GIAC Certified Forensic Analyst (GCFA) Courses

Validates knowledge of digital forensics and incident response, including memory forensics, timelines, Windows artifacts and enterprise investigations.

A good GCFA course teaches memory forensics, timelines and enterprise incident response with real labs, because the exam includes CyberLive tasks in live virtual machines. We compared the main options on lab depth, coverage, price and how current they are.

Take SANS FOR508 if your employer funds it; its labs match the CyberLive questions on the exam. Add The Art of Memory Forensics for deep background, and choose Michael Leclair's two-hour course as a cheap warm-up if memory analysis is new to you.

Course	Best for	Format	Price
SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics	Employer-funded course	Live online	$8,780
The Art of Memory Forensics	Memory forensics reference	Book	$58
SDF: Memory Forensics 1	Quick memory warm-up	Video	$50

Employer-funded course

SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

A six-day course, or 36 hours self-paced, on memory forensics, timelines and enterprise incident response, with 35 labs and an APT capstone. It is GIAC's affiliated course for GCFA and earns 36 CPEs.

Great fit if your employer funds training and you want the labs the CyberLive questions follow

Poor fit if you have no Windows forensics background yet; start with FOR500 or equivalent experience

Memory forensics reference

The Art of Memory Forensics

4.7(225 ratings)

The standard reference on memory analysis for Windows, Linux and Mac, written by the Volatility developers. It gives deep background on memory forensics only, so it supports a course rather than replacing one.

Great fit if you want deep background for the memory forensics objectives

Poor fit if you want a full GCFA study guide; choose FOR508

Quick memory warm-up

SDF: Memory Forensics 1

4.5(607 ratings)

A two-hour Udemy video course that introduces memory forensics and Volatility triage. It is quick to finish and works as a warm-up before the memory sections of FOR508.

Great fit if you are new to memory analysis and want a warm-up before FOR508

Poor fit if you need file system, timeline or enterprise response coverage; choose FOR508

How to choose a GCFA course

Look for labs that match CyberLive. GCFA includes CyberLive tasks in live virtual machines that need specific tool options. FOR508's 35 labs are the closest listed practice.
Build your index while you study. The exam is open book for printed books and notes, but not for electronic files. Use your course material to build an index you can search fast.
Plan the cost. FOR508 costs $8,780 and a GCFA attempt adds $999, so most people need an employer to fund it. You can buy an attempt without the course.
Have the Windows forensics background. SANS recommends a background equal to its FOR500 course before FOR508, which does not teach forensics fundamentals.

Recommended GCFA course combinations

Employer pays: FOR508 ($8,780) with the two GIAC practice tests that come with a SANS course bundle.
Self-funded: The Art of Memory Forensics ($58) for memory analysis, your own lab practice, and GIAC's GCFA practice test ($399) to check your index.
New to memory analysis: Michael Leclair's two-hour course ($50) as a warm-up, then The Art of Memory Forensics ($58) for depth.
Already do incident response: FOR508 OnDemand (4 months of access) with GIAC's practice test ($399) as a final check.

Compare all GCFA practice tests →

GCFA course FAQ

What is the best GCFA course?

SANS FOR508, if your employer funds it. It is GIAC's affiliated course, and its labs match the CyberLive questions. Add The Art of Memory Forensics for memory depth.

Can I pass GCFA with free courses?

No free full course exists in this list. You can buy a GCFA attempt without any course, but FOR508 is the closest preparation for the exam.

How long does a GCFA course take?

FOR508 runs six days live or 36 hours self-paced with four months of access. Plan for about 90 hours of preparation in total.

Do I need FOR500 before FOR508?

No. SANS recommends a Windows forensics background equal to FOR500 before FOR508, but nothing is required.