Final Days to get an iPad Mini 4, a Galaxy Tab A, or Take $250 Off with Online Training - Register by 9/27!

Digital Forensics Security Training Events

A SANS DFIR Training Event is a training session led by a skilled and respected SANS Instructor. Our hands on Events are held in major cities around the world and focus on cyber criminals' latest tactics and methods.

Train with a SANS Instructor to pass your DFIR GIAC exam.

Hands On Learning

SANS' DFIR Curriculum is designed to teach the tools, techniques and exploits hackers are using right now to break into systems. We teach how to forensically analyse these attacks and compose an advanced stead fast response.

SANS Digital Forensics and Incident Response Training features hands on lab exercises. Courses cover areas from the forensic analysis of Windows, Mac, networks, smartphones and system memory.

See our full DFIR Course list at the end of this page.

In a SANS Training Event students conduct forensic examinations on live systems and live data. Our focus is on teaching ethical forensic techniques, performing work safely and in a way that produces evidence that could be presented in court.

Expect to investigate the command prompt, mastering industry's leading applications and prying open files.

DFIR Courses Built to be Remembered

Some Courses at Training Events use War Games as a teaching method. Here, Instructors build test systems, networks and applications, hide strongly encrypted prizes in them and challenge teams to crack the specially designed missions.

At the heart of our practical learning is a belief that it's not just tools that make a successful DFIR practitioner. Rather, successful analysts need knowledge, experience and practice.


Students who attend a DFIR Course are provided with a wide selection of courseware. This includes a selection of expertly written textbooks. The books have been designed to follow the same structure as classroom sessions they support.

Several DFIR Courses integrate the SANS Investigative Forensic Toolkit (SIFT) into lab exercises. SANS provides students with a copy of the toolset and, any others that are utilised in class.

Students receive builds of the lab exercises. These are generally designed to run virtually. SANS provides copies of the virtual machines - either on optical media or USB.

Forensics Courses that require work on hard disks sometimes call on the CRU WiebeTech UltraDock v5 - a hard disk analysis and duplication tool. If a course features one, we'll ensure students take one back to their office.

Along with supporting students while they're with us, SANS Courseware is designed so that students can deploy the tools and techniques learned as soon as they get back to their team. See a sample of our free DFIR security support materials on our Resources page.

For a team of 25 or more who would like to take SANS Training, explore our Private Training options.


SANS DFIR Training Events are held in venues across the EMEA region and all over the world. Attend a Training Event and be in with a chance to win a SANS Lethal Forensicator Coin.


SANS is a global business and hosts events across the world. Our events attract professionals from different industries and technical professions.

During Training Events, SANS often hosts social evenings. These are informal sessions where students can chat with each other and their Instructors.

DFIR Security Certification

Global Information Assurance Certification (GIAC) validates the skills of DFIR professionals. By achieving a GIAC Certification, professionals prove that their Forensic and Response skills are of the highest quality.

Many SANS courses are aligned with GIAC Certifications. To read what pervious students say about their experiences, visit our Testimonials page.

The DFIR GIAC exams available to study for are:

For any questions about training read our FAQs or email

Training Events Offering DFIR Courses
Event Dates Register
SANS Copenhagen 2017 Sep 25 - Sep 30, 2017  
SANS London September 2017 Sep 25 - Sep 30, 2017  
SANS SEC504 at Cyber Security Week 2017 Sep 25 - Sep 30, 2017  
SANS DFIR Prague Summit & Training 2017 Oct 02 - Oct 08, 2017  
SANS Brussels Autumn 2017 Oct 16 - Oct 21, 2017  
SANS Berlin 2017 Oct 23 - Oct 28, 2017  
SANS Gulf Region 2017 Nov 04 - Nov 16, 2017  
SANS Amsterdam 2017 Nov 06 - Nov 11, 2017  
SANS Milan November 2017 Nov 06 - Nov 11, 2017  
SANS Paris November 2017 Nov 13 - Nov 18, 2017  
SANS London November 2017 Nov 27 - Dec 02, 2017  
SANS Munich December 2017 Dec 04 - Dec 09, 2017  
SANS Frankfurt 2017 Dec 11 - Dec 16, 2017  
SANS Amsterdam January 2018 Jan 15 - Jan 20, 2018  
SANS London February 2018 Feb 05 - Feb 10, 2018  
SANS Oslo 2018 Feb 05 - Feb 10, 2018  
Online Training: SANS OnDemand
Event Dates Register
OnDemand - Various Courses Anytime  
Private Training
Event Dates Register
Private Training Course of Your Choice Your Choice