SECURITY 408SECURITY 408


Course PDF

Master computer forensics. Learn essential investigation techniques.

With today's ever-changing technologies and environments, it is inevitable that organizations will deal with some form of cybercrime. These forms include, but are not exclusive to, fraud, insider threat, industrial espionage, and phishing. In order to help solve these cases, organizations are hiring digital forensic professionals and calling cybercrime law enforcement agents to fight and solve these cyber crimes.

SANS Security 408: Computer Forensic Essentials focuses on the essentials that a forensic investigator must know to investigate core computer crime incidents successfully. You will learn how computer forensic analysts focus on collecting and analyzing data from computer systems to track user-based activity that could be used internally or in civil/criminal litigation.

This course covers the fundamental steps of the in-depth computer forensic methodology so that each student will have the complete qualifications to work as a computer forensic investigator in the field helping solve and fight crime.

This course is the first course in the SANS Computer Forensic Curriculum. If this is your first computer forensics course with SANS we recommend that you start here.

FIGHT CRIME. UNRAVEL INCIDENTS... ONE BYTE AT A TIME.

You will Receive with this Course

Free SANS Investigative Forensic Toolkit (SIFT) Essentials

As a part of this course you will receive a SANS Investigative Forensic Toolkit (SIFT) Essentials with a Tableau Write Block Acquisition Kit. The entire kit will enable each investigator to accomplish proper and secure examinations of SATA, IDE, or Solid State Drives (SSD). The toolkit consists of:

  • Tableau T35e Write Blocker Kit
    • One Tableau T35e Write Blocker (Read-Only)
    • IDE Cable/Adapters
    • SATA Cable/Adapters
    • FireWire and USB Cable Adapters
    • Forensic Notebook Adapters (IDE/SATA)
    • HELIX Incident Response & Computer Forensics Live CD
  • SANS Windows XP Forensic Analysis VMware Workstation
  • Course DVD: Loaded with case examples, tools, and documentation

SANS Computer Forensic Website - forensics.sans.org

The learning does not end when class is over. SANS Computer Forensic Website is a community-focused site offering digital forensics professionals a one-stop forensic resource to learn, discuss and share current developments in the field. It also provides information regarding SANS forensics training, GIAC certification, and upcoming events. Visit http://forensics.sans.org. New content is added regularly, so please visit often. In addition, do not forget to share this information with your fellow forensic professionals.




  • Computer Forensic Essentials Course Topics:
    • Digital Forensics Essentials
    • Windows File System Basics
    • Fundamental Forensic Methodology
    • Evidence Acquisition Tools and Techniques
    • Law Enforcement Bag and Tag
    • Evidence Integrity
    • Presentation and Reporting of Evidence and Analysis
    • Windows XP, VISTA, and WIN7 Investigation and Analysis
    • Windows In-Depth Registry Forensics
    • Tracking User Activity
    • USB Device Tracking and Analysis
    • E-mail Forensics (Host, Server, Web)
    • Microsoft Office Document Analysis
    • Windows Link File Investigation
    • Windows Recycle Bin Analysis
    • File and Picture Metadata Tracking and Examination
    • Prefect Analysis
    • Firefox and Internet Explorer Browser Forensics
    • Deleted File Recovery
    • String Searching
    • Data Carving
    • Examine cases involving both Windows XP and VISTA
  • Who Should Attend:
    • Information technology professionals who wish to learn the core concepts in computer forensics investigations
    • Incident Response Team Members who are responding to security incidents and need to utilize computer forensics to help solve their cases
    • Law enforcement officers, federal agents, or detectives who desire to become a subject matter expert on computer forensics for Windows based operating systems
    • Information security managers who need to understand digital forensics in order to understand information security implications and potential litigation related issues or manage investigative teams
    • Information technology lawyers and paralegals who desire to have a formal education in digital forensic investigations
    • Anyone interested in computer forensic investigations with a background in information systems, information security, and computers
SECURITY 408 Upcoming Events
Event Location Dates Delivery Method
SANS vLive! - Security 408 - Rob LeeSANS vLive! SEC408-200911, VANov 30, 2009 - Feb 01, 2010
SANS CDI East 2009Washington DCDec 11, 2009 - Dec 18, 2009Live Event
SANS Security East 2010New Orleans, LAJan 10, 2010 - Jan 18, 2010Live Event
SANS 2010Orlando, FLMar 06, 2010 - Mar 15, 2010Live Event
SANS Security West 2010San Diego, CAMay 07, 2010 - May 15, 2010Live Event
SANS vLive! - SEC 408 - Rob LeeSANS vLive! SEC408 - 201006, VAJun 08, 2010 - Aug 24, 2010
"This is awsome! We're seeing details that most people don't even know exist" - John Wright, Info Tech, Inc.
"The class provided in-depth, real world, hands-on information" - Robert Dale Drollinger, General Dynamics
SANS Institute