FOR308: Digital Forensics Essentials

Course Overview

This is an introductory course aimed at people from non-technical backgrounds, to give an understanding, in layman's terms, of how files are stored on a computer or smartphone. It explains what Digital Forensics and Incident Response are and the art of the possible when professionals in these fields are given possession of a device. This course is intended to be a starting point in the SANS catalogue and provide a grounding in knowledge, from which other, more in-depth, courses will expand.


  • FOR308.1: Introduction to Digital Investigation
  • FOR308.2: Digital Forensics
  • FOR308.3: Incident Response
  • FOR308.4: Digital Evidence Acquisition Essentials
  • FOR308.5: Digital Forensic Analysis
  • FOR308.6: Digital Forensics Management 


In Person (6 days) / Online - Access Period: 4 months

Course Authors

  • Kathryn Hedley, Certified Instructor Candidate
  • Phill Moore, Certified Instructor Candidate
  • Jason Jordaan, Certified Instructor

What You Will Learn

FOR308: Digital Forensics Essentials Course will prepare your team to: Effectively use digital forensics methodologies Ask the right questions in relation to digital evidence Understand how to conduct digital forensics engagements compliant with acceptable practice standards Develop and maintain a digital forensics capacity Understand incident response processes and procedures and when to call on the team Describe potential data recovery options in relation to deleted data Identify when digital forensics may be useful and understand how to escalate to an investigator If required, use the results of your digital forensics in court