CAWFE — Certified Advanced Windows Forensic Examiner
IACIS's advanced Windows artefact credential, taken as a written exam followed by a 30-day practical, and notably not gated behind holding the CFCE first.
Type: CertificationLaw enforcement & investigatorsWorking practitioners
Offered by IACIS
The facts
- Cost
- Set as a member or non-member certification fee by IACIS; the figure is not published as static text on the CAWFE page, so treat the certification fee as unconfirmed. The associated AWFE course was listed at $995 for the 36-hour online delivery.Figure read 2026-09-12 from www.iacis.com/certification/cawfe
- Prerequisites
- IACIS membership in good standing, or payment of the non-member fee. The CFCE is not a hard prerequisite.
- Format
- Phase 1 written exam: 125 questions, up to 8 hours, open-book and not proctored, 80% minimum. Phase 2 practical: 30 days of Windows artefact analysis.
- Length
- Runs on an annual cycle — the written phase by 30 November and the practical by 31 December of the same year.
- Renewal
- Every three years: one proficiency exercise, 40 continuing-education hours, evidence of at least three examinations or active casework, current dues and ethics compliance.
- Accreditation
- The CAWFE page does not state FSAB accreditation, unlike the CFCE page. Do not assume the CFCE's accreditation extends to it.
- Who it suits
- An examiner with a Windows-heavy caseload who already has foundational training and wants a graded advanced credential.
- Audience
- Law enforcement & investigators · Working practitioners
- Official page
- www.iacis.com/certification/cawfe
Strengths
- Recertification requires evidence of active casework, which is a stronger currency test than CPE credits alone.
- Deep Windows artefact focus, with a graded practical rather than a knowledge exam only.
- The $995 supporting course is cheap for 36 hours of advanced instruction.
Limitations
- The certification fee is not published as static text on the page, so a reader cannot price the credential without contacting IACIS.
- No FSAB accreditation is claimed for this credential, which makes it a weaker third-party signal than the CFCE.
- Because the CFCE is not a prerequisite, someone can hold CAWFE without ever having passed the peer-reviewed foundational credential — worth knowing if you are evaluating an expert's qualifications.
- Windows-only, and locked to a single annual cycle with hard November and December deadlines.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.