13Cubed on-demand DFIR courses
Narrow, deep, artefact-level courses on investigating Windows endpoints, Windows memory, Linux and macOS, alongside a substantial free YouTube channel.
Type: Bootcamp & intensiveWorking practitioners
Offered by 13Cubed
The facts
- Cost
- Per course: Architecting the Hunt $295; Investigating Windows Endpoints $795; Investigating Windows Memory $795; Investigating Linux Devices $895; Investigating macOS Endpoints $895. Bundles run from $1,395 (Windows) to $2,995 (XPlat Complete). The YouTube content is free.Figure read 2026-09-12 from training.13cubed.com
- Prerequisites
- None stated, but the material assumes forensic fundamentals and comfort at a command line.
- Format
- Self-paced video with hands-on material. The site states each course includes a knowledge assessment and separate certifications; the exam mechanics and any proctoring are not detailed publicly, so treat the certification structure as unconfirmed.
- Length
- Self-paced.
- Renewal
- No renewal or recertification requirement is published for this entry.
- Accreditation
- No accreditation is claimed for this entry, and none should be inferred.
- Who it suits
- A working practitioner who wants SANS-grade artefact depth on one specific platform without a SANS-grade invoice.
- Audience
- Working practitioners
- Official page
- training.13cubed.com
Strengths
- Among the best-regarded independent DFIR training in the field, and priced at a fraction of the SANS equivalent for comparable artefact depth.
- The free YouTube channel alone is a serious learning resource — you can evaluate the teaching before paying anything.
- Deliberately narrow scope per course, so you can buy only the platform you actually work on.
- macOS and Linux coverage, which is thin almost everywhere else.
Limitations
- $795-$895 per course is real money, and it is not a subscription — a full multi-platform skill set is a four-figure commitment.
- The bundled certifications have no third-party accreditation and are not the credentials hiring filters look for.
- The exam format is not publicly documented, so you cannot tell in advance what the assessment involves.
- Self-paced video with no cohort or instructor access means no one will notice if you stall.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.