New iPad Pro, Microsoft Surface Pro or $550 Off with SANS OnDemand or vLive - ends July 12!

Take SANS DFIR Training Courses Online

Access SANS' world-class, hands-on and expert-led DFIR training with complete flexibility Online.

There are many routes to taking SANS DFIR Training. One of the most flexible is OnDemand, our Online programme that lets students take a SANS Digital Forensics Course online. Students can access training from a laptop, tablet or mobile at convenient times.

DFIR Online Training Benefits

SANS is the world's largest provider of cyber security training. Our heritage and success are partly routed in the quality and expertise of our Instructors and our 25 years within the cyber security industry.

SANS DFIR Instructors work for police departments, in academia, military bodies and for global corporations. In these organisations they hold prominent Forensics and Incident Response roles.

OnDemand gives students access to our expert Instructors through an extensive library of pre-recorded MP3 audio lectures.

SANS Online Training equips students with expertly written textbooks to support hands on online learning. Courseware textbooks are created by the same security experts who create the SANS DFIR courses.

Students can expect many lab exercises incorporated into our Online courses. These exercises are designed to help students build hands-on skills using key Forensic tools. The exercises and tools being explored are incorporated into a virtualised environment.

We'll supply the necessary VMs - either on optical media or USB flash storage.

Posters and cheat sheets that help distil complex concepts and processes into quickly digestible formats are shared with students.

Some Forensic courses - like FOR500: Windows Forensic Analysis - focus on working with hard disks. This course explores, in part, how to use a Wiebetech Forensic Ultradock v5 Write Blocker Kit to perform analyses.

OnDemand Students who study this course will receive the write block and the necessary cabling.

Flexible Training

Students can study at their own pace and in their own time.

OnDemand's inherent flexibility and self-directed nature means students can spend more time on lessons they find tough. All our courses feature quizzes at the end of each unit. These ensure students have mastered a topic before moving on to the next one.

Complete Consistency

Along with OnDemand, SANS offers many different training options. These include classroom-like Training Events (where students are given the chance to win a SANS Lethal Forensicator Coin) and Private Training.

SANS invests in ensuring that training is completely consistent across all delivery methods.

Whichever route is followed, students receive the same quality of instruction, the same technical depth, and the same focus on developing hands-on skills.

DFIR Security Certification

GIAC Certification validates the hands on skills of cyber security practitioners.

GIAC Certifications are recognised globally. Defence, governmental, private and public businesses all trust GIAC to ensure their cyber defenders' skills are on the cutting edge.

GIAC offers 6 Digital Forensic and Incident Response Certifications. These are:

Read what students have to say about our DFIR training on our Testimonials page or read our FAQs for any training queries. Alternatively, select a course below to book an Online Training course.


DFIR Curriculum
Course Certification Register
Level 1 SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling GCIH  
FOR500: Windows Forensic Analysis GCFE  
MGT535: Incident Response Team Management  
Level 2 FOR508: Advanced Digital Forensics, Incident Response, and Threat Hunting GCFA  
FOR518: Mac Forensic Analysis  
FOR572: Advanced Network Forensics and Analysis GNFA  
FOR578: Cyber Threat Intelligence  
FOR585: Advanced Smartphone Forensics GASF  
Level 3 FOR526: Memory Forensics In-Depth  
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques GREM