Enterprise Cloud Forensics and Incident Response, Re: SANS FOR509 OnDemand Experience Derek completed the SANS FOR509 4-day course. He liked it.