- Incident response steps, attack progression and adversary basics
- Scaling triage and analysis across a large environment
GIAC Certification Training Course
GIAC Certified Forensic Analyst (GCFA) Certification Training Course
Prepare for the GIAC Certified Forensic Analyst (GCFA) exam with on-demand, self-paced work in memory forensics, timelines and Windows artifacts, the skills you need to scope and investigate an intrusion across an enterprise.
Course focus: Enterprise incident response, memory forensics, normal versus malicious system activity, file system timelines, NTFS and Windows artifact analysis and anti-forensics detection, aligned with GIAC's published GCFA objectives.
Course Overview
What the GCFA course covers and who it's for.
Accumentum's GCFA prep course is for incident responders, threat hunters, SOC analysts and digital forensic analysts who already know the basics and need to go deeper. GIAC says GCFA validates core forensic skills to collect and analyze data in computer systems and to conduct formal incident investigations.
The course follows GIAC's published GCFA objectives. You'll cover the enterprise incident response process, memory collection and analysis, normal and malicious system activity, file system timelines, NTFS internals and Windows artifacts. GCFA includes CyberLive hands-on questions, so most of the course is spent working real evidence.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC or the SANS Institute. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Course Objectives
Get ready for GCFA the way the exam actually tests.
01
Cover Every GCFA Objective
Work through each certification objective GIAC publishes for GCFA, in an order that builds on itself.
02
Practice Hands-On
GCFA includes CyberLive questions that run in real virtual machines, so labs are part of every module.
03
Build an Open-Book Index
GIAC exams are open book. We help you build and test the index you'll bring into the exam.
04
Know the Exam Before You Sit It
GCFA is 82 questions in 3 hours with a minimum passing score of 71%, per GIAC. We pace practice to match.
Who Should Attend
- Incident response team members and threat hunters.
- SOC analysts moving into investigation work.
- Experienced digital forensic analysts and CHFI holders who want an advanced credential.
- Federal agents, law enforcement and red team members who want to understand what defenders find.
Prerequisites
- There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCFA.
- This is an advanced course. You should be comfortable with Windows internals and the command line, and have some incident response or forensics experience. GCIH, GCFE or CHFI level knowledge helps.
Pathway Map
The GCFA course in 8 modules.
Each module maps to one or more of GIAC's published GCFA certification objectives.
Course Content
- When and how to collect volatile data
- Documenting and preserving memory evidence
- Network connections, command line artifacts, processes, handles and threads
- Malicious processes and suspicious drivers
- Code injection and rootkits
- Separating normal from abnormal activity on disk and in memory
- Indicators of compromise, attacker tools and anti-forensics
- Collecting and processing Windows timeline data
- How system and user activity changes timestamps
- Data, metadata and filename layers
- Recovering and analyzing evidence at each layer
- Backup and restore data
- Evidence of program execution
Course Features
Built for the hands-on side of GCFA.
On-Demand Format
Self-paced video lessons you can start, pause and replay whenever it fits your schedule.
Hands-On Labs
Lab work in every module so the CyberLive portion of GCFA isn't the first time you've touched the tools.
Objective Mapping
Every lesson is tied to a published GCFA certification objective.
Exam Strategy
Time management, open-book indexing and practice under exam conditions.
Certification Exam
About the GIAC GCFA exam.
GCFA Exam Readiness
Our students pass at a 98.8% rate across Accumentum courses. We'll get you ready for GCFA the same way.
Per GIAC, the GCFA exam is one proctored exam with 82 questions, a 3 hours time limit and a minimum passing score of 71%. It's web based and proctored online through ProctorU or onsite at Pearson VUE.
GIAC can update exam specs, so confirm the details for your attempt in your GIAC account. Full details are on GIAC's GCFA page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC or the SANS Institute. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Frequently Asked Questions
Common questions about Accumentum's GCFA prep course.
GIAC Certified Forensic Analyst (GCFA) is a practitioner certification from GIAC. Per GIAC, the exam is 82 questions, 3 hours, with a minimum passing score of 71%, and it's proctored online through ProctorU or at a Pearson VUE center.
No. SANS course names and materials belong to the SANS Institute and only SANS teaches them. This is Accumentum's own on-demand prep for the GIAC exam, built from GIAC's published certification objectives.
Ask us when you request a quote. GIAC sells certification attempts and practice tests directly, and we'll walk you through what you need to buy from GIAC and when.
GIAC GCFA is listed on Air Force COOL. Contact us about funding options.
There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCFA. This is an advanced course. You should be comfortable with Windows internals and the command line, and have some incident response or forensics experience. GCIH, GCFE or CHFI level knowledge helps.
Yes. GCFA includes CyberLive hands-on questions, so every module has labs with the same kinds of tools you'll use on the job.
On-demand and self-paced. You get video lessons, hands-on labs and practice questions, and you work through them on your own schedule.
Use the registration page linked below, or email info@accumentum.net and an advisor will follow up with access details and next steps.
Enrollment
Enroll in GCFA training with Accumentum.
Enroll in Accumentum's GCFA prep course to get ready for the GIAC Certified Forensic Analyst (GCFA) exam with on-demand lessons and hands-on labs.
For access details and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on GCFA?
Start on your own schedule and work toward the test date you pick.