- Incident response steps, attack progression and adversary basics
- Scaling triage and analysis across a large environment
GIAC Certification Training Course
GIAC Certified Forensic Analyst (GCFA) Certification Training Course
Prepare for the GIAC Certified Forensic Analyst (GCFA) exam with on-demand, self-paced work in memory forensics, timelines and Windows artifacts, the skills you need to scope and investigate an intrusion across an enterprise.
Course focus: Enterprise incident response, memory forensics, normal versus malicious system activity, file system timelines, NTFS and Windows artifact analysis and anti-forensics detection, aligned with GIAC's published GCFA objectives.
Course Overview
What the GCFA course covers and who it's for.
Accumentum's GCFA prep course is for incident responders, threat hunters, SOC analysts and digital forensic analysts who already know the basics and need to go deeper. GIAC says GCFA validates core forensic skills to collect and analyze data in computer systems and to conduct formal incident investigations.
The course follows GIAC's published GCFA objectives. You'll cover the enterprise incident response process, memory collection and analysis, normal and malicious system activity, file system timelines, NTFS internals and Windows artifacts. GCFA includes CyberLive hands-on questions, so most of the course is spent working real evidence.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Course Objectives
Get ready for GCFA the way the exam actually tests.
01
Cover Every GCFA Objective
Work through each certification objective GIAC publishes for GCFA, in an order that builds on itself.
02
Practice Hands-On
GCFA includes CyberLive questions that run in real virtual machines, so labs are part of every module.
03
Build an Open-Book Index
GIAC exams are open book. We help you build and test the index you'll bring into the exam.
04
Know the Exam Before You Sit It
GCFA is 82 questions in 3 hours with a minimum passing score of 71%, per GIAC. We pace practice to match.
Who Should Attend
- Incident response team members and threat hunters.
- SOC analysts moving into investigation work.
- Experienced digital forensic analysts and CHFI holders who want an advanced credential.
- Federal agents, law enforcement and red team members who want to understand what defenders find.
Prerequisites
- There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCFA.
- This is an advanced course. You should be comfortable with Windows internals and the command line, and have some incident response or forensics experience. GCIH, GCFE or CHFI level knowledge helps.
Pathway Map
The GCFA course in 8 modules.
Each module maps to one or more of GIAC's published GCFA certification objectives.
Course Content
- When and how to collect volatile data
- Documenting and preserving memory evidence
- Network connections, command line artifacts, processes, handles and threads
- Malicious processes and suspicious drivers
- Code injection and rootkits
- Separating normal from abnormal activity on disk and in memory
- Indicators of compromise, attacker tools and anti-forensics
- Collecting and processing Windows timeline data
- How system and user activity changes timestamps
- Data, metadata and filename layers
- Recovering and analyzing evidence at each layer
- Backup and restore data
- Evidence of program execution
Course Features
Built for the hands-on side of GCFA.
On-Demand Format
Self-paced video lessons you can start, pause and replay whenever it fits your schedule.
Hands-On Labs
Lab work in every module so the CyberLive portion of GCFA isn't the first time you've touched the tools.
Objective Mapping
Every lesson is tied to a published GCFA certification objective.
Exam Strategy
Time management, open-book indexing and practice under exam conditions.
Certification Exam
About the GIAC GCFA exam.
GCFA Exam Readiness
Every objective GIAC publishes for GCFA has a lesson and a lab in our course, so you know exactly what you've covered before you book.
Per GIAC, the GCFA exam is one proctored exam with 82 questions, a 3 hours time limit and a minimum passing score of 71%. It's web based and proctored online through ProctorU or onsite at Pearson VUE.
GIAC can update exam specs, so confirm the details for your attempt in your GIAC account. Full details are on GIAC's GCFA page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Certification Objectives
The full GIAC GCFA objective list.
GIAC publishes 10 certification objectives for GCFA. Each one below uses GIAC's own wording, and our course maps a lesson or lab to every one of them.
Analyzing Volatile Malicious Event Artifacts
The candidate will demonstrate an understanding of abnormal activity within the structure of Windows memory and be able to identify artifacts such as malicious processes, suspicious drivers and malware techniques such as code injection and rootkits.
Analyzing Volatile Windows Event Artifacts
The candidate will demonstrate an understanding of normal activity within the structure of Windows memory and be able to identify artifacts such as network connections, memory resident command line artifacts and processes, handles and threads.
Enterprise Environment Incident Response
The candidate will demonstrate an understanding of the steps of the incident response process, attack progression, and adversary fundamentals and how to rapidly assess and analyze systems in an enterprise environment scaling tools to meet the demands of large
File System Timeline Artifact Analysis
The candidate will demonstrate an understanding of the Windows filesystem time structure and how these artifacts are modified by system and user activity.
Identification of Malicious System and User Activity
The candidate will demonstrate an understanding of the techniques required to identify and document indicators of compromise on a system, detect malware and attacker tools, attribute activity to events and accounts, and identify and compensate for anti-forensi
Identification of Normal System and User Activity
The candidate will demonstrate an understanding of the techniques required to identify, document, and differentiate normal and abnormal system and user activity using memory and disk resident artifacts.
Introduction to File System Timeline Forensics
The candidate will demonstrate an understanding of the methodology required to collect and process timeline data from a Windows system.
Introduction to Memory Forensics
The candidate will demonstrate an understanding of how and when to collect volatile data from a system and how to document and preserve the integrity of volatile evidence.
NTFS Artifact Analysis
The candidate will demonstrate an understanding of core structures of the Windows filesystems, and the ability to identify, recover, and analyze evidence from any file system layer, including the data storage layer, metadata layer, and filename layer.
Windows Artifact Analysis
The candidate will demonstrate an understanding of Windows system artifacts and how to collect and analyze data such as system back up and restore data and evidence of application execution.
Study Plan
How we suggest you work through GIAC GCFA.
GIAC lists the GCFA objectives alphabetically, not in study order. We teach them in an order that builds, starting with the fundamentals and working up to the topics that lean on them, and every block ends with labs before you move on.
Save a review week for the two or three objectives you found hardest. For many students that is Identification of Normal System and User Activity or Windows Artifact Analysis, but your lab results will tell you.
If you are new to GCFA topics, plan on steady weekly study over a couple of months. If you already do this work every day, you may move faster. Either way, the objective list is the checklist we hold you to.
Areas and Audience
Where GIAC GCFA fits.
Areas GIAC says this certification covers
- Advanced incident response and digital forensics
- Memory forensics, timeline analysis, and anti-forensics detection
- Threat hunting and APT intrusion incident response
Who GIAC says it is for
- Incident Response Team members
- Threat hunters
- SOC analysts
- Experienced digital forensic analysts
- Information security professionals
- Federal agents and law enforcement professionals
- Red Team members, penetration testers, and exploit developers
Exam Format
How the GIAC GCFA exam works.
The GIAC GCFA exam is one proctored exam with 82 questions and a 3 hours time limit. GIAC sets the minimum passing score at 71%.
GIAC lets you sit the exam online through ProctorU or at a Pearson VUE testing center.
GCFA includes CyberLive hands-on questions, which GIAC describes as performance based challenges in realistic lab environments. That is why our course leans so hard on labs.
We tell students to finish the objective list first, then use a timed practice run to find gaps and close them before test day.
Career Outlook
Where GIAC GCFA can take you.
GCFA is a senior forensics and incident response credential. It fits IR team members, threat hunters and forensic analysts who work enterprise intrusions, memory images and timelines when an advanced attacker is involved.
Per the U.S. Bureau of Labor Statistics, information security analysts earned a median annual wage of $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. A median is the midpoint, so half earned more and half earned less, and your own pay will depend on location, experience and employer. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for GIAC GCFA training.
GIAC GCFA is Air Force COOL Approved. See how Air Force COOL works with us.
Paying on your own? GIAC GCFA prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page covers every other way to pay, and you can always talk with us before you enroll.
Frequently Asked Questions
Common questions about Accumentum's GCFA prep course.
GIAC Certified Forensic Analyst (GCFA) is a practitioner certification from GIAC. Per GIAC, the exam is 82 questions, 3 hours, with a minimum passing score of 71%, and it's proctored online through ProctorU or at a Pearson VUE center.
Ask us when you request a quote. GIAC sells certification attempts and practice tests directly, and we'll walk you through what you need to buy from GIAC and when.
GIAC GCFA is Air Force COOL Approved. Contact us about funding options.
There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GCFA. This is an advanced course. You should be comfortable with Windows internals and the command line, and have some incident response or forensics experience. GCIH, GCFE or CHFI level knowledge helps.
Yes. GCFA includes CyberLive hands-on questions, so every module has labs with the same kinds of tools you'll use on the job.
On-demand and self-paced. You get video lessons, hands-on labs and practice questions, and you work through them on your own schedule.
Use the registration page linked below, or email info@accumentum.net and an advisor will follow up with access details and next steps.
GIAC sets the minimum passing score for GCFA at 71%.
The exam has 82 questions and a 3 hours time limit.
GIAC publishes 10 certification objectives for GCFA, and our course covers all of them.
GIAC names these audiences for GCFA:
- Incident Response Team members
- Threat hunters
- SOC analysts
- Experienced digital forensic analysts
- Information security professionals
- Federal agents and law enforcement professionals
- Red Team members, penetration testers, and exploit developers
Yes. GIAC offers remote proctoring through ProctorU, and you can also test in person at a Pearson VUE center.
Yes. GIAC sells official practice tests. GIAC notes the practice question bank is limited, so the same question can show up on more than one test.
Yes. GIAC GCFA prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee. 9, 12 and 18 month terms add 5%, 10% and 15%.
Enrollment
Enroll in GCFA training with Accumentum.
Enroll in Accumentum's GCFA prep course to get ready for the GIAC Certified Forensic Analyst (GCFA) exam with on-demand lessons and hands-on labs.
For access details and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on GCFA?
Start on your own schedule and work toward the test date you pick.