GCFE (GIAC Certified Forensic Examiner)
GCFE is about collecting and analyzing data from Windows systems for investigations such as e-Discovery, evidence acquisition, browser forensics, and user and application activity tracing. Information security professionals, incident responders, and law enforcement investigators are among its audience. The matching SANS course is FOR500.
Exam Details
Open-book, web-based exam, proctored remotely through ProctorU or onsite at a Pearson VUE test center. It includes CyberLive hands-on questions run in virtual machines.
Price of one certification attempt with 120 days of access. A retake after a failed attempt is $899, a 45-day extension is $479, and a practice test is $399. Prices exclude sales tax.
Requirements and Renewal
Prerequisites
None. GIAC sets no prerequisites for any certification attempt but recommends a training course first.
Renewal
Earn 36 CPEs during the four-year cycle (or retake the exam) and pay the $499 maintenance fee. Additional renewals within two years of a full-price renewal cost $249.
Exam Domains
10 domains| Domain |
|---|
| Browser Forensic Artifacts |
| Browser Structure and Analysis |
| Cloud Storage Analysis |
| Digital Forensic Fundamentals |
| Email Analysis |
| Event Log Analysis |
| File and Program Analysis |
| Forensic Artifact Techniques |
| System and Device Analysis |
| User Artifact Analysis |
DoD 8140 Work Roles
3 work rolesThe DoD 8140 Qualification Matrix V2.1 lists GCFE as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Certification Lists
Related Tool Categories
Frequently Asked Questions
What does the GCFE exam cover?→
The objectives cover Windows artifacts: registry, event logs, browser data, email (including M365), cloud storage, USB devices, and program execution evidence.
How long is the GCFE exam?→
It has 82 questions and a 3-hour limit. The minimum passing score is 70%.
Does GCFE expire?→
Yes. GIAC certifications are valid for four years and are renewed with 36 CPEs or a retake, plus a $499 fee.
What happens if you fail a GIAC exam?→
Candidates can buy a retake within 30 days after the attempt deadline and must wait 30 days before sitting again. After three failed attempts the attempt ends, and a new one cannot be bought for one year.
Sources
Exam details are checked against official GIAC pages. Fees, exam versions, and renewal rules change; confirm with GIAC before registering. GCFE is a trademark of its owner. This site is not affiliated with or endorsed by GIAC.