GIAC Battlefield Forensics and Acquisition Certification (GBFA)

Digital Forensics Certification Overview

GBFA validates a practitioner’s readiness to collect, acquire, and rapidly triage data across a wide range of data storage.

Explore FOR498 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GBFA Certification?

The GIAC Battlefield Forensics and Acquisition (GBFA) certification validates a practitioner’s readiness to handle every facet of the data collection and rapid triage process. GBFA certification holders are qualified to properly collect, acquire, and conduct rapid triage analysis across a wide range of data storage.

By the numbers

2 hrs

Exam duration

Questions

69%

Min. passing score

What GBFA Covers

GIAC publishes 19 exam objectives for GBFA, and they group into six practical domains that follow the six sections of FOR498.

Scene and Storage Foundations

Covers Acquisition Preparation, Computer Fundamentals, Physical Storage Devices, Filesystem Fundamentals, and Working With Evidence Files.

Portable Device Acquisition

Covers Mobile Device Acquisition, Mobile Device Triage, and Dead Box Acquisition, including write blocking and media removal.

Live Response and Triage

Covers Host Based Live Acquisition, Acquiring RAM and OS Artifacts, Manual Triage, and Data on Drives.

Network and Cloud Acquisition

Covers Remote Acquisition, Storage Technologies, Windows Filesystems, and Using Forensic Tools for Triage.

Apple and IoT Devices

Covers Specialty Device Fundamentals, including macOS, and Data on the Network, including IoT traffic and PCAP files.

Manual Data Recovery

Covers Manually Finding Data, including where data can be found, carving metadata, and file recovery.

Prepare With This Course

FOR498: Digital Acquisition and Rapid Triage

Course Details

How FOR498 Prepares You for GBFA

FOR498 is built around the exam objectives that make up the GBFA certification:

Section 1, Scene Prep, Management, and Storage Interfaces builds skills tested under Acquisition Preparation, Computer Fundamentals, Physical Storage Devices, Filesystem Fundamentals, and Working With Evidence Files.
Section 2, Portable Devices and Acquisition Processes aligns with Mobile Device Acquisition, Mobile Device Triage, and Dead Box Acquisition.
Section 3, Triage and Data Acquisition maps directly to Host Based Live Acquisition, Acquiring RAM and OS Artifacts, Manual Triage, and Data on Drives.
Section 4, Non-Traditional and Cloud Acquisition builds skills tested under Remote Acquisition, Storage Technologies, Windows Filesystems, and Using Forensic Tools for Triage.
Section 5, Apple Acquisition and Internet of Things aligns with Specialty Device Fundamentals and Data on the Network.
Section 6, Beyond the Forensic Tools: The Deeper Dive builds skills tested under Manually Finding Data.

Across all six sections, 20 hands-on labs give you the chance to apply each skill in the SANS Windows DFIR Workstation environment, and FOR498: Digital Acquisition and Rapid Triage provides great training if you’re thinking of pursuing GBFA.

Read the full GBFA certification overview

FOR498 Course Authors

Kevin Ripa

President at The Grayson Group of Companies

Kevin Ripa has transformed the global cybersecurity landscape through decades of frontline digital forensics, assisting law enforcement, governments, and Fortune 500 companies in unraveling sophisticated cyberattacks and nation-state threats.

Learn more

Eric Zimmerman

Senior Vice President at Kroll Cyber Security

Eric has redefined digital forensics with open-source tools like KAPE, now global standards for cybercrime investigations. He has directly enabled faster evidence analysis, rescued exploited children, and set new benchmarks in forensic response.

Learn more

Who Should Pursue GBFA

Federal Agents and Law Enforcement Personnel

Digital Forensic Analysts

Incident Response Team Members

Information Security Professionals

Media Exploitation Analysts

DoD and Intelligence Community Professionals

Frequently Asked Questions

GBFA validates a practitioner’s readiness to handle the data collection and rapid triage process. Certification holders are qualified to properly collect, acquire, and conduct rapid triage analysis across a wide range of data storage.

GBFA is one proctored exam with 75 questions and a 2 hour time limit. The minimum passing score is 69%. GIAC periodically reviews exam specifications, so check the Certification Information section of your GIAC account for the format that applies to your attempt.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GBFA suits federal agents and law enforcement personnel, digital forensic analysts, incident response team members, information security professionals, media exploitation analysts, and DoD and intelligence community professionals.

FOR498: Digital Acquisition and Rapid Triage provides great training if you’re thinking of pursuing GBFA. The course includes 20 hands-on labs in the SANS Windows DFIR Workstation environment, across six sections that run from scene management and live acquisition to Apple devices, IoT, and manual data recovery. SANS training is not required for GIAC certification, and candidates who are already trained can register for the exam directly through GIAC.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GBFA certification?

Add the GBFA exam attempt when you register for FOR498.

Already trained? Register for the exam directly through GIAC.

SEC536: Adversarial AI - Penetration Testing AI Systems