Skip to content
CertGPS
Comparison

GCFE or GNFA: Choosing Between Windows Forensics and Network Forensics

GCFE tests Windows host forensics and GNFA tests what logs, NetFlow and packets can prove. How the two GIAC exams differ, who each suits and which to take first.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

GCFE or GNFA: Choosing Between Windows Forensics and Network Forensics

If the evidence you're usually handed is a Windows laptop, take GCFE. If it's a proxy log, a NetFlow export or a packet capture, take GNFA. Both are GIAC exams tied to a six-day SANS course at the same price, so cost doesn't separate them. Where your cases start does, and for most people moving into forensics that's the host.

The two exams side by side

GCFEGNFA
Issuer and courseGIAC; SANS FOR500, Windows Forensic AnalysisGIAC; SANS FOR572, Advanced Network Forensics
FormatProctored, open book (printed material only), ending in CyberLive hands-on tasks in a virtual machineProctored, open book (printed material only), ending in CyberLive hands-on tasks in a virtual machine
Questions and time82 questions, 3 hours66 questions, 3 hours
Passing score70% (versions released from December 17, 2022)70% (versions released from December 24, 2016)
Price$999 per attempt; $899 retake$999 per attempt; $899 retake
SANS course levelEssentialAdvanced
PrerequisitesNone listedNone listed; SANS expects working knowledge of forensic methods, networking and Linux tools
RenewalEvery four years: 36 CPEs or a retake, plus $499Every four years: 36 CPEs or a retake, plus $499

Whose cases each one fits

GCFE is built around a question about a person: what did this user do on this machine? Its objectives cover the registry, evidence of program execution, browser databases, email (webmail and Microsoft 365 included), cloud storage clients, event logs and USB devices. That's the material of internal investigations, such as an employee suspected of taking intellectual property, a fraud inquiry or an e-discovery request. GIAC names incident responders, law enforcement officers, federal agents and detectives in its audience. SANS rates FOR500 at its "Essential" level with no prerequisite courses, so an analyst or administrator new to forensics can start there.

GNFA asks what crossed the network and what that says about an intrusion. GIAC describes holders as able to analyze application activity "through system logs, network traffic captures, and network metadata". The listed audience overlaps with GCFE's (incident responders, threat hunters, SOC staff, network defenders), but the exam suits someone whose host evidence has run out: the endpoint was reimaged, the attacker used a device nobody can image, or the open question is what data left. SANS puts FOR572 at its advanced level and expects students to arrive with forensic method, networking from the physical layer up, and Linux command-line skill.

A corporate investigator or police examiner should start with GCFE, then. A responder on a team that already covers host forensics, and that collects flow data and proxy logs, will get more from GNFA.

What each exam rewards

Both exams allow printed books and notes and finish with CyberLive tasks, where you work in a virtual machine with real tools. GIAC does not publish a separate hands-on passing threshold on these pages, nor the number of hands-on items nor domain weights for either exam.

GCFE rewards a well-built index and hours spent on Windows artifacts. Questions turn on where a trace lives (a registry key, a browser SQLite table, a jump list) and what it proves about the user. There's no memory forensics objective and no intrusion scenario, and SANS says FOR500 leaves out chain of custody and introductory drive acquisition. The exam is narrower than the job title "forensic examiner" suggests.

GNFA reaches further than its title. Its eight objectives run from network architecture and open-source proxies through NetFlow, security event logging, wireless analysis, encryption and protocol reverse engineering. Two of the three evidence types in GIAC's description aren't packets, so a Wireshark specialist who has never queried proxy logs or NetFlow at scale will find gaps. FOR572 teaches on open-source tools, SOF-ELK and Arkime among them, which you can run at home before the exam and keep using after it. GNFA also has 16 fewer questions in the same three hours: about 2.7 minutes per item, against 2.2 on GCFE, but that average is not a time allocation for the practical tasks.

Holding both, and in which order

The outlines barely overlap, which is the case for holding both in a small team where one person handles every kind of evidence. The SANS pages point to the order. FOR500 lists FOR572 among its follow-on courses, and FOR572 expects forensic experience and shares lab scenarios with FOR508. Host first, network second, with GCFA (the FOR508 exam) often in between for responders who work intrusions.

Paying for both is the obstacle. GIAC charges $999 for each attempt and SANS lists each course at $8,780. Upkeep is kinder. Under GIAC's CPE rules a new GIAC certification can count toward renewing up to five others, for up to 36 CPEs, and a second renewal within two years of a full-price one costs $249 instead of $499.

Neither exam counts toward the one-year CISSP experience waiver. ISC2's approved list includes four GIAC credentials, and neither forensics exam is one of them. On the host side, GIAC's Experienced Forensics Examiner (GX-FE), 25 CyberLive tasks in four hours, costs $499 with an active GCFE and $1,299 without; GNFA earns no such discount. Our forensics investigator career track covers the stages around these exams, and the incident response certification guide covers the responder side.

Our view

Take GCFE first unless your job already hands you network evidence every week. SANS rates its course as the easier entry point, it maps to the investigations most organizations actually run, and it builds the artifact knowledge that GCFA and GX-FE assume. GNFA is the stronger second credential for a responder, because working an incident from NetFlow and proxy logs alone is a less common skill and the exam tests exactly that. Someone in a SOC that never images laptops could fairly argue for GNFA first. If you're paying yourself, buy one course, then see which kind of evidence your cases produce over the following year before buying the second.

Sources