FirstTry

Certification guide

GCFA

GIAC Certified Forensic Analyst (GCFA): the honest guide

The GIAC Certified Forensic Analyst exam is the Windows intrusion forensics exam: memory acquisition and analysis, NTFS internals, timeline construction from filesystem and artifact timestamps, evidence of execution and persistence, lateral movement, anti-forensics, and the incident response process at enterprise scale. It is 82 questions in three hours with a minimum passing score of 71 percent, delivered as a proctored web-based exam either remotely through ProctorU or at a Pearson VUE center.

Two things make it unlike most certification exams. It is open book, for printed material only, so the index you build during study is a legitimate exam tool. And it includes CyberLive questions, which put you in a lab with real tools and real evidence and score what you find rather than what you can describe. GIAC publishes ten objective areas without weightings, so every one of them can carry questions.

Who GCFA is for

A good fit if

  • You are on an incident response team, in a SOC or in a threat hunting role and you want to prove you can take a compromised Windows host from triage to a timeline that names what the attacker did and when.
  • You do digital forensics for law enforcement, a consultancy or an internal investigations team and your casework is moving from single machines to intrusions across an estate.
  • You are taking or have taken SANS FOR508 and want the credential the course is built around, since the exam objectives are the course's own topic list.
  • You hold GCIH or a similar handling credential and want the analysis depth that sits under it: memory, filesystem and artifact evidence rather than the response playbook.

Probably not, if

  • You have not yet done hands-on Windows forensics. The exam assumes you can run Volatility, parse an MFT and read a super timeline, and the CyberLive items test exactly that with no partial credit for knowing the theory.
  • Your work is network forensics, mobile devices or macOS and Linux endpoints. GCFA is Windows-centered, and GIAC has separate certifications for each of those specialities.
  • You want an entry-level security credential. The attempt alone is close to a thousand dollars and the objectives start where introductory forensics courses end.

Is GCFA worth it?

For incident response and forensics roles it is one of the few credentials hiring managers ask for by name, and one of the fewer still whose exam involves doing the work. That is why it holds value without the course: the certification attests to the same skill set whether or not you sat FOR508.

It is worth less as a first security certification or as a resume line for a role that does not touch investigations. The cost is high, the renewal is a four year cycle with 36 CPEs and a fee, and none of that pays back unless the skills get used.

Self-funding the exam without the course is a reasonable decision for a working analyst. Self-funding the course is a different question: the SANS FOR508 price was listed at $8,780 on 2 September 2026, and the honest comparison is against what the same money buys in lab time, books and conferences.

What the exam actually asks you to do

A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 82 are hands-on, so neither do we.

Item formats

  • Multiple choice
  • Hands-on lab

The highlighted formats are the ones you cannot answer from memory alone. GIAC, GCFA certification details ↗

Domain breakdown

Volatile Windows Artifacts and Malware Analysis is the heaviest domain at 20 percent, followed by File System Timeline Forensics at 20 percent.

GIAC publishes the GCFA exam certification objectives as an unweighted list and does not publish percentages for them. The six groupings above and the percentages assigned to them are ours, built by combining GIAC's published objective titles. Treat them as a study aid for planning practice time, not as an official GIAC exam weighting.

  • Enterprise Incident Response15%
  • Memory Forensics10%
  • Volatile Windows Artifacts and Malware Analysis20%
  • File System Timeline Forensics20%
  • NTFS and Windows Artifact Analysis20%
  • Normal and Malicious Activity Identification15%

Where to focus: The published GCFA objectives spend as much attention on normal Windows behavior as on malicious behavior, so build a baseline first: know what ordinary processes, handles, prefetch entries, and NTFS timestamps look like before you try to spot the outliers. Because the objectives are written as things you demonstrate rather than facts you recall, practice narrating the evidence chain from a raw artifact to a conclusion, not just naming the tool that reads it.

GIAC: GIAC certification objectives ↗

Study plans by experience level

Working DFIR analyst, forensics is the day job

6 to 8 weeksat 6 to 8 hours

  1. 1Read the ten objective areas on the GIAC page and, for each, write down which tool and which artifact you would reach for. Anything you cannot answer from memory is the study list.
  2. 2Build the index from week one: one line per artifact, per tool switch and per NTFS structure, with the page it lives on in your printed references. Print it in the last week and do not rely on searching a PDF you will not have.
  3. 3Spend two weeks on memory: acquisition options and their integrity implications, then Volatility plugins for processes, handles, threads, network connections, injected code and drivers, on samples of both clean and compromised hosts, so normal activity is as familiar as malicious activity.
  4. 4Spend two weeks on NTFS and timelines: MFT entries, $LogFile and $UsnJrnl, timestamp rules under copy, move and anti-forensic tampering, then super timeline construction with Plaso and filtering it down to the intrusion.
  5. 5Finish with a week on execution and persistence artifacts (Prefetch, Amcache, Shimcache, ShellBags, UserAssist, scheduled tasks and services) and a week on the enterprise response process and lateral movement evidence, then sit two timed practice exams with the index beside you.

Incident responder or SOC analyst moving into forensics

12 to 16 weeksat 8 to 10 hours

  1. 1Set up a lab you can break: a Windows VM, a SIFT workstation or a Linux VM with Volatility, Plaso and Eric Zimmerman's tools, and a way to take a memory image and a disk image of the Windows VM.
  2. 2Learn acquisition before analysis. Capture memory and disk from a running system, document the process, and understand what each method changes and why order of volatility matters.
  3. 3Work through memory forensics in the order GIAC lists it: how to identify normal Windows processes, handles and threads first, then the abnormal ones, since the malicious artifact objectives are defined against knowing what normal looks like.
  4. 4Take the same VM through an attack you run yourself (a dropped tool, a scheduled task, a lateral movement to a second VM) and then find every trace of it on disk: MFT, USN journal, Prefetch, Amcache, event logs, registry.
  5. 5Build a super timeline of that intrusion and practice reducing it to the events that matter. This is the skill the timeline objectives test and the one that takes longest to become fast.
  6. 6Build the index throughout, then spend the last three weeks on practice exams under time, with the printed index, and fix every gap the index failed to answer.

Sitting FOR508 with the attempt bundled

8 to 10 weeks after the courseat 5 to 8 hours

  1. 1Book the exam date before the course ends. The attempt runs on a 120 day clock from activation, and an attempt with no date booked is the one that lapses.
  2. 2Index the course books in the first fortnight while the material is fresh, by topic, tool and artifact, with book and page numbers. GIAC's own preparation page calls the index an essential part of studying, and an index built while the material is fresh is faster to use than one assembled from memory in the last week.
  3. 3Repeat every lab from the course on your own machine without the workbook, and time yourself. The CyberLive questions are lab tasks with a clock.
  4. 4Use the first bundled practice test at the halfway point to find weak objectives and the second in the final week as a timed dress rehearsal.
  5. 5Revisit the enterprise incident response and adversary fundamentals material last. It is the part of the course that feels like reading rather than doing, and the exam asks about it in scenario form.

Common mistakes

Treating open book as a reason to study less
Three hours for 82 questions is about two minutes each, and the CyberLive items take longer than that. A candidate who has to look up how a tool works rather than where a fact is written runs out of time. The book confirms what you know; it does not substitute for it.
Bringing the wrong kind of book
GIAC allows printed books, notes and study guides and no digital items at all. A tablet full of annotated PDFs stays outside. Build a paper index and test it on paper.
Learning malicious artifacts without learning normal ones
Half the memory objectives and one of the activity objectives are about identifying normal system and user activity. The exam asks you to tell the two apart, and a candidate who only studied attacker tooling will flag legitimate Windows behavior as malicious.
Skipping timestamp rules
The timeline objectives rest on what each NTFS timestamp does under a copy, a move, an extraction and a deliberate timestomp, and on the difference between $STANDARD_INFORMATION and $FILE_NAME. Candidates who memorized tools rather than rules lose questions here reliably.
Letting the 120 day window run out
The attempt expires 120 days after activation. Extensions cost money, missed appointments cost money, and a purchase of a new attempt costs the full fee. Schedule on the day the attempt activates.
Expecting the practice test to teach
GIAC's practice tests use a limited question bank and never include real exam questions. They are a rehearsal of the engine and of pacing. Buy one late, not three early.

What comes after passing

Set the four year renewal in a calendar on the day you pass. Registration opens at the two year mark, renewal adds four years to the existing expiry rather than to the renewal date, and 36 CPEs are easier to log gradually than to find in the last six months.

Put the credential on a resume next to the casework it represents: memory analysis, timeline reconstruction, enterprise-scale response. A GCFA with two written-up investigations behind it reads very differently from the acronym alone.

The natural next steps are GCFE for the deeper Windows user-activity analysis, GNFA for the network side of the same intrusions, or GREM if the malware you keep finding in memory is the part you want to understand.

Costs across the full renewal cycle are on the GCFA cost page.

Frequently asked questions

Is the GCFA exam open book?

Yes, for printed material only. GIAC allows printed books, notes and study guides into the exam and permits no digital items. GIAC's preparation guidance calls building an index an essential part of studying, and it goes into the room with you on paper.

Do I need to take SANS FOR508 to sit the GCFA?

No. The certification attempt can be bought on its own from GIAC. The course covers the same objectives and includes two practice tests with the bundled attempt, but nothing about the exam requires it.

What are CyberLive questions?

Hands-on items inside the exam that put you in a lab environment with real tools and evidence and score the result you produce. They are worth preparing for by repeating lab work under time rather than by reading about tools.

How long do I have to take the exam after buying it?

120 days from the date the attempt is activated in your GIAC account. A 45 day extension can be bought around the deadline, and the maximum total access to any attempt, including extensions and retakes, is 570 days.

What happens if I fail?

A retake can be bought for 30 days after your deadline at a reduced price, with a 30 day wait after the failure. After a third failure the attempt closes and GIAC requires a year before a new one unless a documented waiver is accepted.

How long is the GCFA valid?

Four years. Renewal is 36 CPE credits plus a maintenance fee, or passing the current exam again, and registration opens two years before the certification expires.

Keep reading

Every guide and cost breakdown, by vendor

Practice GCFA for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free GCFA questions