GIAC Advanced Smartphone Forensics Certification (GASF)

Digital Forensics Certification Overview

Validates a practitioner's aptitude performing forensic examinations on mobile phones and tablets, including file system and malware analysis.

Explore FOR585 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GASF Certification?

The GIAC Advanced Smartphone Forensics (GASF) certification validates a practitioner's aptitude performing forensic examinations on devices such as mobile phones and tablets. GASF certification holders understand mobile forensics fundamentals, device file system analysis, mobile application behavior, event artifact analysis, and mobile device malware identification.

By the numbers

2 hrs

Exam duration

Questions

69%

Min. passing score

What GASF Covers

GASF's eight exam objectives group into six practical clusters, matching FOR585's course structure, with the final cluster applying all of them together in a cumulative capstone.

Introduction to Mobile Forensics

Smartphone handling, acquisition states, and SQLite forensics fundamentals.

Android Device File System Artifacts & Android Device Application Analysis

Android file system structure, native app artifacts, and location data validation.

Apple Device File System Artifacts & Apple Device Application Analysis

iOS file system structure, native Apple app artifacts, and encryption handling.

Mobile Device Malware Analysis

Mobile malware classification, detection, isolation, and reverse-engineering.

Mobile Device Application Analysis & Mobile Device File System Artifacts

Third-party application decoding, secure messaging, and browser artifact recovery.

Cumulative application of all GASF domains

A capstone exercise applying every technique to a multi-device cold case investigation.

Prepare With This Course

FOR585: Smartphone Forensic Analysis In-Depth

Course Details

How FOR585 Prepares You for GASF

FOR585 is built around the exam objectives that make up the GASF certification:

Section 1, Smartphone Overview, Fundamentals of Analysis, and SQLite Forensics builds skills tested under GASF's Introduction to Mobile Forensics objective.
Section 2, Android Forensics builds skills tested under GASF's Android Device File System Artifacts and Android Device Application Analysis objectives.
Section 3, iOS Device Forensics builds skills tested under GASF's Apple Device File System Artifacts and Apple Device Application Analysis objectives.
Section 4, AI Impact on Mobile Forensics, Malware/Spyware Forensics, and Detecting Evidence Destruction builds skills tested under GASF's Mobile Device Malware Analysis objective.
Section 5, Third-Party Application Analysis builds skills tested under GASF's Mobile Device Application Analysis and Mobile Device File System Artifacts objectives.
Section 6, Smartphone Forensic Capstone Exercise applies all eight GASF objectives together in a cumulative, gamified investigation exercise.

Across all six sections, 22 hands-on labs, 2 optional bonus labs, and a capstone CTF exercise give you the chance to apply each domain's techniques to real device extractions before you sit the exam.

Read the full GASF certification overview

FOR585 Course Authors

Heather Barnhart

VP of Curriculum and Digital Forensics Expert at SANS Institute

Heather Barnhart is the VP of Curriculum at SANS Institute, where she shapes the future of all SANS courses and trainings. She is also Dean of Faculty at the SANS Technology Institute, the premier college for cybersecurity.

Learn more

Domenica (Lee) Crognale

Cybersecurity Engineer at SANS Institute

Domenica brings 20 years of mobile forensics experience supporting U.S. federal law enforcement and intelligence agencies while leading global training programs for elite investigative units including FBI and military special operations forces.

Learn more

Who Should Pursue GASF

Digital Forensic Examiners

Incident Response Teams

Law Enforcement Officers and Federal Agents

Information Security Professionals

Media Exploitation Analysts

Frequently Asked Questions

GASF proves you can perform forensic examinations on mobile phones and tablets, demonstrating understanding of mobile forensics fundamentals, file system analysis, application behavior, event artifacts, and mobile malware identification.

A single 2-hour proctored exam with 75 questions and a minimum passing score of 69%.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GASF fits digital forensic examiners, media exploitation analysts, information security professionals, incident response teams, law enforcement officers, federal agents, and detectives, and accident reconstruction investigators.

FOR585 covers all eight domains across six course sections, with 22 hands-on labs, 2 bonus labs, and a capstone CTF exercise using real device extractions.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GASF certification?

Add the GASF exam attempt when you register for FOR585.

Already trained? Register for the exam directly through GIAC.

SEC536: Adversarial AI - Penetration Testing AI Systems