The GIAC Certified Forensic Examiner (GCFE) tests whether you can reconstruct what a user and a Windows system did from the artefacts left behind, and candidates who memorise artefact names without knowing what each one proves tend to struggle. GCFE covers Windows filesystem and registry fundamentals, program execution and file access artefacts, USB and cloud storage traces, event logs, email and browser forensics. This guide sets out what GIAC publishes about the exam, objectives, prices, attempt rules and renewal, then adds a practical preparation plan and where GCFE sits on a digital forensics and incident response (DFIR) career path. It is for incident responders, SOC analysts moving into forensics, investigators and law enforcement examiners, and for managers deciding whether to fund it. Exam facts are taken from giac.org, checked November 2026; GIAC says the format and passing score for your own attempt are shown in your GIAC account, so confirm there before you register. For the discipline itself, see the Digital Forensics (DFIR) Guide.
This is an independent guide from NHI Mgmt Group, based on GIAC's public certification pages as of November 2026. It is not sponsored or reviewed by GIAC. Exam details change, so confirm them against GIAC's current pages and your GIAC account.
Key takeaways
- It is a Windows host forensics certification. GIAC's ten objectives centre on Windows artefacts: registry, program execution, file and folder access, USB devices, event logs, email, browsers and cloud storage.
- The exam is 82 questions in 3 hours. One proctored exam, minimum passing score 70% for exam versions released on or after 17 December 2022.
- Open book rewards a good index. GIAC exams allow printed books and notes but no digital materials, at a test centre or remotely.
- Budget $999 an attempt. GIAC's standard attempt price; practice tests are $399 and a retake is $899, and prices can change without notice.
- Renew every four years. Earn 36 CPEs over four years and pay the renewal fee ($499 standard), or renew by retaking the exam.
Who the certification is for
GIAC describes the GCFE audience as people with a background in information systems, information security or computers who want a deep understanding of Windows forensics, together with information security professionals, incident response team members, law enforcement officers, federal agents and detectives, and media exploitation analysts. GIAC groups the content into Windows forensics and data triage; registry, USB devices, shell items, email forensics and log analysis; and advanced browser forensics for Chrome, Edge and Firefox.
| Role | Why GCFE fits | What to add |
|---|---|---|
| Incident responder | Answers "what happened on this host, and when" during an investigation | Enterprise-scale and memory forensics (see the GIAC GCFA Guide) |
| SOC analyst moving to DFIR | Moves from alert triage to evidence-based host analysis | Incident handling (see the GIAC GCIH Guide) |
| Internal investigator (HR, insider, fraud) | User activity, file access and USB artefacts are core to insider cases | Evidence handling and legal process training |
| Law enforcement examiner | Named in GIAC's audience; Windows artefacts appear in most casework | Mobile device forensics |
| eDiscovery or litigation support analyst | Email and cloud storage objectives map to collection work | Cloud and SaaS collection |
GCFE or GCFA: both are GIAC forensics certifications. GCFE centres on what a user did on a Windows system; GCFA extends to enterprise incident response, memory analysis and finding attacker activity across many hosts. Many examiners take GCFE first and GCFA later; responders who already know host artefacts often go straight to GCFA.
Exam format and domains
| Item | GIAC's published value |
|---|---|
| Number of exams | 1 proctored exam |
| Questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 70% (exam versions released on or after 17 December 2022) |
| Delivery | Web based, proctored remotely (ProctorU) or onsite (Pearson VUE) |
| Attempt window | 120 days from activation |
| Materials allowed | Printed books, notes and study guides; no digital materials |
GIAC's certification objectives for GCFE, with what each one means for study:
| GIAC objective | What GIAC says it covers | Study focus |
|---|---|---|
| Digital Forensic Fundamentals | Forensic methodology, key concepts, Windows filesystems and registry structure | NTFS structures, timestamps, registry hives and where they live |
| Forensic Artifact Techniques | Approaches and tools for collecting evidence for triage | Triage collection versus full images; tool output validation |
| File and Program Analysis | Artefacts from program execution and folder and file activity | Evidence of execution, recently used files, folder access |
| System and Device Analysis | File access artefacts and USB device artefacts | Tying a device to a user, a time and the files opened |
| User Artifact Analysis | Artefacts from user accounts and activity on current Windows systems | Account profiles, logon history, user-specific registry keys |
| Event Log Analysis | Purpose and forensic value of Windows event, service and application logs | Logon, process and service events; gaps and clearing |
| Email Analysis | Client, web-based, mobile and Microsoft 365 email | Header analysis, mailbox stores, cloud mail audit |
| Browser Forensic Artifacts | Forensic value of browser artefacts | History, downloads, cache, cookies, session restore |
| Browser Structure and Analysis | Common browser structure and analysis techniques | Browser databases and profiles across Chromium-based browsers and Firefox |
| Cloud Storage Analysis | Artefacts from installing and using cloud storage, and their use in examinations | Sync client databases, local caches, linking to cloud audit logs |
The site's discipline guides follow the same areas: the Windows Event Log Guide, the Browser Forensics Guide, the Email Forensics and Header Analysis Guide and the File System Forensics Guide.
Prerequisites and experience
The GIAC GCFE page lists no formal prerequisite. GIAC links the exam to SANS training available live and OnDemand. The affiliated course is SANS FOR500: Windows Forensic Analysis, which SANS lists as 6 days instructor-led or 36 hours self-paced, 36 CPEs, with no prerequisite courses required. Training is optional: you can buy a GIAC attempt without it.
- Helpful before you start: confident Windows administration, comfort with the command line, and an understanding of how users, profiles and file permissions work on Windows.
- Helpful but not essential: some incident response experience, so you know which questions an investigation actually needs answered.
- Evidence handling: GCFE tests artefact knowledge, but real casework also needs sound acquisition and chain of custody. See the Disk Imaging and Forensic Acquisition Guide.
Preparation plan
GIAC advises planning about four months of study, starting right after training, and reports that certification holders studied an average of 55+ hours. A 12 week plan within that window:
- Weeks 1 to 2, fundamentals: NTFS, timestamps and registry hive structure. Build a Windows lab virtual machine you can image and examine.
- Weeks 3 to 4, execution and file access: generate known activity in the lab (run programs, open files, browse folders), then find each action in the artefacts and note what each artefact proves and does not prove.
- Weeks 5 to 6, users, devices and logs: connect a test USB device, log on as different users, and trace it all through registry keys and event logs.
- Week 7, email, browsers and cloud storage: create browser history, downloads and synced files on purpose, then recover them.
- Week 8, timelines: combine artefacts into one timeline; see the Forensic Timeline Analysis Guide.
- Week 9, first practice test: GIAC advises a practice test after the first full pass, then using the score report to target weak objectives.
- Weeks 10 to 11, index and gaps: complete your colour-coded index, with a column for "what this artefact proves". GIAC's tip is not to take two practice tests in one day.
- Week 12, second practice test and booking.
GIAC notes that the practice question bank is limited, so questions can repeat between practice tests, and practice exams never include real exam questions. The strongest preparation is lab work where you created the activity yourself, because you know the ground truth and can check every conclusion.
Readiness signals: given a user action such as running a program, opening a document or plugging in a USB device, you can name the artefacts that record it, where they live and which timestamps they carry; your index finds any artefact in under a minute; and your practice score sits comfortably above 70% with no objective far behind the rest. If browser, email or cloud storage objectives trail, give them a dedicated lab week, as they are easy to neglect next to registry work.
Cost, renewal and continuing education
| Fee (GIAC standard pricing, USD, excluding tax) | Amount |
|---|---|
| Certification attempt | $999 |
| Practice exam | $399 |
| Exam retake | $899 |
| Attempt extension (45 days) | $479 |
| Certification renewal | $499 |
| Additional renewals within 2 years of a full price renewal | $249 each |
| Reseating fee for a missed proctored appointment | $175 |
GCFE is not listed among the exceptions on GIAC's pricing page, so standard prices apply. The pricing page also lists GX-FE, priced at $1,299 an attempt, or $499 for candidates holding an active GCFE. GIAC states it can change pricing at any time without notice.
- Attempt rules: 120 days per attempt; extensions and retakes cannot take the total beyond 570 days; 30 day wait after a failure, with a retake adding 60 days to the deadline; up to 10 extensions of 45 days; after 3 failed attempts, a one year wait before a new attempt.
- Renewal: collect 36 CPEs over four years and pay the renewal fee, or retake the exam; a successful renewal keeps the certification active for four more years. See the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
GCFE is often the first specialist credential for someone moving into forensics, because Windows endpoints feature in most investigations. The DFIR Analyst Career Guide covers the wider route.
- First forensics role: GCFE validates the host artefact knowledge that junior examiners use daily.
- Incident response progression: GCFE, then GCFA for enterprise investigations and memory analysis, and GREM for those who move into malware analysis (see the GIAC GREM Guide).
- Investigations and insider risk: GCFE's user, device and email objectives map directly to HR and insider cases.
- Identity angle: many investigations turn on which account did what. Artefacts that tie activity to a user also expose service accounts and stored credentials used on the host, which feeds identity remediation; see the Identity Incident Response Playbook.
Salary claims are not included: GIAC publishes no official salary data for GCFE, and figures quoted elsewhere vary by market and source.
Practitioner checklist
- Confirm the exam version, question count and passing score in your GIAC account before booking.
- Map your skills to the ten GIAC objectives and mark the weakest three.
- Build a Windows lab and generate known activity so you can check every artefact against ground truth.
- For each artefact, record what it proves, what it does not prove, and where it lives.
- Build your colour-coded index as you study, not at the end.
- Take the first practice test after one full pass and the second only when the index is complete.
- Choose remote or test centre delivery early and test the remote setup.
- Diary the four-year renewal and track CPEs from the day you pass.
Standards and references
- GIAC: Certified Forensic Examiner (GCFE)
- GIAC: Pricing
- GIAC: Retakes and Extensions
- GIAC: Best Practices for Practitioner Exam Preparation
- GIAC: How to Renew
- SANS: FOR500 Windows Forensic Analysis
Related NHI Mgmt Group resources: Digital Forensics (DFIR) Guide · GIAC GCFA Guide · DFIR Analyst Career Guide · Forensic Timeline Analysis Guide · Windows Event Log Guide