Gamble? Not with your future



By Lee Whitfield

Honestly, I’ve never been big into gambling. The closest I’ve come is buying a lottery ticket when I was 18. While I understand the excitement, the science, and compulsion, it has just never been a huge draw for me personally.

There are many things that fall into the category of gambling. You can choose to back your favorite sports team by putting your money where your mouth is. You may not have a lot of faith in your team and bet against them, and still call yourself a fan? You may attend a regular gathering of friends and play cards together.

Gambling presents an inherent risk, hence the excitement. You run the odds in your head and determine if there’s a chance you’ll win. If the right combination of probability and odds come up, you pony up and hope for the best. However, there’s always a chance that something goes wrong and you walk away with a loss instead of a win.

You may not be familiar with Steve Richards. Why would you? He’s a roofer from the UK. Richards had a penchant for sports betting and accurately predicted the correct scores for twelve different rugby games. He bet £10 at some crazy odds and walked away with £38,970. Now, roofers in the UK probably don’t make that much in a year so this was an extraordinary win for him but instead of taking that money and doing something useful, he “reinvested” by placing a £30,000 on another Rugby game one week later. He lost. A year’s wages gone in an instant.

So why am I talking about gambling? Well, it is the start of a new year. New opportunities, new goals, new budgets. The likelihood is that you have some amount of money allocated to you for training purposes in 2019 and you have a to ask yourself a question. How do you spend that money wisely and not gamble it away on less-than-stellar instruction?

As you may know, I recently started teaching for SANS. I’ve had the pleasure of teaching in Boston, London and Denver. My next class is in Reno, Nevada – the gambling state. It starts on February 25. Here I will be teaching the FOR500: Windows Forensic Analysis class. In six days you’ll learn the skills needed to conduct investigations into a variety of cases and, to top it off, you’ll put the skills to the test with the forensic challenge that I helped to create. The FOR500 class is updated throughout the year so you’ll be learning about the latest and greatest artifacts to help you become a lethal forensicator, take down the bad guys, impress your bosses, and get that raise that you deserve.

As an added bonus, I’ll also be giving a brand new @Night talk entitled “Ready, Fire, Aim.” You won’t want to miss it.

So don’t gamble away your future, make the safe bet and come join me in Reno in February. Come to the class, hang out with me, learn some stuff, and play some slots. Who knows, you might walk away with more than the best training money can buy.

More information about the SANS Reno event
Register for the class


Coin Check: Win the challenge, join the elite list of lethal forensicators & take home a brand new DFIR challenge coin!

forensics_coin (1)Hundreds of SANS Institute digital forensics students have stepped up to the challenge and conquered. They’ve mastered the concepts and skills, beat out their classmates, and proven their prowess. These are the elite, the recipients of the SANS Lethal Forensicator Coin, an award given to a select portion of the thousands of students that have taken any of the SANS Institute Digital Forensics or Incident Response (DFIR) courses. Now, the institute is expanding the opportunity for students to earn these highly coveted tokens in each of the SANS DFIR courses.

Thanks to an effort led by curriculum lead Rob Lee & the SANS DFIR faculty, students can now win specific SANS Lethal Forensicator Coins designed to go with each of the DFIR course themes. These coins are tailored to be icons and the precious prizes to be won by students as a proof and symbol of their mastery in a specific digital forensics specialty.

New DFIR course challenge coins available now:

500FOR500: Windows Forensic Analysis

“Ex Umbra in Solem”: From the Shadows into the Light
In today’s digital world, forensics plays a critical role in uncovering the truth. Forensic examiners shine light on the facts of the case, making good decisions possible. And the forces of evil unceasingly develop new ways to hide their activities, forcing us to continually improve our skills to counter them.

508FOR508: Advanced Digital Forensics, Incident Response & Threat Hunting

“Non Potestis Celare”: You  cannot hide
The most successful incident response teams are evolving rapidly due to near-daily interaction with adversaries. New tools and techniques are being developed, providing better visibility and making the network more defensible. Adversaries can no longer hide.

610FOR610: Reverse-Engineering Malware

“R.E.M”: Reverse-Engineering Master

Today,  attackers are modifying their malware with increasing frequency to bypass antivirus and other endpoint controls. Through reverse-engineering Malware (R.E.M) Analysis Masters can isolate the most appropriate Indicators of Compromise (IOCs) to stop & identify malware.

585FOR585: Advanced Smartphone Forensics

“Omnis Tactus Vestigium Relinquit”:  Every contact leaves a trace
Knowing how to recover all of the data residing on the smartphone is now an expectation in the digital forensics field, and examiners must understand the fundamentals of smartphone handling, data recovery, accessing locked devices, and manually recovering data hiding in the background on the device. There are traces of evidence hiding on the device, and you know how to uncover them.

572FOR572: Advanced Network Forensics Analysis

“Malum Loquitur, Bonum Auscultat”: Evil must talk, so good must listen

Network Forensic professionals are hunters with great visibility, who can find a target among a mass of camouflaging data. Wisdom, experience, and stealth are all embodied by the owl’s watchful, unwavering eye, seeking its prey under the cover of darkness. No matter how crafty an adversary may be, their communications will allow the hunter to find, identify, and ultimately eliminate their presence.

518FOR518: Mac Forensics

“Impera magis. Aliter cogita”: Command more and think differently.

Apple users have always thought differently and that goes for Apple forensicators too. The analysts who hold this coin take command of their forensic analysis and appreciate looking at the raw data and interpreting it correctly without the necessity of superfluous tools. Knowing where you came from can help you move forward, this is where the hat tip to the original colored Apple logo comes in. New artifacts are presented to analysts in every OS update, the knowledge of historic elements may provide insight.

FOR578_coinFOR578: Cyber Threat Intelligence

“Hominem unius libri timeo”: I fear the man of one book.

FOR578 is all about developing analytical skills. To think critically and expand our views which is a skill that applies to any security profession. The quote is attributed to Thomas Aquinas and despite the common use of the phrase (which is meant to deride the person who is not well studied across multiple subjects) the original meaning was to state that a person who understood one good book well could defeat their opponent. Thus, this phrase can be interpreted two entirely different ways. Both are about self-education and broadening our views on the world.

FOR526_coinFOR526: Memory Forensics In-Depth

“Cur mihi oculi dolent?” Why do my eyes hurt?

Memory forensics reveals deeper insights into the state of a compromised system and stands as the best source for detection of malware and OS/process manipulation/subversion. These analysis methods reveal key evidence which may not be uncovered through querying the operating system or digging through network packets. This quote comes from the original Matrix movie, a question Neo asks of Morpheus when he first wakes from his life in the artificial reality created by sentient machines. It is this awakening and raw view of reality that we as forensic examiners/incident responders strive to achieve through deeper analysis of system memory.


Netwars DFIR Netwars

Staying up-to-date with the latest challenges in the digital forensics field demand analytical skills that cannot be gained by just reading a textbook. Just like firemen could never learn the skills of how to fight a fire by just studying theory, incident responders, threat hunters, and digital forensic investigators can test their skills with DFIR Netwars.

New DFIR Challenge coin back design:

BackThe challenges for each course are held on the last day. Students must successfully overcome a number of obstacles, directly compete against fellow students, and prove their proficiency during timed, hands-on incidents. The obstacles, competitions and hands-on scenarios have been created by SANS’ top instructors – digital forensics practitioners, subject matter experts, experienced teachers and professional leaders in their own right. At the end of the challenge, the instructor announces the winner(s) who are awarded the coins at the end of the 6th day of class and winners are later on listed on the SANS Institute’s virtual wall of Lethal Forensicator Coin Holders.


History of the SANS Challenge coins:

The coin – more precisely, Round Metal Object (RMO) – was initially created to recognize students who demonstrate exceptional talent, contributions, or who serve as leaders in the digital forensics profession and community. The coin is meant to be an honor; it is also intended to be rare. SANS Institute uses the coins to identify and honor those who excel at detecting and eradicating threats, understand the critical importance of cybersecurity and continually strive to further not only their knowledge but also the knowledge of the entire digital forensics field. They actively share their experience and encourage learning through participation in the community and are typically leaders in the digital forensics and incident response community.

Those who are awarded the Lethal Forensicator are also bestowed special privileges and recognition, including participation in the so-called and well-regarded “coin check” challenge and response.

“Coin check” Challenge:

Initiated by one coin holder to another, a coin check typically begins by a challenger holding his or her coin in the air or slamming it on a table and yelling “coin check!” All who are challenged must respond by showing their coins to the challenger within 10 seconds, and whoever fails to do so must buy everyone a round of drinks. If all the challenged coin holders do produce their coin, the challenger must by the round of drinks. (By the way, if you accidentally drop your coin and it makes an audible sound on impact, then you’ve “accidentally” initiated a coin check. And, there are no exceptions to the rules!)

Coin checks aside, there are other ways to win the DFIR Challenge coins besides being an exceptional DFIR student and winning the classroom challenges. Each GOLD GCFA, GREM, GCFE member that has written a published white paper that has furthered the field of research in the Digital Forensics field receives a coin, as do SANS Digital Forensics Blog authors who have written six published entries over a one-year span. In addition, speakers and panelists who participate at a SANS Digital Forensic Summit are awarded coins (vendors and vendor-related speakers are not eligible). Finally, any coin holder can nominate an individual in the digital forensics field who has contributed knowledge, tools or service.

For more information on our SANS DFIR courses, please visit our Forensics Courses list. And to read more about the coin and the history of the term “Forensicator,” check out our Community – Lethal Forensicator Coin page.

FOR408: Windows Forensic Analysis has been renumbered to FOR500: Windows Forensics Analysis

FullSizeRender (4)


The FOR408: Windows Forensic Analysis course was renumbered to FOR500: Windows Forensic Analysis. SANS renumbered the course to better reflect the course’s intermediate-level material. The content of the course will remain basically the same, although it will be constantly updated to reflect changes in the field.



Why change the course number?
FOR500/FOR408 is an intermediate-level Windows forensics course that skips over the introductory material of digital forensics. This class does not include basic digital forensic analysis concepts. FOR500/FOR408 focuses entirely on in-depth, tool-agnostic analysis of the Windows operating system and artifacts. The course has been at the intermediate skill level since 2013 and a course number change to the 5 level reflects this content more accurately. The course is vigorously updated each year. The change in the course number was timed to coincide with the regularly scheduled update of the course in the Spring of 2017. SANS courses are updated as frequently as possible as part of our efforts to keep teaching material hyper-current and relevant for leading-edge problem solving.

What is the difference between FOR500 and FOR508?
FOR500 focuses on deep-dive forensic analysis of Windows operating systems and artifact locations. FOR508 teaches students how to conduct enterprise incident response and threat hunting. Its focus is on intrusion response and forensics. Each course complements the other and both should be taken to create a full operational and analytical capability.

Which course should I take first, FOR500 or FOR508?
It is recommended that FOR500/FOR408 be taken prior to FOR508 so that students obtain a firm understanding of operating system and artifact locations on Windows systems as well as demonstrable, hands-on skills in Windows forensics. However, FOR500 is not a formal prerequisite for FOR508, so the classes could be taken in any order.

How does the change in the course number affect GIAC certification?
Any current GCFE certifications will not change in any way. Any student taking FOR500/FOR408 will be taking the same exam. Additionally, DoDD 8570, DoDD 8140, and ANSI/ISO/IEC 17024 accreditation status remains unchanged.

How will the course number change affect alumni?
Anyone who wishes to retake the FOR500/FOR408 course using the alumni discount may do so if they have taken FOR408 in the past.

If you have any additional questions regarding this change, please email us at