GCFE — GIAC Certified Forensic Examiner
The entry-level GIAC forensics cert focused exclusively on Windows endpoint forensics. Covers the full Windows artifact landscape — registry, LNK files, shellbags, browser history, email artifacts, and prefetch. Well respected in enterprise DFIR teams and government environments, and DoD 8140 approved. The main criticism is the 25% practical weight still leans heavily on multiple choice, meaning strong memorization can pass it without deep hands-on experience. Best suited for analysts who need a recognized credential to validate Windows forensics skills for enterprise or government roles.
| Issuer | GIAC / SANS Institute |
|---|
| Level | intermediate |
|---|
| Domains | Digital Forensics & Incident Response |
|---|
| Practical weight | 25% |
|---|
| Cost (USD) | 999 |
|---|
| Renewal | 4 years |
|---|
| DoD 8140 | Yes |
|---|
| Skills | windows_artifact_analysis, browser_forensics, email_forensics, file_system_analysis, evidence_handling, registry_analysis, lnk_file_analysis |
|---|
Official certification page
Browse all 426 cybersecurity certifications on EBCertMap