Digital Forensics Programs & Certifications
Every serious route into digital forensics, with the cost, the prerequisites, the strengths and the limitations of each — including the ones that compete with us.
The short answer
There is no single best way to learn digital forensics. If an employer will pay, SANS and GIAC certifications are the most recognised and by far the most expensive. If you are paying yourself, IACIS CFCE and ISFCE CCE cost a fraction and test graded practical work. If a job posting requires a degree, a public-university online master's costs less than either. Lawyers need the evidence rules and CLE, not tool training.
61 entries across 7 categories, each with a sourced cost and a stated date. 11 are free or low-cost, and several of those cost nothing at all.
Who wrote this, and what we sell
Legal Cyber Academy publishes this directory and sells online courses, so 5 of the 61 entries below are our own and are marked Our own coursewherever they appear. We have not softened a competitor’s strengths or inflated ours. Where SANS, IACIS or a free lab platform is the better answer for a given reader, the entry says so — and our own entries state plainly that they will not make anyone a practising examiner.
Filter the directory
By category
- Certification19
- Degree & academic14
- Bootcamp & intensive5
- Vendor & tool training5
- Free & low-cost11
- CLE & legal training2
- Legal Cyber Academy5
By reader
- Students19
- Working practitioners44
- Lawyers & in-house counsel13
- Law enforcement & investigators19
- Career changers19
Showing 61 of 61 entries
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.
Certification (19)
Independent credentials with a published exam. These are what hiring managers and opposing counsel actually recognise, and what an expert gets asked about on cross-examination. They prove you passed an assessment on a date — not that you can run an examination end to end.
| Program | Provider | Cost (as published) | Format & length | Prerequisites |
|---|---|---|---|---|
| GCFA — GIAC Certified Forensic Analyst | GIAC (Global Information Assurance Certification) | $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR508 course is listed separately at $8,780; SANS bundles an attempt with a course purchase but does not publish the bundled add-on price as static text.As published 2026-09-12 · source for GCFA — GIAC Certified Forensic Analyst cost | One proctored exam, remote or at a test centre. 82 questions, 3 hours, 71% to pass, delivered in GIAC's CyberLive format — performance-based tasks in a live lab environment rather than only multiple choice.Exam only; the attempt must be completed within 120 days of activation. The paired FOR508 course is six days instructor-led or about 36 hours self-paced. | None published. GIAC's page describes practical experience as helpful for mastering the material, not as an entry requirement. |
| GCFE — GIAC Certified Forensic Examiner | GIAC (Global Information Assurance Certification) | $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR500 course is listed separately at $8,780.As published 2026-09-12 · source for GCFE — GIAC Certified Forensic Examiner cost | One proctored exam, remote or at a test centre. 82 questions, 3 hours, 70% to pass. GIAC's GCFE page does not describe this exam as using the CyberLive performance format.Exam only. The paired FOR500 course is six days instructor-led or about 36 hours self-paced, with four months of OnDemand access. | None published. GIAC describes the audience as anyone with a background in information systems, information security and computers. |
| GNFA — GIAC Network Forensic Analyst | GIAC (Global Information Assurance Certification) | $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR572 course is priced on its SANS course page; we could not resolve that page at the time of writing, so treat the course figure as unconfirmed and check SANS directly.As published 2026-09-12 · source for GNFA — GIAC Network Forensic Analyst cost | One web-based proctored exam, remotely proctored or at a Pearson VUE centre. 66 questions, 3 hours, 70% to pass.Exam only. The paired FOR572 course is a six-day SANS course. | None published. |
| GREM — GIAC Reverse Engineering Malware | GIAC (Global Information Assurance Certification) | $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR610 course is listed separately at $8,780.As published 2026-09-12 · source for GREM — GIAC Reverse Engineering Malware cost | One proctored exam. 66 questions, 3 hours, 73% to pass. GIAC classifies it as a practitioner certification using CyberLive, which its page describes as replacing traditional multiple-choice testing with performance-based challenges.Exam only. The paired FOR610 course is six days instructor-led or about 36 hours self-paced. | None published, but the material assumes comfort with assembly, debuggers and Windows internals — this is not an entry-level certification in practice. |
| GCTI — GIAC Cyber Threat Intelligence | GIAC (Global Information Assurance Certification) | $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR578 course is listed separately at $8,780.As published 2026-09-12 · source for GCTI — GIAC Cyber Threat Intelligence cost | One proctored exam. 82 questions, 3 hours, 71% to pass, in GIAC's CyberLive performance-based format.Exam only. The paired FOR578 course is six days instructor-led or about 36 hours self-paced. | None published. |
| GCFR — GIAC Cloud Forensics Responder | GIAC (Global Information Assurance Certification) | $999 for the certification attempt on its own ($899 for a retake), per GIAC's general pricing table. The paired SANS enterprise cloud forensics course is priced separately on its SANS page.As published 2026-09-12 · source for GCFR — GIAC Cloud Forensics Responder cost | One proctored exam. 82 questions, 3 hours. GIAC's page states a 64% passing score for exams released on or after 25 July 2026 — a date-scoped figure, so confirm the mark that applies to your attempt.Exam only. The associated SANS course is titled around enterprise cloud forensics and incident response; we could not confirm its FOR course number from the GIAC page, so treat the course code as unconfirmed. | None formal. GIAC notes that practical work experience helps ensure mastery, and lists incident responders, SOC analysts, threat hunters and forensic analysts as the target roles. |
| CFCE — Certified Forensic Computer Examiner | IACIS (International Association of Computer Investigative Specialists) | $800 for the external CFCE certification process, with IACIS membership waived on purchase. Recertification after expiry is $350. The 72 training hours you must show first are a separate cost — IACIS's own BCFE course was listed at €4,800 for the October 2026 Budapest delivery.As published 2026-09-12 · source for CFCE — Certified Forensic Computer Examiner cost | Phase 1 peer review: four scenario-based practical problems, 30 days each, with an assigned coach; all four must pass. Phase 2 certification: a graded hard-drive practical over 30 days plus a written exam over 14 days, 80% minimum on both.Roughly a year in practice — four 30-day peer-review problems followed by the certification phase, which runs on IACIS's annual calendar. | Proof of 72 hours of training aligned to the CFCE core competencies. Non-law-enforcement candidates are eligible through the external track and Associate membership, which requires a background check. |
| CAWFE — Certified Advanced Windows Forensic Examiner | IACIS | Set as a member or non-member certification fee by IACIS; the figure is not published as static text on the CAWFE page, so treat the certification fee as unconfirmed. The associated AWFE course was listed at $995 for the 36-hour online delivery.As published 2026-09-12 · source for CAWFE — Certified Advanced Windows Forensic Examiner cost | Phase 1 written exam: 125 questions, up to 8 hours, open-book and not proctored, 80% minimum. Phase 2 practical: 30 days of Windows artefact analysis.Runs on an annual cycle — the written phase by 30 November and the practical by 31 December of the same year. | IACIS membership in good standing, or payment of the non-member fee. The CFCE is not a hard prerequisite. |
| ICMDE — IACIS Certified Mobile Device Examiner | IACIS | The certification fee is not published as static text on the ICMDE page; treat it as unconfirmed and ask IACIS. The supporting MDF and AMDF courses were each listed at $995 for the 36-hour online delivery.As published 2026-09-12 · source for ICMDE — IACIS Certified Mobile Device Examiner cost | A written exam (true/false, multiple choice, matching and short answer) inside a single 48-hour window once started, plus a 48-hour hands-on practical. 80% minimum on both.Two 48-hour assessment windows, taken on IACIS's certification calendar. | IACIS membership. The MDF and AMDF courses are the usual preparation. |
| CCE — Certified Computer Examiner | ISFCE (International Society of Forensic Computer Examiners) | $495 for the CCE examination, $250 for the two-year recertification, $150 for a retake. The required CCE training course is a separate $4,995 (listed at $3,996 with a published discount code), or $3,995 for the bootcamp. Law-enforcement, government and military discounts of 5-25% are noted.As published 2026-09-12 · source for CCE — Certified Computer Examiner cost | An online knowledge assessment plus practical examinations — forensically examining three distinct media sources and producing a comprehensive, detailed report for each. Candidates sign a code of ethics and submit a notarised statement of independent work; collaboration and plagiarism are expressly forbidden.Self-paced through the practicals; the training course that precedes it is a multi-day program or bootcamp. | Completion of the ISFCE CCE training course or an authorised training centre equivalent, or substitution of another recognised digital-forensics credential with documented experience. Full Member status additionally requires at least eighteen months of verifiable professional examination experience; candidates without it are awarded Associate status. |
| EnCE — EnCase Certified Examiner | OpenText (formerly Guidance Software) | $500 per exam attempt. OpenText states that its Learning Subscriptions do not include the exam fee, and the price of the required authorised courses was not published on the pages we could read — treat course cost as unconfirmed.As published 2026-09-12 · source for EnCE — EnCase Certified Examiner cost | Phase I written: 2 hours, true/false and multiple choice, administered through Certiverse, 80% minimum. Phase II practical: available for 60 days after passing Phase I, 18 questions, all must be answered, 85% minimum.Phase I is a two-hour sitting; Phase II runs inside a 60-day window after it. | Either 64 continuing professional education hours of authorised computer forensic instruction, or 12 months of work experience. |
| ACE — AccessData Certified Examiner (status uncertain) | Exterro (formerly AccessData) | No current price could be found. The former AccessData certification URL now redirects to Exterro's homepage rather than to any certification page, and Exterro's sitemap contains no certification URLs.As published 2026-09-12 · source for ACE — AccessData Certified Examiner (status uncertain) cost | Historically a knowledge and practical examination on FTK. Current format unknown — Exterro's training portal is a JavaScript application we could not inspect.Unknown. | Historically an FTK-focused examination. Current prerequisites unknown. |
| CHFI — Computer Hacking Forensic Investigator | EC-Council | EC-Council does not publish the exam voucher or training prices on the CHFI pages we could read, so no figure can be quoted. Expect the training bundle to be the dominant cost and ask for a written quote.As published 2026-09-12 · source for CHFI — Computer Hacking Forensic Investigator cost | Exam 312-49: 150 multiple-choice questions, 4 hours, with cut scores ranging from 60% to 85% depending on exam form. The five-day course includes 68 hands-on labs, but the labs are training content rather than a graded certification requirement.Five-day course in iLearn self-paced, iWeek live online or in-person partner delivery, plus the four-hour exam. | No prerequisite is stated on the CHFI page. EC-Council's general non-training eligibility route requires documented information-security experience; we could not confirm the figure for CHFI specifically. |
| CISSP — Certified Information Systems Security Professional | ISC2 | Widely reported at $749 for the exam with a $135 annual maintenance fee, but ISC2's own pages we could read did not display those figures, so treat both as unconfirmed by primary source and check ISC2 directly.As published 2026-09-12 · source for CISSP — Certified Information Systems Security Professional cost | Computerised adaptive testing: 3 hours, 100-150 multiple-choice and advanced-format questions, pass mark 700 of 1000 scaled points, with performance required across all eight domains.A single three-hour adaptive exam. | Five years of cumulative, full-time experience in two or more of the eight CISSP domains. Up to one year is waivable with a qualifying four-year degree or an approved credential. Passing without the experience yields Associate of ISC2 status, valid six years. |
| Certified CyberDefender — CCDL1 and CCDL2 | CyberDefenders | Not published on the certification or pricing pages we could read, so no figure can be quoted. The renewal fee and validity period are similarly not stated in the page content we could retrieve — ask CyberDefenders directly.As published 2026-09-12 · source for Certified CyberDefender — CCDL1 and CCDL2 cost | A 48-hour practical exam. CCDL1 is described as covering five sections across network forensics, disk forensics, perimeter defence, memory forensics and threat hunting; CCDL2 is a 48-hour practical across enterprise environments.A 48-hour examination window, after self-paced preparation on the lab platform. | Recommended rather than required: Windows and Linux fundamentals, basic command-line use and general networking knowledge for CCDL1. CCDL2 targets experienced analysts with a year or more of experience. |
| BTL1 — Blue Team Level 1 | Centri (trading as Security Team Training Ltd; formerly Security Blue Team) | £399.00, which includes about 30 hours of coursework, four months of on-demand material access and one free resit voucher. Priced in pounds only; the dollar cost moves with the exchange rate.As published 2026-09-12 · source for BTL1 — Blue Team Level 1 cost | About 30 hours of coursework followed by one 24-hour practical incident-response exam with immediate grading and feedback.Four months of material access; the exam itself is a 24-hour window. | None. The provider states plainly that there are no entry requirements for the exam, and recommends it for people with zero to two years of experience. |
| BTL2 — Blue Team Level 2 | Centri (formerly Security Blue Team) | £1,999.00, including five months of material access. Priced in pounds only.As published 2026-09-12 · source for BTL2 — Blue Team Level 2 cost | Up to 72 hours to complete a practical assessment and submit a written report, hand-graded, 70% to pass, with a distinction at 90% or above.Five months of material access; the assessment window is up to 72 hours. | No formal prerequisites. The provider recommends two or more years of experience and completing BTL1 first. |
| HTB Certified Defensive Security Analyst | Hack The Box Academy | $490, described on the certification page as covering fifteen modules with the exam included.As published 2026-09-12 · source for HTB Certified Defensive Security Analyst cost | Fifteen Academy modules followed by an included examination. Hack The Box's certification exams are practical; the precise structure is set out in the exam documentation rather than on the preview page.Self-paced through the modules, then the exam. | None stated. |
| CEDS — Certified E-Discovery Specialist | ACEDS (Association of Certified E-Discovery Specialists) | Not published in the pages we could read — ACEDS's pricing is served by a scripted page that returned no figures. Do not rely on a second-hand number; ask ACEDS for current exam and membership pricing.As published 2026-09-12 · source for CEDS — Certified E-Discovery Specialist cost | A proctored certification exam. The question count, time limit and pass mark were not retrievable from the pages we could read, so treat the exam mechanics as unconfirmed.Self-paced preparation, then the exam. | Not stated in the content we could retrieve. Study support includes a candidate handbook, a study manual and a mentorship programme. |
Degree & academic (14)
University programs, from bachelor's degrees to one-course graduate certificates. Slow and expensive relative to a certification, but they are the route that qualifies for federal financial aid, satisfies degree-required job postings, and teaches the statistics, law and writing that tool training skips.
| Program | Provider | Cost (as published) | Format & length | Prerequisites |
|---|---|---|---|---|
| BS in Applied Cybersecurity (BACS) | SANS Technology Institute (SANS.edu) | $41,650 total program cost for the 50 credits taken at SANS.edu, plus a $75 application fee. The program requires roughly 70 transfer credits completed elsewhere first, which are an additional cost not included in that figure.As published 2026-09-12 · source for BS in Applied Cybersecurity (BACS) cost | 100% online, or live online, or in-person immersion courses. Coursework is SANS courses with GIAC exams attached.Two years at SANS.edu for the 50 credits, after the transfer credits. | It is a degree-completion program: about 70 transferable credits are required on entry, so this is not a route from a standing start. |
| MS in Information Security Engineering (MSISE) | SANS Technology Institute (SANS.edu) | $1,500 per credit across 36 credit hours — SANS.edu publishes a $54,000 total program cost — plus a $100 application fee.As published 2026-09-12 · source for MS in Information Security Engineering (MSISE) cost | 100% online option available, built from SANS courses with GIAC exams, plus graduate-level research and presentation work.Three to five years part-time alongside full-time work. | A current professional role in information security or a closely related field. This is not an entry-level program. |
| BS in Digital Forensics and Cybersecurity | Eastern Kentucky University | Not verified. EKU's published tuition rates were not retrievable in our research pass, so we state no figure — check EKU's own tuition page before relying on any number you find elsewhere.As published 2026-09-12 · source for BS in Digital Forensics and Cybersecurity cost | Undergraduate degree program. Delivery mode not verified.A bachelor's degree, typically four years. | Standard undergraduate admission. Specific program prerequisites were not verified. |
| BS in Digital Forensics | Champlain College | $48,800 per year, or $24,400 per semester, full-time for 2025-26, rising to $49,500 per year for 2026-27. Part-time study is $2,100 per credit.As published 2026-09-12 · source for BS in Digital Forensics cost | On-campus in Burlington, Vermont. We found no current online bachelor's.A bachelor's degree. Credit hours were not stated on the programme page we read. | Standard undergraduate admission. Programme-specific prerequisites were not stated on the page we read. |
| MS in Digital Forensics | University of Central Florida | $369.65 per credit in-state and $1,276.48 per credit out-of-state, over 30 credit hours. UCF publishes a per-credit rate rather than a programme total, so we do not multiply it out.As published 2026-09-12 · source for MS in Digital Forensics cost | 100% online, with an on-campus option for a thesis defence. 30 credit hours.30 credit hours; the programme page does not state a fixed completion time. | A bachelor's in computer science, computer engineering, IT or a closely related field. Applicants from other fields need basic CS or IT coursework, training or working experience in CS, IT or digital forensics. Requires a résumé, a statement of objectives and three letters of recommendation. |
| MS in Digital Forensics and Cyber Investigation | University of Maryland Global Campus | $694 per credit for 2026-27, charged at the same rate in-state and out-of-state because UMGC prices online study flat. The military rate is $336 per credit. 30 credits, of which up to 12 are transferable.As published 2026-09-12 · source for MS in Digital Forensics and Cyber Investigation cost | Online. 30 credits — 15 core, 12 elective and a 3-credit capstone. UMGC estimates about 18 months at two courses per term.About 18 months at two courses per term. | No specific undergraduate major is required. UMGC recommends a background in computing and programming, and strong writing skills. |
| MS in Cybersecurity and Digital Forensics | Stevenson University | $719 per credit with no fees, over 36 credits. Stevenson publishes the per-credit rate; the academic year it applies to was not labelled on the page we read, so confirm currency.As published 2026-09-12 · source for MS in Cybersecurity and Digital Forensics cost | 100% online, 36 credits.Two years or less, per the programme page. | A bachelor's from a regionally accredited institution in a related field, or an unrelated field plus IT, cybersecurity or forensics coursework or professional experience. Cumulative 3.0 GPA, and a personal statement on forensic-tools and evidence-handling experience. International transcripts need a NACES evaluation. |
| MS in Digital Forensics | George Mason University | Not published on the catalogue page we read; GMU directs readers to a separate tuition-and-fees page we could not retrieve. We therefore state no figure — check GMU's tuition page for the current rate and your residency.As published 2026-09-12 · source for MS in Digital Forensics cost | 30 credits: a 21-credit required core plus either a concentration or 9 elective credits.30 credits. | A bachelor's from an accredited institution in engineering, mathematics, science, computer science, quantitative business, economics or another analytical field, or equivalent analytical work experience. Minimum 3.00 undergraduate GPA. Some admits are required to take 3 to 12 credits of preliminary coursework. |
| MS in Digital Forensics (and PhD in Digital and Cyber Forensic Science) | Sam Houston State University | Not stated on the programme page we read, so we quote no figure. Confirm current graduate tuition with SHSU, and note that the online rate and the residency rules are what determine the real cost.As published 2026-09-12 · source for MS in Digital Forensics (and PhD in Digital and Cyber Forensic Science) cost | Online. 30 credit hours.30 credit hours. | Not stated on the page we read. Application deadlines are 1 August for autumn, 15 December for spring and 15 May for summer. |
| BS in Digital Forensics and Cybersecurity | Commonwealth University of Pennsylvania (Bloomsburg) | Not stated on the programme page we read. As a Pennsylvania State System institution its published rates are lower than the private options here, but we quote no figure without the source — check Commonwealth University's tuition page.As published 2026-09-12 · source for BS in Digital Forensics and Cybersecurity cost | Face-to-face, online and hybrid, across the Bloomsburg, Lock Haven and Mansfield campuses.A bachelor's degree. | Standard undergraduate admission; specifics not verified. |
| MS in Digital Forensics and Cybersecurity | John Jay College of Criminal Justice, CUNY | Not stated on the programme page we read. CUNY publishes graduate rates centrally and they differ sharply for New York residents; confirm with John Jay's graduate admissions before budgeting.As published 2026-09-12 · source for MS in Digital Forensics and Cybersecurity cost | On campus in Manhattan, with evening classes Monday to Thursday.Not stated on the page we read. | A bachelor's from an accredited institution with a minimum 3.0 GPA, plus a computer science background: two programming courses, data structures, algorithms, operating systems, networks, statistics and discrete mathematics. Two letters of recommendation, a personal statement, transcripts and a résumé. The GRE is advised but not required for certain applicants. |
| BS in Cyber Forensics and Security | Marshall University | Not stated on the programme page we read. Note that Marshall participates in the Southern Regional Education Board's Academic Common Market, which may allow in-state tuition for eligible out-of-state students — worth checking, as it can change the cost substantially.As published 2026-09-12 · source for BS in Cyber Forensics and Security cost | On campus in Huntington, West Virginia, in the Weisberg Family Applied Engineering Complex, with a capstone using simulated and real-world cases.A bachelor's degree. | Standard undergraduate admission; specifics not verified. |
| MS in Computer and Information Technology — Cyberforensics specialisation | Purdue University | Not stated on the programme pages we read. Purdue publishes graduate tuition centrally and rates differ by residency; confirm before budgeting.As published 2026-09-12 · source for MS in Computer and Information Technology — Cyberforensics specialisation cost | A specialisation in cyberforensics with thesis, within the MS in Computer and Information Technology, at West Lafayette only.Not stated on the pages we read. | Not stated on the pages we read. |
| Graduate Certificate in Digital Forensics | SANS Technology Institute (SANS.edu) | $22,800 total programme cost for 12 credits, as published by SANS.edu, plus a $35 application fee. That is roughly $1,900 per credit-equivalent.As published 2026-09-12 · source for Graduate Certificate in Digital Forensics cost | 12 credits, online or with in-person course options, taught by practising professionals. Four GIAC certifications are awarded on completion.18 to 24 months. | A current professional role in information security or a closely related field. Applications are accepted monthly on a rolling basis. |
Bootcamp & intensive (5)
Short, intensive, cohort-based programs. They compress months of study into weeks and usually include career support. Verify outcomes claims and accreditation carefully: this is the least standardised category in the field and the quality range is enormous.
| Program | Provider | Cost (as published) | Format & length | Prerequisites |
|---|---|---|---|---|
| SANS FOR-series forensics courses | SANS Institute | $8,780 per course at list price, the same figure for live instructor-led and for OnDemand self-paced, with regional pricing in EUR, GBP, JPY, AUD and SGD. A GIAC certification attempt is an extra, bundled add-on at purchase.As published 2026-09-12 · source for SANS FOR-series forensics courses cost | Six days instructor-led (in person or live online) or about 36 hours self-paced OnDemand with roughly four months of access. Hands-on labs throughout, with a virtual machine and datasets you keep.Six consecutive days for the live format; OnDemand is self-paced inside the access window. | None enforced. Each course page states assumed knowledge; the advanced courses genuinely assume it. |
| SANS Work Study (facilitator) program | SANS Institute | $2,500 for a four-to-six-day course, or $417 per day for shorter courses, in exchange for volunteer facilitator duties. SANS says a GIAC attempt and extended OnDemand access are often — not always — included.As published 2026-09-12 · source for SANS Work Study (facilitator) program cost | You attend the course as a student while performing facilitator duties for the event. Same courseware and same instructor as a full-price seat.The length of the course you facilitate, typically four to six days. | A competitive application. SANS asks for strong organisation, support and leadership skills, and you take on real duties supporting the instructor and class. |
| BCFE — Basic Computer Forensic Examiner course | IACIS | €4,800 for the October 2026 Budapest delivery, as listed on IACIS's training calendar. Pricing varies by delivery and location, and US deliveries are priced separately — check the calendar for the session you want.As published 2026-09-12 · source for BCFE — Basic Computer Forensic Examiner course cost | Two weeks of instructor-led classroom training, about 76 hours, hands-on throughout.Two weeks, 76 hours. | IACIS membership. The course is aimed at investigators and examiners beginning in computer forensics. |
| 13Cubed on-demand DFIR courses | 13Cubed | Per course: Architecting the Hunt $295; Investigating Windows Endpoints $795; Investigating Windows Memory $795; Investigating Linux Devices $895; Investigating macOS Endpoints $895. Bundles run from $1,395 (Windows) to $2,995 (XPlat Complete). The YouTube content is free.As published 2026-09-12 · source for 13Cubed on-demand DFIR courses cost | Self-paced video with hands-on material. The site states each course includes a knowledge assessment and separate certifications; the exam mechanics and any proctoring are not detailed publicly, so treat the certification structure as unconfirmed.Self-paced. | None stated, but the material assumes forensic fundamentals and comfort at a command line. |
| Antisyphon Training | Antisyphon Training | Pay-what-you-can classes start at $0.00. On the pay-what-you-can catalogue, under $295 excludes cyber-range access; $295 or more adds six months of range access, a certificate and six months of recordings; $575 or more adds twelve months of range access. The advanced DFIR course Advanced Endpoint Investigations is separately priced at $575 on demand and $725-$1,850 live.As published 2026-09-12 · source for Antisyphon Training cost | Live and on-demand courses, typically 16 hours for the DFIR offerings, with an optional cyber range at the higher payment tiers.Usually two days live, or self-paced on demand. | Varies by course; the pay-what-you-can classes are introductory. |
Vendor & tool training (5)
Training built around one company's tool — EnCase, Cellebrite, AXIOM, Belkasoft. Indispensable if your lab has bought that tool, and often the fastest route to competent output. It certifies tool proficiency, which is not the same thing as method-independent forensic competence.
| Program | Provider | Cost (as published) | Format & length | Prerequisites |
|---|---|---|---|---|
| Cellebrite CCO and CCPA (Inseyets) | Cellebrite | Not published. Cellebrite routes pricing enquiries through its sales and community portal rather than listing course or certification prices publicly, so we cannot state a figure — ask Cellebrite for a written quote.As published 2026-09-12 · source for Cellebrite CCO and CCPA (Inseyets) cost | CCO Inseyets is a two-day, 14-hour intermediate course; CCPA Inseyets is a three-day, 21-hour advanced course. Both are available in person, virtually or self-paced, and both are assessed by a knowledge test plus a hands-on practical skills assessment at 80%.Two days for CCO, three days for CCPA. | CCO is recommended, not strictly required, before CCPA. Cellebrite notes the two may be taken individually in limited scenarios but strongly recommends the bundled path. |
| CCME — Cellebrite Certified Mobile Examiner | Cellebrite | Not published. Cellebrite does not list certification pricing publicly and routes enquiries through sales, so no figure can be quoted here.As published 2026-09-12 · source for CCME — Cellebrite Certified Mobile Examiner cost | Assessment through Cellebrite's certification program; the specific written and practical structure is not published in detail on the public pages.Not published. | Positioned as the advanced step after the operator and physical-analyst credentials. Cellebrite's published prerequisite detail is thin; confirm directly. |
| Magnet certifications — MCFE, MMCE, MCCE, MCME | Magnet Forensics | The certifications themselves are free — Magnet states certification is free to users who have completed the prerequisite training courses. The prerequisite courses are paid, and their prices are not stated on the certification overview, so the real cost is the training and it is unconfirmed here.As published 2026-09-12 · source for Magnet certifications — MCFE, MMCE, MCCE, MCME cost | Examination following the prerequisite training. The written-versus-practical breakdown is not published on the pages we could read — treat the format as unconfirmed.Not published. | Completion of the relevant prerequisite Magnet training courses. The specific course names per credential are not set out on the overview page. |
| Autopsy Basics and Hands On | Sleuth Kit Labs | Not published on the training page we could read. Note that a widely repeated claim of a free eight-hour introductory course is NOT supported by the current page — the eight-hour course appears to be paid, and a $500 processing fee applies to purchase-order or invoice payment for fewer than ten seats.As published 2026-09-12 · source for Autopsy Basics and Hands On cost | Eight hours, online or in person, mixing video lecture with hands-on labs. A certificate of completion is issued for use toward CPE credits.One day, eight hours. | The provider describes it as a good one-day introduction to Autopsy for examiners who already know the fundamentals of digital forensics — so forensic fundamentals are assumed. |
| Belkasoft DFIR training and certification | Belkasoft | $2,999 per year for the Annual Training Pass covering all ten on-demand courses — Belkasoft describes this as nearly $5,000 off buying them separately. Completion earns 62 CPE credits. The knowledge base and webinar library are free.As published 2026-09-12 · source for Belkasoft DFIR training and certification cost | Ten self-paced on-demand courses, plus instructor-led certification courses in Belkasoft's BelkaX series covering fundamentals, RAM, mobile and cloud.One year of access under the annual pass. | None stated for the on-demand catalogue. |
Free & low-cost (11)
Free and low-cost material: hands-on lab platforms, published datasets, open-source tool training, community courses. This is where most practitioners actually build hands-on skill. Very little of it produces a credential an employer will recognise on its own.
| Program | Provider | Cost (as published) | Format & length | Prerequisites |
|---|---|---|---|---|
| SANS Cyber Academy | SANS Institute | No cost to the participant. SANS states plainly that it is a 100% free, merit-based training program, funded by sponsors including Cisco, WiCyS and Mission 43.As published 2026-09-12 · source for SANS Cyber Academy cost | Three SANS courses with GIAC exam attempts — SEC275/GFACT, SEC401/GSEC and SEC504/GCIH — each completed inside a three-month window including exam preparation.About nine months in total across the three courses. | US citizens or legal permanent residents, with no prior cybersecurity work experience, no existing GIAC or advanced cyber certification, and no graduate degree in cybersecurity. Active-duty applicants must be within six months of separation. |
| DFIR Diva free and affordable training list | DFIR Diva (Elan Wright) | Free to use. The site describes itself as covering over 500 free and affordable training resources; the linked resources themselves range from free to paid.As published 2026-09-12 · source for DFIR Diva free and affordable training list cost | A curated web index with categories and commentary, plus career and résumé advice.Self-paced browsing; it is a directory, not a course. | None. |
| Blue Team Labs Online (BTLO) | Centri | Free tier gives access to challenges as downloadable artefacts. PRO is £15 per month, £40.50 for three months, £76.50 for six months or £144 per year.As published 2026-09-12 · source for Blue Team Labs Online (BTLO) cost | Browser-delivered and downloadable challenges and investigations across five defensive disciplines.Self-paced and open-ended. | None. |
| TryHackMe | TryHackMe | Premium was shown at €16.99 per month, or €10.50 per month billed annually; the MAX tier at €29.11 per month, or €17.99 billed annually. The site served us euro pricing, so the US dollar figures are unconfirmed. A limited free tier exists.As published 2026-09-12 · source for TryHackMe cost | Browser-based guided labs organised into learning paths, with hints and walkthroughs.Self-paced. | None. |
| NIST CFReDS datasets and CFTT tool testing | NIST (National Institute of Standards and Technology) | Free. Both programs are publicly funded; CFReDS is supported through a National Institute of Justice interagency agreement with NIST.As published 2026-09-12 · source for NIST CFReDS datasets and CFTT tool testing cost | CFReDS provides documented sets of simulated digital evidence for examination, tool validation, equipment verification, training and proficiency testing. CFTT publishes a methodology for testing forensic software, along with specifications, procedures, criteria and test reports.Self-directed and open-ended. | You need to know how to design an examination or a validation test. These are datasets and reports, not lessons. |
| TCM Security Academy | TCM Security | $29.99 per month, $154.99 for six months or $299.99 per year. A free tier exists before upgrading.As published 2026-09-12 · source for TCM Security Academy cost | Self-paced video courses. The forensics-relevant titles are Introduction to Windows Forensics (about 7 hours 30 minutes) and Windows Evidence Acquisition and Triage (about 3 hours).Self-paced within the subscription period. | None. |
| Free DFIR tooling and reference material | Eric Zimmerman, SANS and the DFIR community | Free. Eric Zimmerman's tools are open source, with development funding and support credited to SANS and SANS DFIR. The SANS poster library lists a Digital Forensics and Incident Response category with 37 resources.As published 2026-09-12 · source for Free DFIR tooling and reference material cost | Downloadable command-line and GUI tools, plus printable posters and cheat sheets covering artefacts, timelines and triage.Ongoing; this is a working reference, not a course. | You need to know what you are looking for. These are instruments and quick references, not instruction. |
| SWGDE best-practice documents | Scientific Working Group on Digital Evidence | Published documents are distributed by SWGDE and are widely used without charge; the documents page we could read did not state a price either way, so treat cost as unconfirmed rather than assuming a fee.As published 2026-09-12 · source for SWGDE best-practice documents cost | Downloadable consensus documents across six committees — audio, forensics, imaging, photography, quality and standards, and video. Titles include Best Practices for Digital Evidence Collection, Best Practices for Computer Forensic Examinations and Core Competencies for Digital Forensics.Reference material; read as needed. | None to read. Membership requires attending two SWGDE meetings as a guest first. |
| Digital Forensics Concepts (Coursera) | Infosec Institute, hosted on Coursera | Free to audit — Coursera's enrol-for-free option covers the material. A graded certificate requires purchasing the certificate experience; the standalone certificate price did not display on the page we could read, so treat it as unconfirmed.As published 2026-09-12 · source for Digital Forensics Concepts (Coursera) cost | Self-paced online video and quizzes.A few weeks of light self-paced study. | None. |
| The evidence rules a digital-evidence lawyer has to know | Federal Rules of Evidence (free, via Cornell LII) | Free. The Federal Rules of Evidence are public and are published in full, with notes, by Cornell's Legal Information Institute.As published 2026-09-12 · source for The evidence rules a digital-evidence lawyer has to know cost | Rule text with committee notes. Rule 702, as amended effective 1 December 2023, now requires the proponent to demonstrate to the court that it is more likely than not that each reliability condition is met, and that the expert's opinion reflects a reliable application of the principles and methods to the facts. Rule 901(b)(9) admits evidence describing a process or system and showing that it produces an accurate result. Rules 902(13) and 902(14) allow self-authentication of records generated by an electronic process and of data copied from a device, each on a qualified person's certification meeting Rule 902(11) requirements, including its notice obligations.An afternoon to read; a career to apply. | Legal training. This is primary source material, not a course. |
| VET TEC 2.0 — VA-funded technology training for veterans | US Department of Veterans Affairs | Funded by the VA for eligible veterans. The programme is limited to 4,000 paid participants in a fiscal year; the VA page we read on 2026-09-12 showed 2,325 openings available and applications open.As published 2026-09-12 · source for VET TEC 2.0 — VA-funded technology training for veterans cost | Funding applied to approved high-technology training programmes, not a course in itself.The length of the funded programme. | Veteran eligibility as defined by the VA, plus acceptance by an approved training provider. |
CLE & legal training (2)
Continuing legal education and legal-side credentials. Aimed at lawyers who have to examine a forensic expert, argue an authentication objection, or supervise e-discovery — not at people who will do the imaging themselves.
| Program | Provider | Cost (as published) | Format & length | Prerequisites |
|---|---|---|---|---|
| State bar CLE — technology and cybersecurity requirements | US state bars and state CLE boards | Set per state, and separate from course fees. Texas requires a minimum 15 hours of CLE a year including 3 hours of ethics; Florida requires 30 hours over three years, of which 3 must be approved technology programmes.As published 2026-09-12 · source for State bar CLE — technology and cybersecurity requirements cost | Accredited courses, live or on demand, reported to the state's CLE board. Accreditation is granted by that board, not by any national body.Annual or multi-year compliance cycles depending on the state. | Admission to the bar of the state in question. |
| SEAK expert witness training | SEAK, Inc. | Not listed on the pages we could read. SEAK sells two-day live and virtual programmes plus on-demand streaming; ask for current pricing.As published 2026-09-12 · source for SEAK expert witness training cost | Two-day live or virtual programmes, on-demand self-paced streaming, and an annual national expert witness conference.Typically two days for the live programmes. | None stated. Aimed at professionals who testify or want to begin testifying. |
Legal Cyber Academy (5)
Our own courses. They teach lawyers, in-house counsel and judges what digital forensics produces and how to attack or defend it in a proceeding. They will not make anyone a practising examiner, and nothing here pretends otherwise.
| Program | Provider | Cost (as published) | Format & length | Prerequisites |
|---|---|---|---|---|
| Digital Forensics for Lawyers (track)Our own course | Legal Cyber Academy | $19.99 and up per course with lifetime access, or $49 per month for all-access to the whole library. A free account carries 16 free courses with a certificate on completion.As published 2026-09-12 · source for Digital Forensics for Lawyers (track) cost | Six on-demand video courses taken in order, with a certificate on completion and verifiable certificates on the courses that carry an exam.Self-paced; each course is a short sitting rather than a multi-day commitment. | None. No technical background is assumed. |
| Cracking the Digital Case: Digital ForensicsOur own course | Legal Cyber Academy | $19.99 one-time with lifetime access, or included in the $49-per-month all-access subscription.As published 2026-09-12 · source for Cracking the Digital Case: Digital Forensics cost | On-demand video, with a certificate on completion.A single short sitting, self-paced. | None. |
| Digital Forensic Files: Computer ForensicsOur own course | Legal Cyber Academy | $39.99 one-time with lifetime access, or included in the $49-per-month all-access subscription. A second part is published as a separate course.As published 2026-09-12 · source for Digital Forensic Files: Computer Forensics cost | On-demand video across two parts, with a certificate on completion.Self-paced across two courses. | None, though it lands better after an introductory course. |
| The Digital Verdict: Mastering Smartphone Evidence in the CourtroomOur own course | Legal Cyber Academy | $19.99 one-time with lifetime access, or included in the $49-per-month all-access subscription.As published 2026-09-12 · source for The Digital Verdict: Mastering Smartphone Evidence in the Courtroom cost | On-demand video, with a certificate on completion.A single short sitting, self-paced. | None. |
| Legal Cyber Academy All-AccessOur own course | Legal Cyber Academy | $49 per month, cancellable at any time from your account. A free account gives 16 free courses with a certificate on completion, and individual courses start at $19.99 one-time with lifetime access.As published 2026-09-12 · source for Legal Cyber Academy All-Access cost | On-demand video across the full catalogue, with verifiable certificates on the courses that carry an exam and group and firm licensing available.Monthly, for as long as you subscribe. | None. |
How to choose
Ranking these bluntly would be dishonest, because the right answer genuinely depends on who is paying, what you already know, and whether you will be doing the examination or arguing about it. So here is the decision as it actually presents itself.
- Your employer has a training budget
- Take the SANS FOR-series course plus the matching GIAC certification. It is the most expensive option in this directory by a wide margin and it is also the best, and someone else is paying. Start with GCFE if you work on Windows endpoints, GCFA if you do intrusion response.
- You are paying for it yourself
- Do not start with SANS. Work through the free material first — DFIR Diva's list, Blue Team Labs Online, Eric Zimmerman's tools, the SWGDE competency document — then buy one graded practical credential. IACIS CFCE at $800 for the certification process, or ISFCE CCE at $495 for the exam, both test real work product. BTL1 at £399 is a lifetime credential with no renewal fee.
- A job posting requires a degree
- A certification will not satisfy it, and no amount of skill substitutes. UCF's online MS at $369.65 per credit in-state is the cheapest verified accredited route; UMGC charges one flat $694 per credit with no residency penalty and asks for no specific undergraduate major, which makes it the realistic option for a career changer.
- You are a law-enforcement examiner
- IACIS is built for you: Regular membership, the BCFE course, then the CFCE. It is FSAB-accredited, tool-agnostic, and the peer-review model gives you a coach. Add a vendor certification for whichever tool your unit actually owns — Cellebrite for mobile, EnCase or Magnet for computers.
- You are a lawyer who has to examine an expert
- You do not need forensic training; you need the evidence rules and enough vocabulary to test a method. Read Rules 702, 901(b)(9) and 902(13)-(14) — they are free — then spend your CLE hours on digital evidence. ACEDS CEDS is the credential your market recognises if your work is discovery-heavy. Our own courses sit in this row, and so does the free reading that precedes them.
- You are changing careers with no budget
- If you are a US veteran, check VET TEC first — the VA's own page shows it active and accepting applications. If you are a US citizen or permanent resident with no cyber experience, SANS Cyber Academy is genuinely free, though it delivers security fundamentals rather than forensics. Otherwise: free labs, then one cheap credential, then apply.
- You already have the skill and need the paperwork
- Look at what the credential actually tests. EnCE accepts 12 months of work experience in place of 64 training hours. ISFCE CCE lets another recognised credential plus documented experience substitute for its course. CISSP's five-year experience requirement is the point of it, not an obstacle.
Head-to-head comparisons
What we could not verify
Publishing the gaps is part of the point. A directory that reads as complete on every figure is a directory that guessed somewhere.
- International programmes are absent. We could not reach the programme pages for University College Dublin, University of South Wales, Teesside, Abertay, Murdoch or Canberra, so none of them is listed. One commonly cited entry turned out to be stale: Cranfield’s Forensic Investigation MSc states on its own page that it is no longer available.
- Several providers do not publish prices at all. Cellebrite, EC-Council, ACEDS, Magnet’s prerequisite courses, SEAK and CyberDefenders all route pricing through sales or a scripted page. Those entries say so rather than repeating a second-hand figure.
- The AccessData ACE certification could not be found at all. Its old URL now redirects to Exterro’s homepage and the sitemap carries no certification pages. We list it as status-uncertain so nobody plans a career step around it.
- State CLE figures need checking against your own state. We verified Texas and Florida directly. New York’s and California’s current requirements we could not retrieve, so the entry names the official sources instead of quoting numbers.
- DoD 8140 baseline listings are unconfirmed. The authoritative list sits behind a government authentication gate. Where a provider claims DoD approval, the entry attributes the claim to the provider.
- Two federal designations are worth checking yourself. NSA CAE designations are searchable at maps.caecommunity.org and FEPAC accreditation at aafs.org. Both change, and a programme page is not evidence that a designation is current.