GIAC · Official Blueprint · Last reviewed May 2026
The official GIAC GCFA exam covers 8 domains. The vendor does not publish percentage weights for these domains — treat each as an equal part of the exam blueprint.
Covers the topics, concepts, and applied skills examined under the Introduction to File System Timeline Forensics domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Practice Introduction to File System Timeline Forensics questionsCovers the topics, concepts, and applied skills examined under the NTFS Artifact Analysis domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Practice NTFS Artifact Analysis questionsCovers the topics, concepts, and applied skills examined under the File System Timeline Artifact Analysis domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Practice File System Timeline Artifact Analysis questionsCovers the topics, concepts, and applied skills examined under the Identification of Malicious and Normal Activity domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Practice Identification of Malicious and Normal Activity questionsCovers the topics, concepts, and applied skills examined under the Introduction to Memory Forensics domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Practice Introduction to Memory Forensics questionsCovers the topics, concepts, and applied skills examined under the Analyzing Volatile and Windows Event Artifacts domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Practice Analyzing Volatile and Windows Event Artifacts questionsCovers the topics, concepts, and applied skills examined under the Enterprise Environment Incident Response domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Practice Enterprise Environment Incident Response questionsCovers the topics, concepts, and applied skills examined under the Windows Artifact Analysis domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Practice Windows Artifact Analysis questionsThe vendor does not currently publish percentage weights for these domains, so Courseiva does not rank them by weight.
Work through each domain systematically — cover fundamentals first, then applied and scenario-based topics.
Never skip a domain regardless of perceived importance. Full coverage is required to pass.
Use Courseiva domain analytics to track your accuracy per domain and route extra questions to your weak areas.
Courseiva tracks your accuracy per domain automatically and routes you toward your weakest areas — no manual configuration needed.