Online Training Special: Get a GIAC Certification Attempt Included or $350 Off through 5/29!

Digital Forensics Security Training Events

A SANS DFIR Training Event is a training session led by a skilled and respected SANS Instructor. Our hands on Events are held in major cities around the world and focus on cyber criminals' latest tactics and methods.

Train with a SANS Instructor to pass your DFIR GIAC exam.

Hands On Learning

SANS' DFIR Curriculum is designed to teach the tools, techniques and exploits hackers are using right now to break into systems. We teach how to forensically analyse these attacks and compose an advanced stead fast response.

SANS Digital Forensics and Incident Response Training features hands on lab exercises. Courses cover areas from the forensic analysis of Windows, Mac, networks, smartphones and system memory.

See our full DFIR Course list at the end of this page.

In a SANS Training Event students conduct forensic examinations on live systems and live data. Our focus is on teaching ethical forensic techniques, performing work safely and in a way that produces evidence that could be presented in court.

Expect to investigate the command prompt, mastering industry's leading applications and prying open files.

DFIR Courses Built to be Remembered

Some Courses at Training Events use War Games as a teaching method. Here, Instructors build test systems, networks and applications, hide strongly encrypted prizes in them and challenge teams to crack the specially designed missions.

At the heart of our practical learning is a belief that it's not just tools that make a successful DFIR practitioner. Rather, successful analysts need knowledge, experience and practice.


Students who attend a DFIR Course are provided with a wide selection of courseware. This includes a selection of expertly written textbooks. The books have been designed to follow the same structure as classroom sessions they support.

Several DFIR Courses integrate the SANS Investigative Forensic Toolkit (SIFT) into lab exercises. SANS provides students with a copy of the toolset and, any others that are utilised in class.

Students receive builds of the lab exercises. These are generally designed to run virtually. SANS provides copies of the virtual machines - either on optical media or USB.

Forensics Courses that require work on hard disks sometimes call on the CRU WiebeTech UltraDock v5 - a hard disk analysis and duplication tool. If a course features one, we'll ensure students take one back to their office.

Along with supporting students while they're with us, SANS Courseware is designed so that students can deploy the tools and techniques learned as soon as they get back to their team. See a sample of our free DFIR security support materials on our Resources page.

For a team of 25 or more who would like to take SANS Training, explore our Private Training options.


SANS DFIR Training Events are held in venues across the EMEA region and all over the world. Attend a Training Event and be in with a chance to win a SANS Lethal Forensicator Coin.


SANS is a global business and hosts events across the world. Our events attract professionals from different industries and technical professions.

During Training Events, SANS often hosts social evenings. These are informal sessions where students can chat with each other and their Instructors.

DFIR Security Certification

Global Information Assurance Certification (GIAC) validates the skills of DFIR professionals. By achieving a GIAC Certification, professionals prove that their Forensic and Response skills are of the highest quality.

Many SANS courses are aligned with GIAC Certifications. To read what pervious students say about their experiences, visit our Testimonials page.

The DFIR GIAC exams available to study for are:

For any questions about training read our FAQs or email

Training Events Offering DFIR Courses
Event Dates Register
SANS Amsterdam May 2019 May 20 - May 25, 2019  
SANS Krakow May 2019 May 27 - Jun 01, 2019  
SANS London June 2019 Jun 03 - Jun 08, 2019  
SANS Zurich June 2019 Jun 03 - Jun 08, 2019  
SANS Paris July 2019 Jul 01 - Jul 06, 2019  
SANS Munich July 2019 Jul 01 - Jul 06, 2019  
SANS London July 2019 Jul 08 - Jul 13, 2019  
SANS Pen Test Hackfest Europe 2019 Jul 22 - Jul 28, 2019  
SANS London August 2019 Aug 05 - Aug 10, 2019  
SANS Prague August 2019 Aug 12 - Aug 17, 2019  
SANS Amsterdam August 2019 Aug 19 - Aug 24, 2019  
SANS Copenhagen August 2019 Aug 26 - Aug 31, 2019  
SANS Munich September 2019 Sep 02 - Sep 07, 2019  
SANS Brussels September 2019 Sep 02 - Sep 07, 2019  
SANS Paris September 2019 Sep 16 - Sep 21, 2019  
SANS Rome September 2019 Sep 16 - Sep 21, 2019  
SANS Bahrain September 2019 Sep 21 - Sep 26, 2019  
SANS London September 2019 Sep 23 - Sep 28, 2019  
SANS Kuwait September 2019 Sep 28 - Oct 03, 2019  
SANS DFIR Prague 2019 Sep 30 - Oct 06, 2019  
SANS Cardiff September 2019 Sep 30 - Oct 05, 2019  
SANS Lisbon October 2019 Oct 07 - Oct 12, 2019  
SANS Doha October 2019 Oct 12 - Oct 17, 2019  
SANS London October 2019 Oct 14 - Oct 19, 2019  
SANS SEC504 Madrid October 2019 (in Spanish) Oct 14 - Oct 19, 2019  
SANS Amsterdam October 2019 Oct 28 - Nov 02, 2019  
SANS Paris November 2019 Nov 04 - Nov 09, 2019  
SANS London November 2019 Nov 11 - Nov 16, 2019  
SANS Gulf Region 2019 Nov 16 - Nov 28, 2019  
SANS Munich November 2019 Nov 18 - Nov 23, 2019  
SANS Paris December 2019 Dec 02 - Dec 07, 2019  
SANS Frankfurt December 2019 Dec 09 - Dec 14, 2019  
Online Training: SANS OnDemand
Event Dates Register
OnDemand - Various Courses Anytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice