Last Day to Save $400 on 4-6 Day Courses at SANS Security West 2018 in San Diego!

DFIR Challenge Coin - A Badge Of Honour

Learn the story behind SANS' DFIR Challenge Coin and discover how to secure your own.

SANS Lethal Forensicator Coin is awarded to Digital Forensic and Incident Response students who demonstrate remarkable skill, or contribute a great deal to the forensics community.

The Coins are beautifully designed, tough to earn and highly prized by those who carry them.

DFIR Coins

History Of SANS DFIR Coin

SANS DFIR Coin is officially named the Lethal Forensicator Coin. The Coin was created by Rob Lee - the curriculum lead and primary author of SANS' Digital Forensics Incident Response family of courses.

Along with other accolades, Rob founded the Information Warfare Squadron - the first US military unit focussed on information warfare.

The term Forensicator was itself created on 1st April 2007, during a security podcast created by two SANS Instructors - Ovie Carroll and Brett Padres. The two talked about a new forensics tool called Forensicator Pro, a piece of software that promised to completely automate the process of creating a forensic report. Forensicator Pro was, of course, an April Fools' prank.

Though originally a joke, the term stuck and took on a life of its own. A Forensicator became a byword for people who conduct forensic examinations.

Words change, language grows and, Lethal Forensicators evolved to become a term for people who can detect and eradicate the most advanced threats.

What Does SANS DFIR Coin Signify?

The Forensicator Coin is a symbol of belonging. It signifies being part of an elite group and is a badge of honour. It demotes that the holder possess the finest DFIR skills. The Coins show the holder's commitment to lifelong learning and professional improvement.

How Can I Earn A DFIR Forensicator Coin?

There several ways in which a student can earn a Forensicator Coin:

  • Scoring first place in a SANS Training Challenge that demands forensic talent (these sessions include those held during DFIR courses FOR500, FOR508, FOR558, and FOR563).
  • At the Instructor's discretion during a Training Event.
  • Write a GIAC gold paper that forwards the digital forensic field.
  • Contribute six published pieces to the SANS Digital Forensics blog.
  • Speak at a SANS Digital Forensics Summit (this does not apply to vendor talks).
  • Nomination by another SANS Coin holder.

Groups can be eligible to receive a DFIR Coin too. To be considered, the group must help further the field of digital forensics. This can mean contributing research, knowledge, and capabilities to the wider forensic community.

SANS provide Private Training to groups of 25 or more students. To explore this training option email or read our Testimonials for more information.

Please contact with any questions relating to DFIR Coins.

Training Events Offering DFIR Courses
Event Dates Register
SANS Abu Dhabi 2018 Apr 07 - Apr 12, 2018  
SANS Zurich 2018 Apr 16 - Apr 21, 2018  
SANS London April 2018 Apr 16 - Apr 21, 2018  
SANS Riyadh April 2018 Apr 28 - May 03, 2018  
SANS Amsterdam May 2018 May 28 - Jun 02, 2018  
SANS London June 2018 Jun 04 - Jun 12, 2018  
SANS Milan June 2018 Jun 11 - Jun 16, 2018  
SANS Oslo June 2018 Jun 18 - Jun 23, 2018  
SANS Paris June 2018 Jun 25 - Jun 30, 2018  
SANS London July 2018 Jul 02 - Jul 07, 2018  
SANS Pen Test Berlin 2018 Jul 23 - Jul 28, 2018  
SANS Krakow 2018 Aug 20 - Aug 25, 2018  
SANS Copenhagen August 2018 Aug 27 - Sep 01, 2018  
SANS Amsterdam September 2018 Sep 03 - Sep 08, 2018  
SANS Munich September 2018 Sep 16 - Sep 22, 2018  
SANS London September 2018 Sep 17 - Sep 22, 2018  
SANS DFIR Prague Summit & Training 2018 Oct 01 - Oct 07, 2018  
SANS London October 2018 Oct 15 - Oct 20, 2018  
SANS Gulf Region 2018 Nov 03 - Nov 15, 2018  
SANS Rome 2018 Nov 12 - Nov 17, 2018  
SANS Paris November 2018 Nov 19 - Nov 24, 2018  
SANS Stockholm 2018 Nov 26 - Dec 01, 2018  
SANS Frankfurt 2018 Dec 10 - Dec 15, 2018  
Online Training: SANS OnDemand
Event Dates Register
OnDemand - Various Courses Anytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice