SecProve
ProfessionalVendor-neutralISO 17024GIAC / SANS· issued from US

GCFE

GIAC Certified Forensic Examiner

Windows host forensics and digital investigation.

Official page at GIAC / SANS↔ Compare with another cert
Exam fee
$979
Ongoing
$0/yr AMF · 9 CPE/yr
Study time
120–200 hrs
Delivery
Online proctored
Validity
4 yrs (renewal cycle)

› Quality score

28.0 / 40

Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.

Blueprint rigor
How well-defined and rigorous the exam blueprint is.
FOR500-aligned, focused on Windows artefacts. Clear objectives.
8.5/10
Practical evidence
Hands-on labs / written reports vs pure MCQ.
Cyber Live forensic-artefact segment — hands-on but narrow.
6.0/10
Currency & upkeep
How aggressively content is kept current with the field.
FOR500 refreshed in 2022 with newer Windows artefact sources.
7.0/10
Market recognition
How often this signal actually moves a hiring decision.
Recognised in Windows-DFIR roles; less weighted than GCFA at senior tiers. [Holders: 8k, 2024-12]
6.5/10

› Market signals

public, citable inputs to the recognition score
Holders worldwide
8,000
as of 2024-12 · source

› Built for these roles

Digital Forensic ExaminerDFIR AnalysteDiscovery Analyst

› Exam format

Open-book MCQ exam, 82 questions over 3 hours plus a 15-min Cyber Live hands-on component, online proctored.

Passing score
70% (scaled per attempt)
Retake policy
Fee: $999 per attempt
Wait: 30d between attempts

30-day wait. SANS course bundles typically include 2 attempts.

› Recertification

36 CPE credits over four years (avg 9/yr) plus the $499 renewal fee per cycle.

› NICE Framework work roles

The NIST NICE work-role IDs this cert maps to. NICCS lookup.

DD-WRL-009PD-WRL-004IN-WRL-001PD-WRL-002
Recognition
GlobalUSEUUK
Exam languages
en

› Core domains covered

The 1 domain this cert is centrally about. Passing the exam demonstrates working knowledge of each.

A7Incident Response & Forensics

IR playbooks, memory/disk/network forensics, chain of custody, malware analysis.

› Prerequisites

Experience

Hands-on forensics or IR experience. Usually paired with SANS FOR500.

Knowledge assumed
  • Windows forensic artifacts (registry, prefetch, MFT)
  • Disk imaging and chain of custody
  • Browser / email forensics

› Progression

requiredrecommended

Where this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.

Required prereqs (0)

No vendor-gated prereqs.

Recommended priors (1)
GSECGIAC / SANS
GCFE
GIAC / SANS
Required by (0)

No certs require this one.

Recommended next (3)
GCFAGIAC / SANSGIMEGIACGASFGIAC

› Study materials

Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.

Official guides
Practice tests
  • GIAC Practice Tests (2 included with exam)
Free / community

› Version & lifecycle

Current version
2024 FOR500 refresh
Released
2024-08

› Salary signal

Forensic examiner / DFIR analyst, US, 3-5 years.

$100K–$150K
median $120K

Robert Half Salary Guide · 2024 · US base only · p25–p75 range

› How it compares

vs
GCFA

GCFE is Windows-focused forensic examiner; GCFA is advanced IR with broader scope.

↔ Compare side-by-side

See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.

Highlight on the domain mapBrowse all certifications