SANS vs IACIS: which forensics route is right

Two genuinely credible routes into digital forensics, an order of magnitude apart in price and pointed at different kinds of work.

The short answer

SANS and GIAC are the right answer when an employer is paying: about $8,780 for the course plus $999 for the exam, ANAB-accredited, and the credential a corporate DFIR hiring manager recognises. IACIS is the right answer when you are paying, or when your work is criminal casework and testimony: $800 for the CFCE certification process, FSAB-accredited, tool-agnostic, and assessed on graded practical work rather than an exam alone.

Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.

The numbers, side by side

Every figure carries the date we read it and a link to the page it came from. The two routes are not priced on the same basis: SANS bundles teaching and courseware into one list price, while IACIS separates the certification process from the training hours it requires.

SANS/GIAC and IACIS programs compared on cost, format and prerequisites.
Program	Provider	Cost (as published)	Format & length	Prerequisites
GCFA — GIAC Certified Forensic Analyst	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR508 course is listed separately at $8,780; SANS bundles an attempt with a course purchase but does not publish the bundled add-on price as static text.As published 2026-09-12 · source for GCFA — GIAC Certified Forensic Analyst cost	One proctored exam, remote or at a test centre. 82 questions, 3 hours, 71% to pass, delivered in GIAC's CyberLive format — performance-based tasks in a live lab environment rather than only multiple choice.Exam only; the attempt must be completed within 120 days of activation. The paired FOR508 course is six days instructor-led or about 36 hours self-paced.	None published. GIAC's page describes practical experience as helpful for mastering the material, not as an entry requirement.
GCFE — GIAC Certified Forensic Examiner	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR500 course is listed separately at $8,780.As published 2026-09-12 · source for GCFE — GIAC Certified Forensic Examiner cost	One proctored exam, remote or at a test centre. 82 questions, 3 hours, 70% to pass. GIAC's GCFE page does not describe this exam as using the CyberLive performance format.Exam only. The paired FOR500 course is six days instructor-led or about 36 hours self-paced, with four months of OnDemand access.	None published. GIAC describes the audience as anyone with a background in information systems, information security and computers.
SANS FOR-series forensics courses	SANS Institute	$8,780 per course at list price, the same figure for live instructor-led and for OnDemand self-paced, with regional pricing in EUR, GBP, JPY, AUD and SGD. A GIAC certification attempt is an extra, bundled add-on at purchase.As published 2026-09-12 · source for SANS FOR-series forensics courses cost	Six days instructor-led (in person or live online) or about 36 hours self-paced OnDemand with roughly four months of access. Hands-on labs throughout, with a virtual machine and datasets you keep.Six consecutive days for the live format; OnDemand is self-paced inside the access window.	None enforced. Each course page states assumed knowledge; the advanced courses genuinely assume it.
SANS Work Study (facilitator) program	SANS Institute	$2,500 for a four-to-six-day course, or $417 per day for shorter courses, in exchange for volunteer facilitator duties. SANS says a GIAC attempt and extended OnDemand access are often — not always — included.As published 2026-09-12 · source for SANS Work Study (facilitator) program cost	You attend the course as a student while performing facilitator duties for the event. Same courseware and same instructor as a full-price seat.The length of the course you facilitate, typically four to six days.	A competitive application. SANS asks for strong organisation, support and leadership skills, and you take on real duties supporting the instructor and class.
CFCE — Certified Forensic Computer Examiner	IACIS (International Association of Computer Investigative Specialists)	$800 for the external CFCE certification process, with IACIS membership waived on purchase. Recertification after expiry is $350. The 72 training hours you must show first are a separate cost — IACIS's own BCFE course was listed at €4,800 for the October 2026 Budapest delivery.As published 2026-09-12 · source for CFCE — Certified Forensic Computer Examiner cost	Phase 1 peer review: four scenario-based practical problems, 30 days each, with an assigned coach; all four must pass. Phase 2 certification: a graded hard-drive practical over 30 days plus a written exam over 14 days, 80% minimum on both.Roughly a year in practice — four 30-day peer-review problems followed by the certification phase, which runs on IACIS's annual calendar.	Proof of 72 hours of training aligned to the CFCE core competencies. Non-law-enforcement candidates are eligible through the external track and Associate membership, which requires a background check.
BCFE — Basic Computer Forensic Examiner course	IACIS	€4,800 for the October 2026 Budapest delivery, as listed on IACIS's training calendar. Pricing varies by delivery and location, and US deliveries are priced separately — check the calendar for the session you want.As published 2026-09-12 · source for BCFE — Basic Computer Forensic Examiner course cost	Two weeks of instructor-led classroom training, about 76 hours, hands-on throughout.Two weeks, 76 hours.	IACIS membership. The course is aimed at investigators and examiners beginning in computer forensics.
CAWFE — Certified Advanced Windows Forensic Examiner	IACIS	Set as a member or non-member certification fee by IACIS; the figure is not published as static text on the CAWFE page, so treat the certification fee as unconfirmed. The associated AWFE course was listed at $995 for the 36-hour online delivery.As published 2026-09-12 · source for CAWFE — Certified Advanced Windows Forensic Examiner cost	Phase 1 written exam: 125 questions, up to 8 hours, open-book and not proctored, 80% minimum. Phase 2 practical: 30 days of Windows artefact analysis.Runs on an annual cycle — the written phase by 30 November and the practical by 31 December of the same year.	IACIS membership in good standing, or payment of the non-member fee. The CFCE is not a hard prerequisite.
ICMDE — IACIS Certified Mobile Device Examiner	IACIS	The certification fee is not published as static text on the ICMDE page; treat it as unconfirmed and ask IACIS. The supporting MDF and AMDF courses were each listed at $995 for the 36-hour online delivery.As published 2026-09-12 · source for ICMDE — IACIS Certified Mobile Device Examiner cost	A written exam (true/false, multiple choice, matching and short answer) inside a single 48-hour window once started, plus a 48-hour hands-on practical. 80% minimum on both.Two 48-hour assessment windows, taken on IACIS's certification calendar.	IACIS membership. The MDF and AMDF courses are the usual preparation.

Where SANS is genuinely better

The teaching and the courseware. This is not a close call and there is no point pretending otherwise. The FOR-series courses are the benchmark the rest of the field is measured against, the labs and datasets are substantial, and the material stays usable as a working reference for years after the exam. Part of what $8,780 buys is a book you will still open in 2030.
Employer recognition in the private sector. If a corporate or consultancy job posting names one forensics credential, it is far more often GCFA or GCFE than CFCE. That is a fact about the market, not a judgement about rigour.
Speed, and scheduling on your terms. Six days, or 36 hours of OnDemand inside a four-month window. The CFCE runs four 30-day peer-review problems and then a certification phase on IACIS’s annual calendar — realistically about a year.
Breadth of specialism. Network forensics, malware reverse engineering, cloud evidence and threat intelligence all have their own GIAC credential. IACIS covers computer, advanced Windows and mobile, and stops there.
CyberLive. GIAC describes its current GCFA, GREM and GCTI exams as performance-based tasks in a live lab rather than only multiple choice, which closes much of the gap that practical-exam advocates used to point at.

Where IACIS is genuinely better

Cost, decisively. $800 for the CFCE certification process against $999 for a GIAC exam attempt alone, before either side’s training. Over a career the gap widens: GIAC renewal is $499 every four years plus 36 CPE credits; IACIS recertifies on a three-year cycle.
It is assessed on work product. Four coached scenario problems, then a graded hard-drive practical and a written exam at 80%. You cannot hold a CFCE without having produced examinations somebody else marked. That is a different and in some respects stronger claim than any exam score.
A coach, and feedback on your reasoning. Almost nothing else in this field gives an individual candidate feedback on how they thought about a problem. SANS gives you an excellent instructor for six days and then an exam.
FSAB accreditation, which is discipline-specific. GIAC’s ANAB accreditation to ISO/IEC 17024 certifies that the certification body is run properly. FSAB accredits forensic specialty certification programmes. Both are real; the second speaks more directly to a courtroom.
Tool-agnostic. Method rather than software, which is what survives the cross-examination question about why you chose the tool you chose.

The limitations each route would rather you did not weigh

SANS and GIAC

About $9,800 at list price for one course and one exam. A working skill set is several courses, so the real figure is a multiple of that.
Effectively closed to the self-funded. Work Study at $2,500 and the free Cyber Academy exist, but both are competitive and capped, and the Academy teaches security fundamentals rather than the FOR-series.
Oriented to enterprise intrusion response rather than criminal casework, evidence handling and testimony.
A recurring $499 renewal every four years, per certification, which compounds if you hold several.

IACIS

The organisation describes its own mission as law-enforcement focused, and Regular membership is restricted to current or former full-time law enforcement and government forensic contractors. Non-LE candidates enter as Associates, without voting rights.
The $800 fee is not the cost. You must first show 72 hours of qualifying training, and the BCFE course that usually supplies them was listed at €4,800 for its October 2026 delivery.
About a year of calendar time, on IACIS’s schedule, with fixed annual deadlines.
Only the CFCE carries the FSAB accreditation. The CAWFE and ICMDE pages do not claim it, and neither publishes its certification fee as static text.

So which one

Corporate or consultancy DFIR, employer-funded: SANS. Take FOR500 with GCFE if your work is endpoint examination, FOR508 with GCFA if it is intrusion response. The recognition and the courseware are worth the price when it is not your money.
Law enforcement or a public forensic unit: IACIS. Regular membership, BCFE, then CFCE. It is built for this work, it is FSAB-accredited, and your agency's peers will have taken the same route.
Private-sector examiner who will testify: IACIS CFCE, or ISFCE CCE if the law-enforcement framing of IACIS membership is a problem. Both are tool-agnostic and both assess graded practical work, which is what you want to be able to say on the stand.
Self-funded and starting out: Neither, yet. Work through the free material first, then take one cheap graded credential — CFCE at $800 or CCE at $495. Apply for SANS Work Study if you want SANS material at $2,500.
You want both: Most senior examiners eventually hold one of each, and that is a reasonable end state. Take the cheaper practical credential first: it teaches you the method the expensive course assumes you already have.

Entries covered on this page

Back to the full directory — 61 entries with sourced costs and stated limitations.