Skip to content
CertGPS

GIAC Certified Forensic Analyst

Proves you can investigate intrusions across a Windows enterprise using memory forensics, filesystem timelines and NTFS analysis, partly tested in live virtual machines

AdvancedGIAC

The exam

Exam cost
$999
Study time
4-6 months
Passing score
71%
Valid for
4 years

Before you book

  • None listed by GIAC
  • Recommended: Windows forensics background such as SANS FOR500, which SANS advises before FOR508

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. GIAC Certified Forensic Examiner

    Advanced

    Comes before. Covers the Windows user artifacts that FOR508 assumes you already know from FOR500

  2. GIAC Certified Forensic Analyst

    You are here

  3. GIAC Reverse Engineering Malware

    Expert

    Next step. Takes the malware GCFA finds in memory and reverses it down to assembly

Study guide

Last updated

GIAC GCFA Study Guide: Memory, Timelines and the FOR508 Exam

GCFA is GIAC's exam for people who investigate intrusions across a Windows enterprise: finding an injected process in a memory image, building a filesystem timeline around the moment of compromise, spotting anti-forensics and scoping how far an attacker got. It's tied to SANS FOR508 and costs $999 an attempt. Course and exam are slightly out of step right now. SANS has given FOR508 a major update that adds AI-assisted forensic processing, but none of GIAC's ten published objectives mention AI, so study to the objectives.

Who GCFA is for, and who should start elsewhere

GIAC lists incident response team members, threat hunters, security operations center (SOC) analysts, experienced digital forensic analysts, federal agents and law enforcement, and red team members and penetration testers. The common thread is that you already know your way around Windows evidence and now need to answer "how did they get in, and where else are they?" across many machines. SANS rates FOR508 at the intermediate level and says it doesn't teach the basics of incident response policy or digital forensics.

If registry keys, shellbags and prefetch files are still new to you, earn GCFE first; SANS itself recommends a FOR500 background before FOR508. If your work is triage and containment rather than deep analysis, GCIH is the closer fit and covers the incident handling process GCFA takes for granted.

GCFA exam facts

ItemGCFA
FormatOne proctored exam with CyberLive hands-on tasks in a virtual machine
Questions and time82 questions, 3 hours
Passing score71% (exam versions released on or after March 18, 2023)
Price$999 per attempt; $899 retake; $399 practice test
DeliveryRemote through ProctorU or on site at Pearson VUE, within 120 days of activation
Reference materialOpen book: printed books, notes and an index; no electronic files
PrerequisitesNone listed by GIAC
Validity and renewalFour years; 36 CPEs or a retake, plus a $499 renewal fee

What the objectives test

GIAC publishes ten objectives with no weights:

  • Analyzing Volatile Malicious Event Artifacts (malicious processes, suspicious drivers, code injection, rootkits)
  • Analyzing Volatile Windows Event Artifacts (network connections, command lines, processes, handles, threads)
  • Enterprise Environment Incident Response
  • File System Timeline Artifact Analysis
  • Identification of Malicious System and User Activity
  • Identification of Normal System and User Activity
  • Introduction to File System Timeline Forensics
  • Introduction to Memory Forensics
  • NTFS Artifact Analysis
  • Windows Artifact Analysis

Count by theme and memory leads with three objectives, timelines and NTFS take three more, and two are about telling normal activity from malicious, a skill the rest depend on. You can't flag a rogue svchost.exe unless you know its parent, path and account on a clean system, which is why the SANS Hunt Evil poster is organized around what's normal on a Windows host.

In FOR508, section 3 covers memory forensics with Volatility and MemProcFS, section 4 builds timelines with tools including Plaso (log2timeline), and section 5 goes into NTFS internals and anti-forensics detection. Section 6 is an incident response challenge across more than thirty systems that pulls all ten objectives together. GIAC says the hands-on portion comes at the end and that failing most of it makes passing unlikely, though it doesn't publish how many items there are.

How to prepare

FOR508 runs six days in class or 36 hours self-paced, with 35 labs. Buying the GIAC attempt with the course adds two practice tests. Plan four to eight weeks after the course, and spend most of it at a keyboard rather than in the books, because the CyberLive tasks reward fast, accurate tool use.

Work in this order:

  • Memory first. Take memory images from your own Windows virtual machines, before and after running something suspicious, and walk the process tree, network connections and injected code with Volatility. The Art of Memory Forensics by Michael Hale Ligh, Andrew Case, Jamie Levy and AAron Walters (Wiley) explains the structures behind the plugins; it was published in July 2014, so check its commands against the Volatility version you use.
  • Timelines second. Build a super timeline of the same machine, then narrow it to the five minutes around your test activity until you can read MACB timestamps without thinking.
  • Enterprise scale last. FOR508 teaches KAPE for triage collection and Velociraptor for remote hunting; know what each collects and when you'd reach for it.

GIAC allows printed course books, notes and an index. With 82 questions in 180 minutes you have a little over two minutes each, so index tool syntax and plugin names as well as concepts. Take one practice test after the index is finished and keep the second for the final week. GIAC puts CyberLive content on practice tests too, so you'll see the virtual machine interface before exam day. A fail costs a 30-day wait and an $899 retake.

Renewal and next steps

GCFA is valid for four years. You renew with 36 CPEs or by retaking the exam, and pay a $499 maintenance fee each cycle. SANS courses can cover all 36 CPEs; work experience, cyber ranges and NetWars are capped at 12 each. Renewal brings updated digital course books, but GIAC's FAQ says the capture-the-flag lab data on USB B and C stays with new FOR508 registrations.

Three directions from here:

  • GIAC Experienced Forensics Analyst (GX-FA), GIAC's first Applied Knowledge certification in digital forensics: 25 CyberLive tasks in four hours, $499 with an active GCFA or $1,299 without.
  • GNFA for the network side of the same cases. SANS built most FOR572 labs with the FOR508 authors, so the scenarios overlap.
  • GREM if the part you enjoyed most was pulling the malicious process out of memory.

Our view

SANS calls FOR508 its original forensics and incident response course, and the exam built on it tests the hard parts: memory, timelines and judgment about what's normal. Two complaints are fair. The published objectives don't yet reflect FOR508's AI material, so you'll study some course content the exam may not test. And with SANS listing FOR508 at $8,780 plus the $999 attempt, it's an expensive way to prove skills you may already show in casework. If you're early in an incident response career and an employer is paying, it's one of the best uses of a training budget. If you've led investigations for years, your case history may speak louder.

Sources