GIAC (SANS)GIAC Certified Forensic Examiner
The GIAC Certified Forensic Examiner (GCFE) certification validates your ability to collect and analyze data from Windows computer systems, covering core forensic skills like evidence acquisition, browser forensics, and user activity tracing. Designed for incident responders, law enforcement, and forensic analysts, it proves you can conduct defensible, expert-level Windows investigations. Earning GCFE signals readiness to handle typical incident investigations with confidence and precision.
416 practice questions · Updated 2026-07-30
GCFE Curriculum
Every domain, objective, and concept the GCFE exam measures.
- Digital Evidence Fundamentals
- Forensic Process Overview
- Legal and Ethical Considerations
- Forensic Readiness
- Evidence Handling and Chain of Custody
- Documentation and Reporting
- Forensic Artifact Identification
- Artifact Acquisition
- Artifact Analysis
- Artifact Preservation
- Artifact Documentation
- Browser Architecture
- Browser Data Storage
- Browser Artifacts
- Browser Profiles and User Data
- Browser Cache Analysis
- Browser History Analysis
- Cookie and Session Analysis
- Download and Form Data Analysis
- Browser Logs and Telemetry
- Cross-Browser Differences
- Browser Data Recovery
- Timeline Correlation
- Browser Artifact Types
- Artifact Storage Locations
- Artifact Formats and Structures
- Timeline Reconstruction
- Correlating Artifacts
- Artifact Integrity and Preservation
- System and Device Analysis Overview
- Evidence Acquisition from Systems and Devices
- File System Forensics
- Windows Registry Analysis
- Artifact Analysis
- Mobile Device Forensics
- Data Recovery and Carving
- Timeline Analysis
- Reporting and Documentation
- Event Log Fundamentals
- Event Log Structure
- Event Log Analysis Tools
- Correlating Events
- Artifact Interpretation
- File System Fundamentals
- File Metadata Analysis
- File Signature Identification
- Program Execution Artifacts
- Malware Persistence Mechanisms
- Application Analysis
- Browser Artifacts
- Email and Messaging Artifacts
- Log Analysis
- Memory Artifacts
- User Artifact Identification
- User Profile Analysis
- Registry Artifacts for User Activity
- File System Artifacts
- Browser Artifacts
- Email and Communication Artifacts
- Cloud Storage and Sync Artifacts
- User Activity Timeline Construction
- Artifact Preservation and Documentation
- Cloud Storage Artifact Identification
- Cloud Storage Data Acquisition
- Cloud Storage Metadata Analysis
- Cloud Storage Synchronization Logs
- Cloud Storage Cache and Local Artifacts
- Cloud Storage Account and User Attribution
- Cloud Storage Timeline Reconstruction
- Email Header Analysis
- Email Authentication Mechanisms
- Email Artifact Locations
- Email Metadata Extraction
- Email Content and Attachment Analysis
- Email Reconstruction and Recovery
- Cloud Email Investigation
- Email Correlation and Timeline Analysis
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GCFE, so none is invented.