Group Purchasing
Group Purchasing

What Is the GCFA Certification?

The GCFA certification validates a practitioner’s core forensic skills to collect and analyze data in computer systems. Certification holders can conduct formal incident investigations and handle advanced scenarios, including internal and external data breach intrusions, advanced persistent threats (APTs), anti-forensic techniques used by attackers, and complex digital forensic cases.

By the numbers

3 hrs

Exam duration

82

Questions

71%

Min. passing score

What GCFA Covers

GCFA’s 10 published exam objectives group into five practical areas, which map to Sections 1 through 5 of FOR508.

Enterprise Incident Response

Covers Enterprise Environment Incident Response and Identification of Normal System and User Activity.

Intrusion Analysis

Covers Windows Artifact Analysis and Identification of Malicious System and User Activity.

Memory Forensics

Covers Introduction to Memory Forensics, Analyzing Volatile Malicious Event Artifacts, and Analyzing Volatile Windows Event Artifacts.

Timeline Analysis

Covers Introduction to File System Timeline Forensics and File System Timeline Artifact Analysis.

NTFS and Anti-Forensics Detection

Covers NTFS Artifact Analysis and the anti-forensics part of Identification of Malicious System and User Activity.

Prepare With This Course

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

How FOR508 Prepares You for GCFA

FOR508 is built around the exam objectives that make up the GCFA certification:

  • Section 1, Enterprise Environment Incident Response and Identification of Normal System and User Activity
  • Section 2, Windows Artifact Analysis and Identification of Malicious System and User Activity
  • Section 3, Memory Forensics in Incident Response and Threat Hunting builds skills tested under Introduction to Memory Forensics, Analyzing Volatile Malicious Event Artifacts, and Analyzing Volatile Windows Event Artifacts. 
  • Section 4, Timeline Analysis aligns with Introduction to File System Timeline Forensics and File System Timeline Artifact Analysis. 
  • Section 5, Incident Response and Hunting Across the Enterprise / Advanced Adversary and Anti-Forensics Detection builds skills tested under NTFS Artifact Analysis and further work in Identification of Malicious System and User Activity. 

Across all five sections, 35 hands-on labs and a capstone APT Threat Group Incident Response Challenge give you the chance to apply each skill in a live Windows enterprise environment before you sit the exam.

Read the full GCFA certification overview here.

FOR508 Authors

Who Should Pursue GCFA

Incident Response Team Members

Threat Hunters

SOC Analysts and Information Security Professionals

Experienced Digital Forensic Analysts

Federal Agents and Law Enforcement Professionals

Red Team Members, Penetration Testers, and Exploit Developers

Frequently Asked Questions

GCFA certification holders can run formal incident investigations against advanced threats, including internal and external data breach intrusions, advanced persistent threats, and complex digital forensic cases involving anti-forensic techniques.

The GCFA exam uses GIAC's CyberLive hands-on testing environment, with 82 questions, a 3-hour time limit, and a minimum passing score of 71%.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC's renewal page.

GCFA is designed for incident response team members, threat hunters, SOC analysts and information security professionals, experienced digital forensic analysts, federal agents and law enforcement professionals, and red team members, penetration testers, and exploit developers.

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics is built around GCFA's exam objectives, with 35 hands-on labs and a capstone APT Threat Group Incident Response Challenge spanning more than thirty systems in a simulated Windows enterprise.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GCFA certification?

Add the GCFA exam attempt when you register for FOR508.

Already trained? Register for the exam directly through GIAC here.