**Focus:** Digital forensics, memory analysis, timeline analysis, advanced incident response - **Cost:** ~$979 (exam); ~$8,525 (with SANS FOR508) - **Difficulty:** 7/10 - **Textbook chapters:** 37 (Incident Response and Forensics) - **Best for:** Forensics specialists and incident response leads