Events use War Games as a teaching method. Here, Instructors build test systems, networks and applications, hide strongly encrypted prizes in them and challenge teams to crack the specially designed missions.

At the heart of our practical learning is a belief that it's not just tools that make a successful DFIR practitioner. Rather, successful analysts need knowledge, experience and practice.


Students who attend a DFIR Course are provided with a wide selection of courseware. This includes a selection of expertly written textbooks. The books have been designed to follow the same structure as classroom sessions they support.

Several DFIR Courses integrate the SANS Investigative Forensic Toolkit (SIFT) into lab exercises. SANS provides students with a copy of the toolset and, any others that are utilised in class.

Students receive builds of the lab exercises. These are generally designed to run virtually. SANS provides copies of the virtual machines - either on optical media or USB.

Forensics Courses that require work on hard disks sometimes call on the CRU WiebeTech UltraDock v5 - a hard disk analysis and duplication tool. If a course features one, we'll ensure students take one back to their office.

Along with supporting students while they're with us, SANS Courseware is designed so that students can deploy the tools and techniques learned as soon as they get back to their team. See a sample of our free DFIR security support materials on our Resources page.

For a team of 25 or more who would like to take SANS Training, explore our Private Training options.


SANS DFIR Training Events are held in venues across the EMEA region and all over the world. Attend a Training Event and be in with a chance to win a SANS Lethal Forensicator Coin.


SANS is a global business and hosts events across the world. Our events attract professionals from different industries and technical professions.

During Training Events, SANS often hosts social evenings. These are informal sessions where students can chat with each other and their Instructors.

DFIR Security Certification

Global Information Assurance Certification (GIAC) validates the skills of DFIR professionals. By achieving a GIAC Certification, professionals prove that their Forensic and Response skills are of the highest quality.

Many SANS courses are aligned with GIAC Certifications. To read what pervious students say about their experiences, visit our Testimonials page.

The DFIR GIAC exams available to study for are:

For any questions about training read our FAQs or email

Training Events Offering DFIR Courses
Event Dates Register
SANS London March 2018 Mar 05 - Mar 10, 2018  
SANS Paris March 2018 Mar 12 - Mar 17, 2018  
SANS Munich March 2018 Mar 19 - Mar 24, 2018  
SANS Abu Dhabi 2018 Apr 07 - Apr 12, 2018  
SANS Zurich 2018 Apr 16 - Apr 21, 2018  
SANS London April 2018 Apr 16 - Apr 21, 2018  
SANS Riyadh April 2018 Apr 28 - May 03, 2018  
SANS Doha 2018 Apr 28 - May 03, 2018  
SANS Amsterdam May 2018 May 28 - Jun 02, 2018  
SANS London June 2018 Jun 04 - Jun 12, 2018  
SANS Milan June 2018 Jun 11 - Jun 16, 2018  
SANS Oslo June 2018 Jun 18 - Jun 23, 2018  
SANS Paris June 2018 Jun 25 - Jun 30, 2018  
SANS London July 2018 Jul 02 - Jul 07, 2018  
SANS Pen Test Berlin 2018 Jul 23 - Jul 28, 2018  
SANS Krakow 2018 Aug 20 - Aug 25, 2018  
SANS Amsterdam September 2018 Sep 03 - Sep 08, 2018  
SANS Munich September 2018 Sep 16 - Sep 22, 2018  
SANS London September 2018 Sep 17 - Sep 22, 2018  
Online Training: SANS OnDemand
Event Dates Register
OnDemand - Various Courses Anytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice