GIAC Certified Forensic Analyst Certification (GCFA)

Digital Forensics Certification

Prove hands-on skill investigating enterprise Windows intrusions through memory forensics, timeline analysis, and anti-forensic detection.

Explore FOR508 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GCFA Certification?

The GCFA certification proves a practitioner can run formal incident investigations against advanced threats, including data breach intrusions, advanced persistent threats, and complex digital forensic cases that involve anti-forensic techniques.

By the numbers

3 hrs

Exam duration

Questions

71%

Min. passing score

What GCFA Covers

The certification's ten published objectives group into six practical domains.

Enterprise Incident Response

Scoping and scaling the incident response process across a large enterprise.

Malicious and Normal Activity Identification

Telling attacker activity apart from legitimate system and user behavior on disk and in memory.

Memory Forensics

Collecting volatile data and finding malicious processes, code injection, and rootkits in memory.

Timeline Forensics

Building and reading filesystem timelines to reconstruct how an intrusion unfolded.

NTFS and Anti-Forensics Analysis

Recovering evidence from Windows filesystem structures and detecting anti-forensic tampering.

Windows Artifact Analysis

Collecting and interpreting Windows system artifacts, including evidence of program execution.

Prepare With This Course

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

Course Details

How FOR508 Prepares You for GCFA

FOR508 is built around the exam objectives that make up the GCFA certification:

Section 1, Advanced Incident Response and Threat Hunting builds skills tested under Enterprise Environment Incident Response and Identification of Malicious and Normal System and User Activity.
Section 2, Intrusion Analysis aligns with Windows Artifact Analysis and Identification of Malicious and Normal System and User Activity.
Section 3, Memory Forensics in Incident Response and Threat Hunting builds skills tested under Introduction to Memory Forensics, Analyzing Volatile Malicious Event Artifacts, and Analyzing Volatile Windows Event Artifacts.
Section 4, Timeline Analysis aligns with Introduction to File System Timeline Forensics and File System Timeline Artifact Analysis.
Section 5, Incident Response and Hunting Across the Enterprise / Advanced Adversary and Anti-Forensics Detection builds skills tested under NTFS Artifact Analysis and further work in Identification of Malicious System and User Activity.
Section 6, The APT Threat Group Incident Response Challenge pulls all ten GCFA objectives together in one enterprise intrusion investigation across more than thirty systems.

Across all six sections, 35 hands-on labs and a capstone APT Threat Group Incident Response Challenge give you the chance to apply each skill in a live Windows enterprise environment before you sit the exam.

Read the full GCFA certification overview here.

FOR508 Authors

Steve Anson

Co-Founder at Informed Defense

Steve Anson is a SANS Principal Instructor, FOR508 co-author and DFIR expert with over 25 years of experience, including complex DCIS and FBI cybercrime investigations, training teams in over 60 countries, and writing widely used IR/forensics books.

Learn more

Mike Pilkington

Full-Time Researcher at SANS Research Operations Center (SROC)

Current DFIR consultant, and former incident response lead at Shell and Halliburton, Mike’s work has helped shape enterprise-scale incident response and directly advanced the global community’s ability to combat cyber adversaries.

Learn more

Who It's For

Incident Response Team Members

Threat Hunters

SOC Analysts

Experienced Digital Forensic Analysts

Federal Agents and Law Enforcement Professionals

Red Team Members, Penetration Testers, and Exploit Developers

Frequently Asked Questions

GCFA certification holders can run formal incident investigations against advanced threats, including internal and external data breach intrusions, advanced persistent threats, and complex digital forensic cases involving anti-forensic techniques.

The GCFA exam uses GIAC's CyberLive hands-on testing environment, with 82 questions, a 3-hour time limit, and a minimum passing score of 71%.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC's renewal page.

GCFA is designed for incident response team members, threat hunters, SOC analysts, experienced digital forensic analysts, federal agents and law enforcement professionals, and red team members, penetration testers, and exploit developers.

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics is built around GCFA's exam objectives, with 35 hands-on labs and a capstone APT Threat Group Incident Response Challenge spanning more than thirty systems in a simulated Windows enterprise.

Ready to earn your GCFA certification?

Add the GCFA exam attempt when you register for FOR508

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems