GCFA: GIAC Certified Forensic Analyst

The GCFA is an advanced incident response and forensics certification that moves beyond basic file recovery to advanced threat hunting. It focuses on digital forensics, incident response, and memory forensics (Windows/Linux) to track and analyze Advanced Persistent Threats (APTs) in enterprise networks. The curriculum teaches how to use timeline analysis and volatile memory artifacts to identify "living off the land" attacks where no malware files are dropped on the disk. It is essential for senior incident responders who need to determine *how* an attacker moved through a network and *what* they stole. The open-book format allows for deep technical questions that test application of knowledge rather than memorization.