Digital Forensics Programs & Certifications

Every serious route into digital forensics, with the cost, the prerequisites, the strengths and the limitations of each — including the ones that compete with us.

The short answer

There is no single best way to learn digital forensics. If an employer will pay, SANS and GIAC certifications are the most recognised and by far the most expensive. If you are paying yourself, IACIS CFCE and ISFCE CCE cost a fraction and test graded practical work. If a job posting requires a degree, a public-university online master's costs less than either. Lawyers need the evidence rules and CLE, not tool training.

61 entries across 7 categories, each with a sourced cost and a stated date. 11 are free or low-cost, and several of those cost nothing at all.

Who wrote this, and what we sell

Legal Cyber Academy publishes this directory and sells online courses, so 5 of the 61 entries below are our own and are marked Our own coursewherever they appear. We have not softened a competitor’s strengths or inflated ours. Where SANS, IACIS or a free lab platform is the better answer for a given reader, the entry says so — and our own entries state plainly that they will not make anyone a practising examiner.

By category

Certification5
Degree & academic4
Bootcamp & intensive3
Vendor & tool training (0)
Free & low-cost7
CLE & legal training (0)
Legal Cyber Academy (0)

By reader

Clear reader

Showing 19 of 61 entries for Career changers

Reset all

Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.

Certification (5)

Independent credentials with a published exam. These are what hiring managers and opposing counsel actually recognise, and what an expert gets asked about on cross-examination. They prove you passed an assessment on a date — not that you can run an examination end to end.

Certification: cost, format and prerequisites for each entry, with the date each cost was read and a link to its source.
Program	Provider	Cost (as published)	Format & length	Prerequisites
GCFE — GIAC Certified Forensic Examiner	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR500 course is listed separately at $8,780.As published 2026-09-12 · source for GCFE — GIAC Certified Forensic Examiner cost	One proctored exam, remote or at a test centre. 82 questions, 3 hours, 70% to pass. GIAC's GCFE page does not describe this exam as using the CyberLive performance format.Exam only. The paired FOR500 course is six days instructor-led or about 36 hours self-paced, with four months of OnDemand access.	None published. GIAC describes the audience as anyone with a background in information systems, information security and computers.
CHFI — Computer Hacking Forensic Investigator	EC-Council	EC-Council does not publish the exam voucher or training prices on the CHFI pages we could read, so no figure can be quoted. Expect the training bundle to be the dominant cost and ask for a written quote.As published 2026-09-12 · source for CHFI — Computer Hacking Forensic Investigator cost	Exam 312-49: 150 multiple-choice questions, 4 hours, with cut scores ranging from 60% to 85% depending on exam form. The five-day course includes 68 hands-on labs, but the labs are training content rather than a graded certification requirement.Five-day course in iLearn self-paced, iWeek live online or in-person partner delivery, plus the four-hour exam.	No prerequisite is stated on the CHFI page. EC-Council's general non-training eligibility route requires documented information-security experience; we could not confirm the figure for CHFI specifically.
Certified CyberDefender — CCDL1 and CCDL2	CyberDefenders	Not published on the certification or pricing pages we could read, so no figure can be quoted. The renewal fee and validity period are similarly not stated in the page content we could retrieve — ask CyberDefenders directly.As published 2026-09-12 · source for Certified CyberDefender — CCDL1 and CCDL2 cost	A 48-hour practical exam. CCDL1 is described as covering five sections across network forensics, disk forensics, perimeter defence, memory forensics and threat hunting; CCDL2 is a 48-hour practical across enterprise environments.A 48-hour examination window, after self-paced preparation on the lab platform.	Recommended rather than required: Windows and Linux fundamentals, basic command-line use and general networking knowledge for CCDL1. CCDL2 targets experienced analysts with a year or more of experience.
BTL1 — Blue Team Level 1	Centri (trading as Security Team Training Ltd; formerly Security Blue Team)	£399.00, which includes about 30 hours of coursework, four months of on-demand material access and one free resit voucher. Priced in pounds only; the dollar cost moves with the exchange rate.As published 2026-09-12 · source for BTL1 — Blue Team Level 1 cost	About 30 hours of coursework followed by one 24-hour practical incident-response exam with immediate grading and feedback.Four months of material access; the exam itself is a 24-hour window.	None. The provider states plainly that there are no entry requirements for the exam, and recommends it for people with zero to two years of experience.
HTB Certified Defensive Security Analyst	Hack The Box Academy	$490, described on the certification page as covering fifteen modules with the exam included.As published 2026-09-12 · source for HTB Certified Defensive Security Analyst cost	Fifteen Academy modules followed by an included examination. Hack The Box's certification exams are practical; the precise structure is set out in the exam documentation rather than on the preview page.Self-paced through the modules, then the exam.	None stated.

Degree & academic (4)

University programs, from bachelor's degrees to one-course graduate certificates. Slow and expensive relative to a certification, but they are the route that qualifies for federal financial aid, satisfies degree-required job postings, and teaches the statistics, law and writing that tool training skips.

Degree & academic: cost, format and prerequisites for each entry, with the date each cost was read and a link to its source.
Program	Provider	Cost (as published)	Format & length	Prerequisites
BS in Applied Cybersecurity (BACS)	SANS Technology Institute (SANS.edu)	$41,650 total program cost for the 50 credits taken at SANS.edu, plus a $75 application fee. The program requires roughly 70 transfer credits completed elsewhere first, which are an additional cost not included in that figure.As published 2026-09-12 · source for BS in Applied Cybersecurity (BACS) cost	100% online, or live online, or in-person immersion courses. Coursework is SANS courses with GIAC exams attached.Two years at SANS.edu for the 50 credits, after the transfer credits.	It is a degree-completion program: about 70 transferable credits are required on entry, so this is not a route from a standing start.
MS in Digital Forensics	University of Central Florida	$369.65 per credit in-state and $1,276.48 per credit out-of-state, over 30 credit hours. UCF publishes a per-credit rate rather than a programme total, so we do not multiply it out.As published 2026-09-12 · source for MS in Digital Forensics cost	100% online, with an on-campus option for a thesis defence. 30 credit hours.30 credit hours; the programme page does not state a fixed completion time.	A bachelor's in computer science, computer engineering, IT or a closely related field. Applicants from other fields need basic CS or IT coursework, training or working experience in CS, IT or digital forensics. Requires a résumé, a statement of objectives and three letters of recommendation.
MS in Digital Forensics and Cyber Investigation	University of Maryland Global Campus	$694 per credit for 2026-27, charged at the same rate in-state and out-of-state because UMGC prices online study flat. The military rate is $336 per credit. 30 credits, of which up to 12 are transferable.As published 2026-09-12 · source for MS in Digital Forensics and Cyber Investigation cost	Online. 30 credits — 15 core, 12 elective and a 3-credit capstone. UMGC estimates about 18 months at two courses per term.About 18 months at two courses per term.	No specific undergraduate major is required. UMGC recommends a background in computing and programming, and strong writing skills.
MS in Cybersecurity and Digital Forensics	Stevenson University	$719 per credit with no fees, over 36 credits. Stevenson publishes the per-credit rate; the academic year it applies to was not labelled on the page we read, so confirm currency.As published 2026-09-12 · source for MS in Cybersecurity and Digital Forensics cost	100% online, 36 credits.Two years or less, per the programme page.	A bachelor's from a regionally accredited institution in a related field, or an unrelated field plus IT, cybersecurity or forensics coursework or professional experience. Cumulative 3.0 GPA, and a personal statement on forensic-tools and evidence-handling experience. International transcripts need a NACES evaluation.

Bootcamp & intensive (3)

Short, intensive, cohort-based programs. They compress months of study into weeks and usually include career support. Verify outcomes claims and accreditation carefully: this is the least standardised category in the field and the quality range is enormous.

Bootcamp & intensive: cost, format and prerequisites for each entry, with the date each cost was read and a link to its source.
Program	Provider	Cost (as published)	Format & length	Prerequisites
SANS Work Study (facilitator) program	SANS Institute	$2,500 for a four-to-six-day course, or $417 per day for shorter courses, in exchange for volunteer facilitator duties. SANS says a GIAC attempt and extended OnDemand access are often — not always — included.As published 2026-09-12 · source for SANS Work Study (facilitator) program cost	You attend the course as a student while performing facilitator duties for the event. Same courseware and same instructor as a full-price seat.The length of the course you facilitate, typically four to six days.	A competitive application. SANS asks for strong organisation, support and leadership skills, and you take on real duties supporting the instructor and class.
BCFE — Basic Computer Forensic Examiner course	IACIS	€4,800 for the October 2026 Budapest delivery, as listed on IACIS's training calendar. Pricing varies by delivery and location, and US deliveries are priced separately — check the calendar for the session you want.As published 2026-09-12 · source for BCFE — Basic Computer Forensic Examiner course cost	Two weeks of instructor-led classroom training, about 76 hours, hands-on throughout.Two weeks, 76 hours.	IACIS membership. The course is aimed at investigators and examiners beginning in computer forensics.
Antisyphon Training	Antisyphon Training	Pay-what-you-can classes start at $0.00. On the pay-what-you-can catalogue, under $295 excludes cyber-range access; $295 or more adds six months of range access, a certificate and six months of recordings; $575 or more adds twelve months of range access. The advanced DFIR course Advanced Endpoint Investigations is separately priced at $575 on demand and $725-$1,850 live.As published 2026-09-12 · source for Antisyphon Training cost	Live and on-demand courses, typically 16 hours for the DFIR offerings, with an optional cyber range at the higher payment tiers.Usually two days live, or self-paced on demand.	Varies by course; the pay-what-you-can classes are introductory.

Free & low-cost (7)

Free and low-cost material: hands-on lab platforms, published datasets, open-source tool training, community courses. This is where most practitioners actually build hands-on skill. Very little of it produces a credential an employer will recognise on its own.

Free & low-cost: cost, format and prerequisites for each entry, with the date each cost was read and a link to its source.
Program	Provider	Cost (as published)	Format & length	Prerequisites
SANS Cyber Academy	SANS Institute	No cost to the participant. SANS states plainly that it is a 100% free, merit-based training program, funded by sponsors including Cisco, WiCyS and Mission 43.As published 2026-09-12 · source for SANS Cyber Academy cost	Three SANS courses with GIAC exam attempts — SEC275/GFACT, SEC401/GSEC and SEC504/GCIH — each completed inside a three-month window including exam preparation.About nine months in total across the three courses.	US citizens or legal permanent residents, with no prior cybersecurity work experience, no existing GIAC or advanced cyber certification, and no graduate degree in cybersecurity. Active-duty applicants must be within six months of separation.
DFIR Diva free and affordable training list	DFIR Diva (Elan Wright)	Free to use. The site describes itself as covering over 500 free and affordable training resources; the linked resources themselves range from free to paid.As published 2026-09-12 · source for DFIR Diva free and affordable training list cost	A curated web index with categories and commentary, plus career and résumé advice.Self-paced browsing; it is a directory, not a course.	None.
Blue Team Labs Online (BTLO)	Centri	Free tier gives access to challenges as downloadable artefacts. PRO is £15 per month, £40.50 for three months, £76.50 for six months or £144 per year.As published 2026-09-12 · source for Blue Team Labs Online (BTLO) cost	Browser-delivered and downloadable challenges and investigations across five defensive disciplines.Self-paced and open-ended.	None.
TryHackMe	TryHackMe	Premium was shown at €16.99 per month, or €10.50 per month billed annually; the MAX tier at €29.11 per month, or €17.99 billed annually. The site served us euro pricing, so the US dollar figures are unconfirmed. A limited free tier exists.As published 2026-09-12 · source for TryHackMe cost	Browser-based guided labs organised into learning paths, with hints and walkthroughs.Self-paced.	None.
TCM Security Academy	TCM Security	$29.99 per month, $154.99 for six months or $299.99 per year. A free tier exists before upgrading.As published 2026-09-12 · source for TCM Security Academy cost	Self-paced video courses. The forensics-relevant titles are Introduction to Windows Forensics (about 7 hours 30 minutes) and Windows Evidence Acquisition and Triage (about 3 hours).Self-paced within the subscription period.	None.
Digital Forensics Concepts (Coursera)	Infosec Institute, hosted on Coursera	Free to audit — Coursera's enrol-for-free option covers the material. A graded certificate requires purchasing the certificate experience; the standalone certificate price did not display on the page we could read, so treat it as unconfirmed.As published 2026-09-12 · source for Digital Forensics Concepts (Coursera) cost	Self-paced online video and quizzes.A few weeks of light self-paced study.	None.
VET TEC 2.0 — VA-funded technology training for veterans	US Department of Veterans Affairs	Funded by the VA for eligible veterans. The programme is limited to 4,000 paid participants in a fiscal year; the VA page we read on 2026-09-12 showed 2,325 openings available and applications open.As published 2026-09-12 · source for VET TEC 2.0 — VA-funded technology training for veterans cost	Funding applied to approved high-technology training programmes, not a course in itself.The length of the funded programme.	Veteran eligibility as defined by the VA, plus acceptance by an approved training provider.

How to choose

Ranking these bluntly would be dishonest, because the right answer genuinely depends on who is paying, what you already know, and whether you will be doing the examination or arguing about it. So here is the decision as it actually presents itself.

Your employer has a training budget: Take the SANS FOR-series course plus the matching GIAC certification. It is the most expensive option in this directory by a wide margin and it is also the best, and someone else is paying. Start with GCFE if you work on Windows endpoints, GCFA if you do intrusion response.
You are paying for it yourself: Do not start with SANS. Work through the free material first — DFIR Diva's list, Blue Team Labs Online, Eric Zimmerman's tools, the SWGDE competency document — then buy one graded practical credential. IACIS CFCE at $800 for the certification process, or ISFCE CCE at $495 for the exam, both test real work product. BTL1 at £399 is a lifetime credential with no renewal fee.
A job posting requires a degree: A certification will not satisfy it, and no amount of skill substitutes. UCF's online MS at $369.65 per credit in-state is the cheapest verified accredited route; UMGC charges one flat $694 per credit with no residency penalty and asks for no specific undergraduate major, which makes it the realistic option for a career changer.
You are a law-enforcement examiner: IACIS is built for you: Regular membership, the BCFE course, then the CFCE. It is FSAB-accredited, tool-agnostic, and the peer-review model gives you a coach. Add a vendor certification for whichever tool your unit actually owns — Cellebrite for mobile, EnCase or Magnet for computers.
You are a lawyer who has to examine an expert: You do not need forensic training; you need the evidence rules and enough vocabulary to test a method. Read Rules 702, 901(b)(9) and 902(13)-(14) — they are free — then spend your CLE hours on digital evidence. ACEDS CEDS is the credential your market recognises if your work is discovery-heavy. Our own courses sit in this row, and so does the free reading that precedes them.
You are changing careers with no budget: If you are a US veteran, check VET TEC first — the VA's own page shows it active and accepting applications. If you are a US citizen or permanent resident with no cyber experience, SANS Cyber Academy is genuinely free, though it delivers security fundamentals rather than forensics. Otherwise: free labs, then one cheap credential, then apply.
You already have the skill and need the paperwork: Look at what the credential actually tests. EnCE accepts 12 months of work experience in place of 64 training hours. ISFCE CCE lets another recognised credential plus documented experience substitute for its course. CISSP's five-year experience requirement is the point of it, not an obstacle.

Head-to-head comparisons

What we could not verify

Publishing the gaps is part of the point. A directory that reads as complete on every figure is a directory that guessed somewhere.

International programmes are absent. We could not reach the programme pages for University College Dublin, University of South Wales, Teesside, Abertay, Murdoch or Canberra, so none of them is listed. One commonly cited entry turned out to be stale: Cranfield’s Forensic Investigation MSc states on its own page that it is no longer available.
Several providers do not publish prices at all. Cellebrite, EC-Council, ACEDS, Magnet’s prerequisite courses, SEAK and CyberDefenders all route pricing through sales or a scripted page. Those entries say so rather than repeating a second-hand figure.
The AccessData ACE certification could not be found at all. Its old URL now redirects to Exterro’s homepage and the sitemap carries no certification pages. We list it as status-uncertain so nobody plans a career step around it.
State CLE figures need checking against your own state. We verified Texas and Florida directly. New York’s and California’s current requirements we could not retrieve, so the entry names the official sources instead of quoting numbers.
DoD 8140 baseline listings are unconfirmed. The authoritative list sits behind a government authentication gate. Where a provider claims DoD approval, the entry attributes the claim to the provider.
Two federal designations are worth checking yourself. NSA CAE designations are searchable at maps.caecommunity.org and FEPAC accreditation at aafs.org. Both change, and a programme page is not evidence that a designation is current.