Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

GIAC Certified Forensic Examiner (GCFE) Certification

Digital Forensics Certification Overview

Validates the ability to collect and analyze data from Windows computer systems, applying core computer forensic analysis skills and knowledge.

Explore FOR500 CourseRegister for the Exam
GCFE Badge
Jump to:

What Is the GCFE Certification?

The GCFE certification validates a practitioner's ability to collect and analyze data from Windows computer systems, applying core computer forensic analysis skills and knowledge. Certification holders are qualified to conduct typical incident investigations, including e-Discovery, forensic analysis and reporting, evidence acquisition, browser forensics, and user and application activity tracing on Windows systems.

By the numbers

3 hrs

Exam duration

82

Questions

70%

Min. passing score

What GCFE Covers

GCFE's 10 published exam objectives group into five practical areas, which map to Sections 1 through 5 of FOR500.

Forensic Methodology and Triage

Covers Digital Forensic Fundamentals and Forensic Artifact Techniques.

Registry, Cloud, and User Activity

Covers Cloud Storage Analysis, File and Program Analysis, and User Artifact Analysis, the artifacts left behind by registry activity, program execution, and cloud storage use.

Device and System Analysis

Covers System and Device Analysis, including file access artifacts and USB device history.

Email and Event Log Analysis

Covers Email Analysis and Event Log Analysis, tracing communications and system activity through logs.

Web Browser Forensics

Covers Browser Forensic Artifacts and Browser Structure and Analysis.

Prepare With This Course

FOR500: Windows Forensic Analysis

Course Details

How FOR500 Prepares You for GCFE

FOR500: Windows Forensic Analysis is built around the exam objectives that make up the GIAC Certified Forensic Examiner (GCFE) certification: 

  • Section 1, Digital Forensics and Advanced Data Triage builds skills tested under Digital Forensic Fundamentals and Forensic Artifact Techniques.
  • Section 2, Registry Analysis, Application Execution, and Cloud Storage Forensics aligns with Cloud Storage Analysis, File and Program Analysis, and User Artifact Analysis.
  • Section 3, Shell Items and Removable Device Profiling builds skills tested under System and Device Analysis.
  • Section 4, Email Analysis, Windows Search, SRUM, and Event Logs aligns with Email Analysis and Event Log Analysis.
  • Section 5, Web Browser Forensics builds skills tested under Browser Forensic Artifacts and Browser Structure and Analysis.

Across all six sections, 22 hands-on labs and a capstone Windows Forensic Challenge give you the chance to apply each skill against real case evidence before you sit the exam. 

Read the full GCFE certification overview.

FOR500 Authors

Heather Barnhart

Heather Barnhart

VP of Curriculum and Digital Forensics Expert at SANS Institute

Heather Barnhart is the VP of Curriculum at SANS Institute, where she shapes the future of all SANS courses and trainings. She is also Dean of Faculty at the SANS Technology Institute, the premier college for cybersecurity.

Learn more
Ovie Carroll

Ovie Carroll

Director at DOJ Cybercrime Lab

For Ovie Carroll, digital forensics is all about the hunt for evidence in digital places that are hiding critical clues, followed by deep analysis to prove something that the evidence was never intended to prove.

Learn more
Mattia Epifani

Mattia Epifani

CEO at Reality Net System Solutions

Mattia Epifani pioneered methodologies for extracting critical evidence from encrypted mobile ecosystems, including iOS and Apple Watch. His groundbreaking work has become foundational for law enforcement and forensic analysts worldwide.

Learn more
Rob Lee

Rob T. Lee

Chief AI Officer and Chief of Research at SANS Institute

Rob T. Lee is Chief AI Officer and Chief of Research at SANS Institute, where he leads research, mentors faculty, and helps cybersecurity teams and executive leaders prepare for AI and emerging threats.

Learn more

Who Should Pursue GCFE

Information Security Professionals

Incident Response Team Members

Law Enforcement Officers, Federal Agents, and Detectives

Media Exploitation Analysts

IT and Security Practitioners Seeking Deep Windows Forensics Skills

Frequently Asked Questions

The GCFE certification proves you can collect and analyze data from Windows computer systems, including e-Discovery, evidence acquisition, browser forensics, and tracing user and application activity. 

The GCFE exam is a single proctored exam, 3 hours long, with 82 questions and a minimum passing score of 70%. 

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC's renewal page. 

GCFE is built for information security professionals, incident response team members, law enforcement officers, federal agents and detectives, and media exploitation analysts, along with anyone with an information systems background who wants a deep understanding of Windows forensics. 

FOR500: Windows Forensic Analysis aligns with GCFE's exam objectives, with 22 hands-on labs and a capstone Windows Forensic Challenge built on evidence from real devices.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GCFE certification?

Add the GCFE exam attempt when you register for FOR500.

Register for FOR500

Already trained? Register for the exam directly through GIAC here.

GIAC Certified Forensic Examiner (GCFE) Certification | SANS Institute