Lee Whitfield

Lee Whitfield seldom accepts anything that he is told. His curious mind and love of challenging norms compels him to obtain the knowledge for himself. It is part of what makes him a great forensic investigator, and also what he hopes to share with his students.

He began his digital forensics career in 2006, when a neighbor told him about the field. Lee was hooked. Immediately, he started reviewing books, software and taking classes to build up his skills. He soon had the knowledge and skill to become a digital forensic investigator in both in the United States and United Kingdom. Today, Lee is a digital forensic consultant and analyst for his own company, 337 Forensics.

Lee has covered a wide array of situations during his time as a forensic investigator, everything from child abuse, intellectual property theft, attempted murder, and much more. One of his greatest successes was his work on reverse engineering Volume Shadow Copies, which had been a stumbling block for forensic investigators. Due to Lee's work and innovation, access and time to locate files was greatly reduced, essentially allowing a forensic investigator to view the computer's contents from days, weeks, or even months before, including old or deleted files. 

As Lee continued to build and expand his knowledge, he had the opportunity to present at the SANS Forensic Summit. The experience, as well as hearing from other knowledgeable experts, led him to understand that SANS was an organization committed to cutting-edge training and expanding the field of digital forensics. 

Now as an instructor for FOR500: Windows Forensic Analysis, Lee pushes his students to understand how important it is to "get things right," given the power of digital forensics and the impact it has on people's lives. Lee shares his own stories and experiences with his students and strives to create open discussion and the opportunity for students to find the answers for themselves. He wants every student to share his passion for finding the truth, and the drive to continue to build their skills and knowledge moving forward.  

Lee also serves as a Senior Technical Adviser for the SANS Research and Operation Center, helping in the Lab Validation process. He also hosts the Forensic 4:cast Awards event at the SANS DFIR Summit each year. In his sparse free time, Lee also produces his own popular digital forensics podcast, Forensic 4:cast. The podcast has afforded him the opportunity to discuss and investigate important issues relating to the field of digital forensics, and in each episode, he interviews a panel of guests on the latest news and issues in the field. 

Outside of digital forensics and instructing, Lee focuses his time on his wife and four children at home in Dallas, TX. He also enjoys photography and flying his drone. To top it off, Lee is a huge Marvel fan and you'll likely find him at the movie theatre on Marvel movie release nights. 

Qualifications Summary


  • EnCase Certified Examiner (EnCE)
  • GIAC Advanced Smartphone Forensics (GASF)
  • GIAC Certified Forensic Examiner (GCFE)
  • GIAC Reverse Engineering Malware (GREM)

Get to Know Lee Whitfield

Here is What Students Say About Lee Whitfield:

"Lee provides real-world experience that help to show the importance of material." - Tom Hamberger, ManTech

"I appreciate Lee sharing his real-world stories of cases he's been involved in, and how he has been able to use many of the tools discussed to aid in investigations." -  David Montoya, OIT

"Lee is an outstanding instructor!" - D. Werden, TARDEC

"What I learned in Lee's class helped me relate to my every day job and continue to build my skills." - Brian Masuoka, Ernst Young

"I've gained a lot from Lee! The best instructor I ever seen in my life. I highly recommend my colleagues take training with him." Sami, MOD

"Lee keeps the course interesting and easy to understand." Jessica Holmes, Pfizer, Inc.

"Lee is awesome! Thanks for drilling down into the weeds to answer our questions." Daniel F., KPMG

"Mr. Whitfield is a very knowledgable and congenial instructor. He makes the class enjoyable." T. Morales, Stroz Friedberg