GCFE: GIAC Certified Forensic Examiner

The GCFE focuses on the core analysis of Windows systems, validating the ability to conduct typical incident investigations. It covers e-discovery and user activity analysis, teaching examiners how to track browser history, USB device usage, email logs, and Windows Registry artifacts. Unlike the GCFA which focuses on hunting hackers, the GCFE is often focused on internal investigations, HR issues, and standard legal discovery. It ensures the examiner understands exactly how Windows stores evidence of user behavior. It is often the first step in the GIAC forensics track before moving to the more advanced GCFA.