Online Training Special: Get a GIAC Certification Attempt Included or $350 Off through 5/29!

DFIR Challenge Coin - A Badge Of Honour

Learn the story behind SANS' DFIR Challenge Coin and discover how to secure your own.

SANS Lethal Forensicator Coin is awarded to Digital Forensic and Incident Response students who demonstrate remarkable skill, or contribute a great deal to the forensics community.

The Coins are beautifully designed, tough to earn and highly prized by those who carry them.

DFIR Coins

History Of SANS DFIR Coin

SANS DFIR Coin is officially named the Lethal Forensicator Coin. The Coin was created by Rob Lee - the curriculum lead and primary author of SANS' Digital Forensics Incident Response family of courses.

Along with other accolades, Rob founded the Information Warfare Squadron - the first US military unit focussed on information warfare.

The term Forensicator was itself created on 1st April 2007, during a security podcast created by two SANS Instructors - Ovie Carroll and Brett Padres. The two talked about a new forensics tool called Forensicator Pro, a piece of software that promised to completely automate the process of creating a forensic report. Forensicator Pro was, of course, an April Fools' prank.

Though originally a joke, the term stuck and took on a life of its own. A Forensicator became a byword for people who conduct forensic examinations.

Words change, language grows and, Lethal Forensicators evolved to become a term for people who can detect and eradicate the most advanced threats.

What Does SANS DFIR Coin Signify?

The Forensicator Coin is a symbol of belonging. It signifies being part of an elite group and is a badge of honour. It demotes that the holder possess the finest DFIR skills. The Coins show the holder's commitment to lifelong learning and professional improvement.

How Can I Earn A DFIR Forensicator Coin?

There several ways in which a student can earn a Forensicator Coin:

  • Scoring first place in a SANS Training Challenge that demands forensic talent (these sessions include those held during DFIR courses FOR500, FOR508, FOR558, and FOR563).
  • At the Instructor's discretion during a Training Event.
  • Write a GIAC gold paper that forwards the digital forensic field.
  • Contribute six published pieces to the SANS Digital Forensics blog.
  • Speak at a SANS Digital Forensics Summit (this does not apply to vendor talks).
  • Nomination by another SANS Coin holder.

Groups can be eligible to receive a DFIR Coin too. To be considered, the group must help further the field of digital forensics. This can mean contributing research, knowledge, and capabilities to the wider forensic community.

SANS provide Private Training to groups of 25 or more students. To explore this training option email emea@sans.org or read our Testimonials for more information.

Please contact dfir-coins@sans.org with any questions relating to DFIR Coins.


Training Events Offering DFIR Courses
Event Dates Register
SANS Amsterdam May 2019 May 20 - May 25, 2019  
SANS Krakow May 2019 May 27 - Jun 01, 2019  
SANS London June 2019 Jun 03 - Jun 08, 2019  
SANS Zurich June 2019 Jun 03 - Jun 08, 2019  
SANS Paris July 2019 Jul 01 - Jul 06, 2019  
SANS Munich July 2019 Jul 01 - Jul 06, 2019  
SANS London July 2019 Jul 08 - Jul 13, 2019  
SANS Pen Test Hackfest Europe 2019 Jul 22 - Jul 28, 2019  
SANS London August 2019 Aug 05 - Aug 10, 2019  
SANS Prague August 2019 Aug 12 - Aug 17, 2019  
SANS Amsterdam August 2019 Aug 19 - Aug 24, 2019  
SANS Copenhagen August 2019 Aug 26 - Aug 31, 2019  
SANS Munich September 2019 Sep 02 - Sep 07, 2019  
SANS Brussels September 2019 Sep 02 - Sep 07, 2019  
SANS Paris September 2019 Sep 16 - Sep 21, 2019  
SANS Rome September 2019 Sep 16 - Sep 21, 2019  
SANS Bahrain September 2019 Sep 21 - Sep 26, 2019  
SANS London September 2019 Sep 23 - Sep 28, 2019  
SANS Kuwait September 2019 Sep 28 - Oct 03, 2019  
SANS DFIR Prague 2019 Sep 30 - Oct 06, 2019  
SANS Cardiff September 2019 Sep 30 - Oct 05, 2019  
SANS Lisbon October 2019 Oct 07 - Oct 12, 2019  
SANS Doha October 2019 Oct 12 - Oct 17, 2019  
SANS London October 2019 Oct 14 - Oct 19, 2019  
SANS SEC504 Madrid October 2019 (in Spanish) Oct 14 - Oct 19, 2019  
SANS Amsterdam October 2019 Oct 28 - Nov 02, 2019  
SANS Paris November 2019 Nov 04 - Nov 09, 2019  
SANS London November 2019 Nov 11 - Nov 16, 2019  
SANS Gulf Region 2019 Nov 16 - Nov 28, 2019  
SANS Munich November 2019 Nov 18 - Nov 23, 2019  
SANS Paris December 2019 Dec 02 - Dec 07, 2019  
SANS Frankfurt December 2019 Dec 09 - Dec 14, 2019  
Online Training: SANS OnDemand
Event Dates Register
OnDemand - Various Courses Anytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice