GCFA (GIAC Certified Forensic Analyst)
GCFA covers collecting and analyzing data from computer systems during formal incident investigations, including memory forensics, timeline analysis, anti-forensics detection, and APT intrusions. Its audience includes incident response team members, threat hunters, SOC analysts, and experienced digital forensic analysts. GIAC pairs it with SANS FOR508.
Exam Details
Open-book, web-based exam, proctored remotely through ProctorU or onsite at a Pearson VUE test center. It includes CyberLive hands-on questions run in virtual machines.
Price of one certification attempt with 120 days of access. A retake after a failed attempt is $899, a 45-day extension is $479, and a practice test is $399. Prices exclude sales tax.
Requirements and Renewal
Prerequisites
None. GIAC sets no prerequisites for any certification attempt but recommends a training course first.
Renewal
Earn 36 CPEs during the four-year cycle (or retake the exam) and pay the $499 maintenance fee. Additional renewals within two years of a full-price renewal cost $249.
Exam Domains
10 domains| Domain |
|---|
| Analyzing Volatile Malicious Event Artifacts |
| Analyzing Volatile Windows Event Artifacts |
| Enterprise Environment Incident Response |
| File System Timeline Artifact Analysis |
| Identification of Malicious System and User Activity |
| Identification of Normal System and User Activity |
| Introduction to File System Timeline Forensics |
| Introduction to Memory Forensics |
| NTFS Artifact Analysis |
| Windows Artifact Analysis |
DoD 8140 Work Roles
5 work rolesThe DoD 8140 Qualification Matrix V2.1 lists GCFA as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Certification Lists
Related Tool Categories
Frequently Asked Questions
How long is the GCFA exam?→
GCFA is a proctored exam of 82 questions with a 3-hour limit. The minimum passing score is 71%.
What is the difference between GCFA and GCFE?→
GCFE covers Windows forensic examination, including registry, browser, email, and event log artifacts. GCFA covers advanced incident response, memory forensics, timeline analysis, and threat hunting in APT intrusions.
How much does GCFA cost?→
A GCFA attempt costs $999 and includes 120 days to take the exam. A retake after failing costs $899.
What happens if you fail a GIAC exam?→
Candidates can buy a retake within 30 days after the attempt deadline and must wait 30 days before sitting again. After three failed attempts the attempt ends, and a new one cannot be bought for one year.
Sources
Exam details are checked against official GIAC pages. Fees, exam versions, and renewal rules change; confirm with GIAC before registering. GCFA is a trademark of its owner. This site is not affiliated with or endorsed by GIAC.