GIAC · 2026 Edition
A complete preparation guide, edited by Johnson Ajibi, a network and security engineer with 12+ years' experience. Covers the exam format,all 8 blueprint domains, a week-by-week study plan, and proven tips for passing first time.
2–4 months
Prep time
Intermediate
Difficulty
60–90
Exam questions
700/1000
Pass mark
Exam code
GCFA
Full name
GIAC Certified Forensic Analyst
Vendor
GIAC
Duration
90 minutes
Questions
~0 items
Passing score
700/1000 (scaled)
Domains covered
8 blueprint domains
Recommended experience
Foundational IT knowledge recommended
Typical prep time
2–4 months
Domain percentage weights are not currently available for this exam. The checklist below is still useful for planning your study.
Phase 1
Introduction to File System Timeline Forensics
Tip: Start with the official Introduction to File System Timeline Forensics objectives, then practise questions on it.
Phase 2
NTFS Artifact Analysis
Tip: Cover the NTFS Artifact Analysis objectives, then answer practice questions to confirm you can apply them.
Phase 3
File System Timeline Artifact Analysis
Tip: Cover the File System Timeline Artifact Analysis objectives, then answer practice questions to confirm you can apply them.
Phase 4
Identification of Malicious and Normal Activity
Tip: Cover the Identification of Malicious and Normal Activity objectives, then answer practice questions to confirm you can apply them.
Phase 5
Introduction to Memory Forensics
Tip: Cover the Introduction to Memory Forensics objectives, then answer practice questions to confirm you can apply them.
Phase 6
Analyzing Volatile and Windows Event Artifacts
Tip: Cover the Analyzing Volatile and Windows Event Artifacts objectives, then answer practice questions to confirm you can apply them.
Phase 7
Enterprise Environment Incident Response
Tip: Cover the Enterprise Environment Incident Response objectives, then answer practice questions to confirm you can apply them.
Phase 8
Windows Artifact Analysis
Tip: Finish with Windows Artifact Analysis, then re-test your weakest earlier domain before a mock exam.
Study the official exam blueprint — weight percentages tell you exactly where to invest prep time.
Practise scenario-based questions regularly — every modern cert exam is scenario-heavy.
Use spaced repetition to retain what you've learned (Courseiva does this automatically).
Book your exam date once you're scoring 80%+ consistently on practice tests.
Review explanations for every wrong answer, not just the question — the 'why' is what makes it stick.
Apply everything in this guide with adaptive practice questions, detailed answer explanations, and domain analytics.