New iPad Pro, Microsoft Surface Pro or $550 Off with SANS OnDemand or vLive - ends July 12!

DFIR Challenge Coin - A Badge Of Honour

Learn the story behind SANS' DFIR Challenge Coin and discover how to secure your own.

SANS Lethal Forensicator Coin is awarded to Digital Forensic and Incident Response students who demonstrate remarkable skill, or contribute a great deal to the forensics community.

The Coins are beautifully designed, tough to earn and highly prized by those who carry them.

DFIR Coins

History Of SANS DFIR Coin

SANS DFIR Coin is officially named the Lethal Forensicator Coin. The Coin was created by Rob Lee - the curriculum lead and primary author of SANS' Digital Forensics Incident Response family of courses.

Along with other accolades, Rob founded the Information Warfare Squadron - the first US military unit focussed on information warfare.

The term Forensicator was itself created on 1st April 2007, during a security podcast created by two SANS Instructors - Ovie Carroll and Brett Padres. The two talked about a new forensics tool called Forensicator Pro, a piece of software that promised to completely automate the process of creating a forensic report. Forensicator Pro was, of course, an April Fools' prank.

Though originally a joke, the term stuck and took on a life of its own. A Forensicator became a byword for people who conduct forensic examinations.

Words change, language grows and, Lethal Forensicators evolved to become a term for people who can detect and eradicate the most advanced threats.

What Does SANS DFIR Coin Signify?

The Forensicator Coin is a symbol of belonging. It signifies being part of an elite group and is a badge of honour. It demotes that the holder possess the finest DFIR skills. The Coins show the holder's commitment to lifelong learning and professional improvement.

How Can I Earn A DFIR Forensicator Coin?

There several ways in which a student can earn a Forensicator Coin:

  • Scoring first place in a SANS Training Challenge that demands forensic talent (these sessions include those held during DFIR courses FOR500, FOR508, FOR558, and FOR563).
  • At the Instructor's discretion during a Training Event.
  • Write a GIAC gold paper that forwards the digital forensic field.
  • Contribute six published pieces to the SANS Digital Forensics blog.
  • Speak at a SANS Digital Forensics Summit (this does not apply to vendor talks).
  • Nomination by another SANS Coin holder.

Groups can be eligible to receive a DFIR Coin too. To be considered, the group must help further the field of digital forensics. This can mean contributing research, knowledge, and capabilities to the wider forensic community.

SANS provide Private Training to groups of 25 or more students. To explore this training option email emea@sans.org or read our Testimonials for more information.

Please contact dfir-coins@sans.org with any questions relating to DFIR Coins.


Training Events Offering DFIR Courses
Event Dates Register
SANS London July 2017 Jul 03 - Jul 08, 2017  
SANS Dublin 2017 Sep 11 - Sep 16, 2017  
SANS Copenhagen 2017 Sep 25 - Sep 30, 2017  
SANS London September 2017 Sep 25 - Sep 30, 2017  
SANS SEC504 at Cyber Security Week 2017 Sep 25 - Sep 30, 2017  
SANS DFIR Summit Prague 2017 Oct 02 - Oct 08, 2017  
SANS Brussels Autumn 2017 Oct 16 - Oct 21, 2017  
SANS Berlin 2017 Oct 23 - Oct 28, 2017  
SANS Gulf Region 2017 Nov 04 - Nov 16, 2017  
SANS Amsterdam 2017 Nov 06 - Nov 11, 2017  
SANS Paris November 2017 Nov 13 - Nov 18, 2017  
SANS London November 2017 Nov 27 - Dec 02, 2017  
Online Training: SANS OnDemand
Event Dates Register
OnDemand - Various Courses Anytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice