Skip to content
CertGPS

GIAC Certified Forensic Examiner

Proves you can reconstruct what a user did on a Windows system from registry, browser, email, USB and cloud storage artifacts, partly in hands-on tasks

AdvancedGIAC

The exam

Exam cost
$999
Study time
4-6 months
Passing score
70%
Valid for
4 years

Before you book

  • None listed by GIAC
  • Recommended: SANS FOR500 Windows Forensic Analysis or equivalent study and Windows forensics experience

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

    • Director of Digital Forensics
    • CISO

Where it leads

  1. GIAC Certified Forensic Examiner

    You are here

  2. GIAC Certified Forensic Analyst

    Advanced

    Next step. Moves from one user's activity on a PC to intrusions, memory and timelines across an enterprise

Study guide

Last updated

GIAC GCFE Study Guide: Windows Forensics, FOR500 and the Exam

GCFE tests whether you can sit down with a Windows machine and say what its user did: which programs ran, which files were opened, which USB drive was attached. It's GIAC's exam for SANS FOR500, and an attempt costs $999. Plan around the format, which is open book for printed material only and ends with hands-on CyberLive tasks in a virtual machine.

Who GCFE suits, and who should pick something else

GIAC aims GCFE at incident response team members, law enforcement officers, federal agents and detectives, media exploitation analysts and security staff who want depth in Windows forensics. In practice that means internal investigations: intellectual property theft, employee misuse, fraud, e-discovery requests. SANS rates FOR500 at its "Essential" skill level and lists no prerequisite courses, so a security analyst or IT administrator moving into forensics can start here.

It's the wrong first pick if your cases are intrusions rather than people. Memory analysis, lateral movement and enterprise-wide timelines belong to GCFA, which assumes the artifact knowledge GCFE builds. If you handle alerts and containment more than evidence, GCIH matches the job better. If your work is evidence handling for court, start somewhere else, because SANS says FOR500 doesn't cover chain of custody or introductory drive acquisition; those sit in FOR498.

GCFE exam facts

ItemGCFE
FormatOne proctored exam with CyberLive hands-on tasks in a virtual machine
Questions and time82 questions, 3 hours
Passing score70% (exam versions released on or after December 17, 2022)
Price$999 per attempt; $899 retake; $399 practice test
DeliveryRemote through ProctorU or on site at Pearson VUE, within 120 days of activation
Reference materialOpen book: printed books, notes and an index; no electronic files
PrerequisitesNone listed by GIAC
Validity and renewalFour years; 36 CPEs or a retake, plus a $499 renewal fee

The ten objectives, and where the weight falls

GIAC lists ten objectives and doesn't publish weights:

  • Browser Forensic Artifacts
  • Browser Structure and Analysis
  • Cloud Storage Analysis
  • Digital Forensic Fundamentals (methodology, Windows filesystems and registry structure)
  • Email Analysis (client, web-based, mobile and Microsoft 365)
  • Event Log Analysis
  • File and Program Analysis
  • Forensic Artifact Techniques (collection for triage)
  • System and Device Analysis (file access and USB devices)
  • User Artifact Analysis

Without weights, the course structure is the best guide to emphasis. SANS maps FOR500's section 2 to three objectives at once (cloud storage, file and program, user artifacts), so registry analysis and evidence of execution carry the most material. Browsers get two objectives and a whole course section covering Chrome, Edge and Firefox, including raw SQLite, LevelDB and ESE databases. Email reaches further than the name suggests: GIAC's objective takes in webmail, mobile clients and Microsoft 365, and FOR500 adds Google Workspace.

The outline has no memory forensics objective and no intrusion scenario. GCFE asks "what did this user do", not "how did the attacker get in". GIAC's CyberLive FAQ adds that the hands-on section comes last, that its share of the score varies by exam, and that candidates who can't answer most CyberLive items correctly shouldn't expect to pass. GIAC doesn't say how many of the 82 questions are CyberLive.

How to prepare

FOR500 runs six days in class or 36 hours self-paced over four months, with 22 labs and a capstone Windows forensic challenge. A GIAC attempt bought with the course comes with two practice tests. If you study without the course, GIAC's own page allows that work experience, college courses or self-study can be enough, but expect the questions to track the FOR500 books closely.

Build a lab before you build an index. Install Windows 11 in a virtual machine, then create the evidence yourself: run programs, open documents, plug in a USB stick, sign in to OneDrive, send webmail, search for files. Collect the image with KAPE, which FOR500 teaches for triage, and find each action again with Eric Zimmerman's parsers, such as RECmd for registry hives. Doing this once for every objective teaches you more than rereading the shellbags chapter.

Then turn the books into an index. GIAC lets you bring printed notes and an index but no electronic files, so the index is how you find a registry key path in 30 seconds. Organize it by question as well as by term. The SANS Windows Forensic Analysis poster is built that way (what ran, what was opened, where the user connected), and a printed copy makes a good companion.

Save both practice tests. If you fail, GIAC makes you wait 30 days before a retake, so a practice score is cheaper feedback. Take the first once your index is done, fix the gaps it shows, and sit the second about a week before the exam. GIAC says CyberLive content appears on practice tests, so use them to get used to switching between the question window and the virtual machine. A reasonable split for six to eight weeks after the course: a third on the index, a third in your lab, the rest on practice tests and the topics they expose.

Renewal and next steps

GCFE lasts four years. To renew, you either earn 36 continuing professional education credits (CPEs) or retake the exam, and pay $499; renewing another GIAC certification within two years of a full-price renewal costs $249. SANS courses can supply all 36 CPEs, while work experience, capture-the-flag events and NetWars are each capped at 12. Renewal includes updated digital course books, audio and lab files, though GIAC's FAQ says the FOR500 capture-the-flag lab data on USB B and C goes only to new course registrations.

Where to go next:

  • GCFA, the natural sequel. SANS recommends a FOR500 background before FOR508.
  • GIAC Experienced Forensics Examiner (GX-FE), an Applied Knowledge exam of 25 CyberLive tasks in four hours. It costs $499 with an active GCFE against $1,299 without.
  • GNFA, if your cases keep leading to proxy logs and packet captures.

Our view

We rate GCFE highly for corporate investigation and law enforcement work, because its outline goes deep on Windows artifacts and the CyberLive section makes you use the tools on a live system. The criticism is cost and coupling. The attempt is $999, SANS lists FOR500 sessions at $8,780, and the open-book format rewards a well-built index as much as forensic judgment. If your employer pays for FOR500, take the exam while the material is fresh. Paying for it yourself, we'd do so only when forensic examiner postings in your market name GCFE.

Sources