FAQ
Ask the obvious questions.
What is free, what is included, and what this training does not promise.
- Why train as a forensic examiner?
- Incidents cross disk, memory, logs, cloud and devices. When nobody can read all of it, the story gets told by whoever guesses first. A forensic examiner preserves the evidence, reads each artifact for what it actually shows, correlates sources on one clock and explains the finding plainly. DFIR.com is designed to help practitioners build that capability by hand, on SIFT.
- Is DFIR.com open yet?
- Not yet. First modules arrive December 14, 2026. Enrollment opens with the first modules. Other tracks follow as their modules are released. Release details will identify which modules are free or paid. Lessons and community will run on Skool so the training reaches you without waiting for custom software.
- What can I try for free?
- SIFT is free. Module 00 in each track and community access are free as modules release.
- Is the content written by AI?
- A named practitioner owns the outline, judgment, lab verification and sign-off. AI may help create lecture material, labs or assessment items. The provenance record identifies those contributions, the model and version, and what the practitioner checked by hand.
- How long is a module?
- Each released module states its expected time and setup requirements before you start. No completion times have been measured yet.
- Where do labs run?
- Labs run on SIFT, on your own host. Each released module states its setup requirements and any costs. Follow the SIFT installation guide before starting a lab.
- How do I verify what I install?
- Get Cast from its official GitHub release and verify the installer against that release's checksum and signature material. Follow the SIFT verification guide. DFIR.com publishes no image at this time.
- Will I receive course completion documentation?
- We plan to provide DFIR.com course completion documentation.
- Can I cancel?
- Billing, renewals, cancellation and refunds run through Skool under Skool's terms. Cancel any time from your Skool account; access continues to the end of the paid period.
- Where do I enroll?
- Enrollment opens with the first modules. Launch updates will tell you when.
- Who writes the modules?
- Practitioners who still do the work. Each module names its author.
- Can my team buy seats?
- Yes. Seat plans for 5, 10 and 25 people are priced on request. Completion reporting is planned.
- What will you publish about results?
- There are no cohort results yet. When cohorts exist, we will report measured learning outcomes with sample size, date range and collection method, including unfavorable results.
- How is this different from sicurity.ai?
- Same operator, same publication standard, different field. sicurity.ai trains AI/ML security engineers. DFIR.com teaches forensic examination and incident response.
Keep your judgment. Build your skills.
The examiner's work
starts with the evidence.
Last reviewed