GCFA And GCFE Certifications
SANS is the organization behind the Global Information Assurance Certification (GIAC) program, and is a well-respected and highly regarded player in the information security field in general. SANS not only teaches and researches in this area, it also provides breaking news, operates a security alert service and serves on all kinds of government, research and academic information security task forces, working groups and industry organizations.
The organization’s forensics credentials include the intermediate-level GIAC Certified Forensic Examiner (GCFE) and the more senior GIAC Certified Forensic Analyst (GCFA). Neither credential requires taking SANS courses (which enjoy a strong reputation as among the best in the information security community, with high-powered instructors to match), but they are recommended to candidates, and often offered before, during or after SANS conferences held around the USA at regular intervals.
The GCFA certification is for professionals working in the information security, computer forensics, and incident response fields. The certification focuses on core skills required to collect and analyze data from Windows and Linux computer systems.
The GCFA certifies that candidates have the knowledge, skills, and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats, anti-forensic techniques used by attackers, and complex digital forensic cases.
The GCFE certification is for professionals working or interested in the information security, legal and law enforcement industries with a need to understand computer forensic analysis. The certification focuses on core skills required to collect and analyze data from Windows computer systems.
The GCFE certifies that candidates have the knowledge, skills, and ability to conduct typical incident investigations including e-Discovery, forensic analysis and reporting, evidence acquisition, browser forensics and tracing user and application activities on Windows systems.
Certification Name
GIAC Certified Forensic Examiner (GCFE)
GIAC Certified Forensic Analyst (GCFA)
Prerequisites & Required Courses
GCFE recommended course: FOR408: Windows Forensic Analysis, $5,620 USD
GCFA recommended course: FOR508: Advanced Digital Forensics and Incident Response, $5,350 USD
Number of Exams
One exam for each credential (115 questions, 3 hours)
GCFE: Passing score of 71 percent required
GCFA: Passing score of 69 percent required
Exams proctored by Pearson VUE. (registration with GIAC required to schedule an exam)
Cost per Exam
$629 to $659, if part of training/bootcamp
Exam challenge: $1,199 USD (no training)
URL
Self-Study Materials
Practice exams available on the GIAC exam preparation page. Study guides and practice exams can be found on Amazon and other typical channels.
