Choose from Eight InfoSec Courses at SANS Las Vegas 2018. Save $200 thru 12/27.

Digital Forensics Security Training Events

A SANS DFIR Training Event is a training session led by a skilled and respected SANS Instructor. Our hands on Events are held in major cities around the world and focus on cyber criminals' latest tactics and methods.

Train with a SANS Instructor to pass your DFIR GIAC exam.

Hands On Learning

SANS' DFIR Curriculum is designed to teach the tools, techniques and exploits hackers are using right now to break into systems. We teach how to forensically analyse these attacks and compose an advanced stead fast response.

SANS Digital Forensics and Incident Response Training features hands on lab exercises. Courses cover areas from the forensic analysis of Windows, Mac, networks, smartphones and system memory.

See our full DFIR Course list at the end of this page.

In a SANS Training Event students conduct forensic examinations on live systems and live data. Our focus is on teaching ethical forensic techniques, performing work safely and in a way that produces evidence that could be presented in court.

Expect to investigate the command prompt, mastering industry's leading applications and prying open files.

DFIR Courses Built to be Remembered

Some Courses at Training Events use War Games as a teaching method. Here, Instructors build test systems, networks and applications, hide strongly encrypted prizes in them and challenge teams to crack the specially designed missions.

At the heart of our practical learning is a belief that it's not just tools that make a successful DFIR practitioner. Rather, successful analysts need knowledge, experience and practice.


Students who attend a DFIR Course are provided with a wide selection of courseware. This includes a selection of expertly written textbooks. The books have been designed to follow the same structure as classroom sessions they support.

Several DFIR Courses integrate the SANS Investigative Forensic Toolkit (SIFT) into lab exercises. SANS provides students with a copy of the toolset and, any others that are utilised in class.

Students receive builds of the lab exercises. These are generally designed to run virtually. SANS provides copies of the virtual machines - either on optical media or USB.

Forensics Courses that require work on hard disks sometimes call on the CRU WiebeTech UltraDock v5 - a hard disk analysis and duplication tool. If a course features one, we'll ensure students take one back to their office.

Along with supporting students while they're with us, SANS Courseware is designed so that students can deploy the tools and techniques learned as soon as they get back to their team. See a sample of our free DFIR security support materials on our Resources page.

For a team of 25 or more who would like to take SANS Training, explore our Private Training options.


SANS DFIR Training Events are held in venues across the EMEA region and all over the world. Attend a Training Event and be in with a chance to win a SANS Lethal Forensicator Coin.


SANS is a global business and hosts events across the world. Our events attract professionals from different industries and technical professions.

During Training Events, SANS often hosts social evenings. These are informal sessions where students can chat with each other and their Instructors.

DFIR Security Certification

Global Information Assurance Certification (GIAC) validates the skills of DFIR professionals. By achieving a GIAC Certification, professionals prove that their Forensic and Response skills are of the highest quality.

Many SANS courses are aligned with GIAC Certifications. To read what pervious students say about their experiences, visit our Testimonials page.

The DFIR GIAC exams available to study for are:

For any questions about training read our FAQs or email

Training Events Offering DFIR Courses
Event Dates Register
SANS Amsterdam January 2018 Jan 15 - Jan 20, 2018  
SANS Dubai 2018 Jan 27 - Feb 01, 2018  
SANS London February 2018 Feb 05 - Feb 10, 2018  
SANS Brussels February 2018 Feb 19 - Feb 24, 2018  
SANS London March 2018 Mar 05 - Mar 10, 2018  
SANS Paris March 2018 Mar 12 - Mar 17, 2018  
SANS Munich March 2018 Mar 19 - Mar 24, 2018  
SANS Abu Dhabi 2018 Apr 07 - Apr 12, 2018  
SANS Zurich 2018 Apr 16 - Apr 21, 2018  
SANS London April 2018 Apr 16 - Apr 21, 2018  
SANS Riyadh April 2018 Apr 28 - May 03, 2018  
SANS Amsterdam May 2018 May 28 - Jun 02, 2018  
SANS London June 2018 Jun 04 - Jun 09, 2018  
SANS Paris June 2018 Jun 25 - Jun 30, 2018  
Online Training: SANS OnDemand
Event Dates Register
OnDemand - Various Courses Anytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice