SANS Technology Institute

What you'll study

The curriculum is four advanced graduate courses (12 credits): three required core courses (9 credits) plus one 3‑credit elective. Core courses focus on practical evidence acquisition and analysis across platforms.

• Required core courses (9 credits): ISE 6498 Battlefield Forensics & Data Acquisition (FOR498 + GBFA); ISE 6500 Windows Forensic Analysis (FOR500 + GCFE); ISE 6585 Advanced Smartphone Forensics (FOR585 + GASF).
• Elective (3 credits): choose one. Options include digital forensics specializations such as ISE 6497 Practical OSINT (SEC497 + GOSI), ISE 6508 Advanced Incident Response, Threat Hunting, and Digital Forensics (FOR508 + GCFA), ISE 6518 Mac and iOS Forensic Analysis and Incident Response (FOR518 + GIME), ISE 6572 Advanced Network Forensics (FOR572 + GNFA), ISE 6587 Advanced OSINT Gathering & Analysis (SEC587 + GSOA), ISE 7610 Reverse‑Engineering Malware (FOR610 + GREM); or incident‑response focused electives such as ISE 6509 Enterprise Cloud Forensics and Incident Response (FOR509 + GCFR), ISE 6577 Linux Incident Response & Threat Hunting (FOR577 + GLIR), ISE 6578 Cyber Threat Intelligence (FOR578 + GCTI), and ISE 6608 Enterprise‑Class Incident Response & Threat Hunting (FOR608 + GEIR).

Skills emphasised include forensic evidence acquisition and preservation; disk, memory and artifact analysis; timeline reconstruction and attribution; and forensic reporting and expert communication. Instruction is lab‑heavy and aligned with GIAC certification objectives.

Entry requirements

Admission requires professional experience and a current information‑security or related role. Applicants may apply any month; apply by the 15th to follow the stated decision timeline. Specific transcript or degree prerequisites are not detailed on the provided source text.

Career prospects

Graduates gain practical DFIR (digital forensics and incident response) skills applicable to roles in incident response teams, forensic analyst positions supporting investigations, threat‑hunting roles, and law‑enforcement or contractor assignments that require platform‑specific forensic expertise (Windows, mobile, network, cloud, or macOS/iOS depending on electives chosen).

Scholarships & funding angle

The program lists a total program cost of $22,800 USD and notes SANS.edu academic pricing for SANS courses and GIAC certifications. It supports DoD 8140 workforce readiness; VA benefits approval is pending. The curriculum also builds toward multiple GIAC certifications, which can be a valuable, employer‑recognized credentialing pathway.