Digital Forensics Programs & Certifications

Every serious route into digital forensics, with the cost, the prerequisites, the strengths and the limitations of each — including the ones that compete with us.

The short answer

There is no single best way to learn digital forensics. If an employer will pay, SANS and GIAC certifications are the most recognised and by far the most expensive. If you are paying yourself, IACIS CFCE and ISFCE CCE cost a fraction and test graded practical work. If a job posting requires a degree, a public-university online master's costs less than either. Lawyers need the evidence rules and CLE, not tool training.

61 entries across 7 categories, each with a sourced cost and a stated date. 11 are free or low-cost, and several of those cost nothing at all.

Who wrote this, and what we sell

Legal Cyber Academy publishes this directory and sells online courses, so 5 of the 61 entries below are our own and are marked Our own coursewherever they appear. We have not softened a competitor’s strengths or inflated ours. Where SANS, IACIS or a free lab platform is the better answer for a given reader, the entry says so — and our own entries state plainly that they will not make anyone a practising examiner.

By category

Clear category

By reader

Clear reader

Showing 19 of 61 entries in Certification for Working practitioners

Reset all

Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.

Certification (19)

Independent credentials with a published exam. These are what hiring managers and opposing counsel actually recognise, and what an expert gets asked about on cross-examination. They prove you passed an assessment on a date — not that you can run an examination end to end.

How to choose

Ranking these bluntly would be dishonest, because the right answer genuinely depends on who is paying, what you already know, and whether you will be doing the examination or arguing about it. So here is the decision as it actually presents itself.

Your employer has a training budget: Take the SANS FOR-series course plus the matching GIAC certification. It is the most expensive option in this directory by a wide margin and it is also the best, and someone else is paying. Start with GCFE if you work on Windows endpoints, GCFA if you do intrusion response.
You are paying for it yourself: Do not start with SANS. Work through the free material first — DFIR Diva's list, Blue Team Labs Online, Eric Zimmerman's tools, the SWGDE competency document — then buy one graded practical credential. IACIS CFCE at $800 for the certification process, or ISFCE CCE at $495 for the exam, both test real work product. BTL1 at £399 is a lifetime credential with no renewal fee.
A job posting requires a degree: A certification will not satisfy it, and no amount of skill substitutes. UCF's online MS at $369.65 per credit in-state is the cheapest verified accredited route; UMGC charges one flat $694 per credit with no residency penalty and asks for no specific undergraduate major, which makes it the realistic option for a career changer.
You are a law-enforcement examiner: IACIS is built for you: Regular membership, the BCFE course, then the CFCE. It is FSAB-accredited, tool-agnostic, and the peer-review model gives you a coach. Add a vendor certification for whichever tool your unit actually owns — Cellebrite for mobile, EnCase or Magnet for computers.
You are a lawyer who has to examine an expert: You do not need forensic training; you need the evidence rules and enough vocabulary to test a method. Read Rules 702, 901(b)(9) and 902(13)-(14) — they are free — then spend your CLE hours on digital evidence. ACEDS CEDS is the credential your market recognises if your work is discovery-heavy. Our own courses sit in this row, and so does the free reading that precedes them.
You are changing careers with no budget: If you are a US veteran, check VET TEC first — the VA's own page shows it active and accepting applications. If you are a US citizen or permanent resident with no cyber experience, SANS Cyber Academy is genuinely free, though it delivers security fundamentals rather than forensics. Otherwise: free labs, then one cheap credential, then apply.
You already have the skill and need the paperwork: Look at what the credential actually tests. EnCE accepts 12 months of work experience in place of 64 training hours. ISFCE CCE lets another recognised credential plus documented experience substitute for its course. CISSP's five-year experience requirement is the point of it, not an obstacle.

Head-to-head comparisons

What we could not verify

Publishing the gaps is part of the point. A directory that reads as complete on every figure is a directory that guessed somewhere.

International programmes are absent. We could not reach the programme pages for University College Dublin, University of South Wales, Teesside, Abertay, Murdoch or Canberra, so none of them is listed. One commonly cited entry turned out to be stale: Cranfield’s Forensic Investigation MSc states on its own page that it is no longer available.
Several providers do not publish prices at all. Cellebrite, EC-Council, ACEDS, Magnet’s prerequisite courses, SEAK and CyberDefenders all route pricing through sales or a scripted page. Those entries say so rather than repeating a second-hand figure.
The AccessData ACE certification could not be found at all. Its old URL now redirects to Exterro’s homepage and the sitemap carries no certification pages. We list it as status-uncertain so nobody plans a career step around it.
State CLE figures need checking against your own state. We verified Texas and Florida directly. New York’s and California’s current requirements we could not retrieve, so the entry names the official sources instead of quoting numbers.
DoD 8140 baseline listings are unconfirmed. The authoritative list sits behind a government authentication gate. Where a provider claims DoD approval, the entry attributes the claim to the provider.
Two federal designations are worth checking yourself. NSA CAE designations are searchable at maps.caecommunity.org and FEPAC accreditation at aafs.org. Both change, and a programme page is not evidence that a designation is current.

Program	Provider	Cost (as published)	Format & length	Prerequisites
GCFA — GIAC Certified Forensic Analyst	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR508 course is listed separately at $8,780; SANS bundles an attempt with a course purchase but does not publish the bundled add-on price as static text.As published 2026-09-12 · source for GCFA — GIAC Certified Forensic Analyst cost	One proctored exam, remote or at a test centre. 82 questions, 3 hours, 71% to pass, delivered in GIAC's CyberLive format — performance-based tasks in a live lab environment rather than only multiple choice.Exam only; the attempt must be completed within 120 days of activation. The paired FOR508 course is six days instructor-led or about 36 hours self-paced.	None published. GIAC's page describes practical experience as helpful for mastering the material, not as an entry requirement.
GCFE — GIAC Certified Forensic Examiner	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR500 course is listed separately at $8,780.As published 2026-09-12 · source for GCFE — GIAC Certified Forensic Examiner cost	One proctored exam, remote or at a test centre. 82 questions, 3 hours, 70% to pass. GIAC's GCFE page does not describe this exam as using the CyberLive performance format.Exam only. The paired FOR500 course is six days instructor-led or about 36 hours self-paced, with four months of OnDemand access.	None published. GIAC describes the audience as anyone with a background in information systems, information security and computers.
GNFA — GIAC Network Forensic Analyst	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR572 course is priced on its SANS course page; we could not resolve that page at the time of writing, so treat the course figure as unconfirmed and check SANS directly.As published 2026-09-12 · source for GNFA — GIAC Network Forensic Analyst cost	One web-based proctored exam, remotely proctored or at a Pearson VUE centre. 66 questions, 3 hours, 70% to pass.Exam only. The paired FOR572 course is a six-day SANS course.	None published.
GREM — GIAC Reverse Engineering Malware	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR610 course is listed separately at $8,780.As published 2026-09-12 · source for GREM — GIAC Reverse Engineering Malware cost	One proctored exam. 66 questions, 3 hours, 73% to pass. GIAC classifies it as a practitioner certification using CyberLive, which its page describes as replacing traditional multiple-choice testing with performance-based challenges.Exam only. The paired FOR610 course is six days instructor-led or about 36 hours self-paced.	None published, but the material assumes comfort with assembly, debuggers and Windows internals — this is not an entry-level certification in practice.
GCTI — GIAC Cyber Threat Intelligence	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR578 course is listed separately at $8,780.As published 2026-09-12 · source for GCTI — GIAC Cyber Threat Intelligence cost	One proctored exam. 82 questions, 3 hours, 71% to pass, in GIAC's CyberLive performance-based format.Exam only. The paired FOR578 course is six days instructor-led or about 36 hours self-paced.	None published.
GCFR — GIAC Cloud Forensics Responder	GIAC (Global Information Assurance Certification)	$999 for the certification attempt on its own ($899 for a retake), per GIAC's general pricing table. The paired SANS enterprise cloud forensics course is priced separately on its SANS page.As published 2026-09-12 · source for GCFR — GIAC Cloud Forensics Responder cost	One proctored exam. 82 questions, 3 hours. GIAC's page states a 64% passing score for exams released on or after 25 July 2026 — a date-scoped figure, so confirm the mark that applies to your attempt.Exam only. The associated SANS course is titled around enterprise cloud forensics and incident response; we could not confirm its FOR course number from the GIAC page, so treat the course code as unconfirmed.	None formal. GIAC notes that practical work experience helps ensure mastery, and lists incident responders, SOC analysts, threat hunters and forensic analysts as the target roles.
CFCE — Certified Forensic Computer Examiner	IACIS (International Association of Computer Investigative Specialists)	$800 for the external CFCE certification process, with IACIS membership waived on purchase. Recertification after expiry is $350. The 72 training hours you must show first are a separate cost — IACIS's own BCFE course was listed at €4,800 for the October 2026 Budapest delivery.As published 2026-09-12 · source for CFCE — Certified Forensic Computer Examiner cost	Phase 1 peer review: four scenario-based practical problems, 30 days each, with an assigned coach; all four must pass. Phase 2 certification: a graded hard-drive practical over 30 days plus a written exam over 14 days, 80% minimum on both.Roughly a year in practice — four 30-day peer-review problems followed by the certification phase, which runs on IACIS's annual calendar.	Proof of 72 hours of training aligned to the CFCE core competencies. Non-law-enforcement candidates are eligible through the external track and Associate membership, which requires a background check.
CAWFE — Certified Advanced Windows Forensic Examiner	IACIS	Set as a member or non-member certification fee by IACIS; the figure is not published as static text on the CAWFE page, so treat the certification fee as unconfirmed. The associated AWFE course was listed at $995 for the 36-hour online delivery.As published 2026-09-12 · source for CAWFE — Certified Advanced Windows Forensic Examiner cost	Phase 1 written exam: 125 questions, up to 8 hours, open-book and not proctored, 80% minimum. Phase 2 practical: 30 days of Windows artefact analysis.Runs on an annual cycle — the written phase by 30 November and the practical by 31 December of the same year.	IACIS membership in good standing, or payment of the non-member fee. The CFCE is not a hard prerequisite.
ICMDE — IACIS Certified Mobile Device Examiner	IACIS	The certification fee is not published as static text on the ICMDE page; treat it as unconfirmed and ask IACIS. The supporting MDF and AMDF courses were each listed at $995 for the 36-hour online delivery.As published 2026-09-12 · source for ICMDE — IACIS Certified Mobile Device Examiner cost	A written exam (true/false, multiple choice, matching and short answer) inside a single 48-hour window once started, plus a 48-hour hands-on practical. 80% minimum on both.Two 48-hour assessment windows, taken on IACIS's certification calendar.	IACIS membership. The MDF and AMDF courses are the usual preparation.
CCE — Certified Computer Examiner	ISFCE (International Society of Forensic Computer Examiners)	$495 for the CCE examination, $250 for the two-year recertification, $150 for a retake. The required CCE training course is a separate $4,995 (listed at $3,996 with a published discount code), or $3,995 for the bootcamp. Law-enforcement, government and military discounts of 5-25% are noted.As published 2026-09-12 · source for CCE — Certified Computer Examiner cost	An online knowledge assessment plus practical examinations — forensically examining three distinct media sources and producing a comprehensive, detailed report for each. Candidates sign a code of ethics and submit a notarised statement of independent work; collaboration and plagiarism are expressly forbidden.Self-paced through the practicals; the training course that precedes it is a multi-day program or bootcamp.	Completion of the ISFCE CCE training course or an authorised training centre equivalent, or substitution of another recognised digital-forensics credential with documented experience. Full Member status additionally requires at least eighteen months of verifiable professional examination experience; candidates without it are awarded Associate status.
EnCE — EnCase Certified Examiner	OpenText (formerly Guidance Software)	$500 per exam attempt. OpenText states that its Learning Subscriptions do not include the exam fee, and the price of the required authorised courses was not published on the pages we could read — treat course cost as unconfirmed.As published 2026-09-12 · source for EnCE — EnCase Certified Examiner cost	Phase I written: 2 hours, true/false and multiple choice, administered through Certiverse, 80% minimum. Phase II practical: available for 60 days after passing Phase I, 18 questions, all must be answered, 85% minimum.Phase I is a two-hour sitting; Phase II runs inside a 60-day window after it.	Either 64 continuing professional education hours of authorised computer forensic instruction, or 12 months of work experience.
ACE — AccessData Certified Examiner (status uncertain)	Exterro (formerly AccessData)	No current price could be found. The former AccessData certification URL now redirects to Exterro's homepage rather than to any certification page, and Exterro's sitemap contains no certification URLs.As published 2026-09-12 · source for ACE — AccessData Certified Examiner (status uncertain) cost	Historically a knowledge and practical examination on FTK. Current format unknown — Exterro's training portal is a JavaScript application we could not inspect.Unknown.	Historically an FTK-focused examination. Current prerequisites unknown.
CHFI — Computer Hacking Forensic Investigator	EC-Council	EC-Council does not publish the exam voucher or training prices on the CHFI pages we could read, so no figure can be quoted. Expect the training bundle to be the dominant cost and ask for a written quote.As published 2026-09-12 · source for CHFI — Computer Hacking Forensic Investigator cost	Exam 312-49: 150 multiple-choice questions, 4 hours, with cut scores ranging from 60% to 85% depending on exam form. The five-day course includes 68 hands-on labs, but the labs are training content rather than a graded certification requirement.Five-day course in iLearn self-paced, iWeek live online or in-person partner delivery, plus the four-hour exam.	No prerequisite is stated on the CHFI page. EC-Council's general non-training eligibility route requires documented information-security experience; we could not confirm the figure for CHFI specifically.
CISSP — Certified Information Systems Security Professional	ISC2	Widely reported at $749 for the exam with a $135 annual maintenance fee, but ISC2's own pages we could read did not display those figures, so treat both as unconfirmed by primary source and check ISC2 directly.As published 2026-09-12 · source for CISSP — Certified Information Systems Security Professional cost	Computerised adaptive testing: 3 hours, 100-150 multiple-choice and advanced-format questions, pass mark 700 of 1000 scaled points, with performance required across all eight domains.A single three-hour adaptive exam.	Five years of cumulative, full-time experience in two or more of the eight CISSP domains. Up to one year is waivable with a qualifying four-year degree or an approved credential. Passing without the experience yields Associate of ISC2 status, valid six years.
Certified CyberDefender — CCDL1 and CCDL2	CyberDefenders	Not published on the certification or pricing pages we could read, so no figure can be quoted. The renewal fee and validity period are similarly not stated in the page content we could retrieve — ask CyberDefenders directly.As published 2026-09-12 · source for Certified CyberDefender — CCDL1 and CCDL2 cost	A 48-hour practical exam. CCDL1 is described as covering five sections across network forensics, disk forensics, perimeter defence, memory forensics and threat hunting; CCDL2 is a 48-hour practical across enterprise environments.A 48-hour examination window, after self-paced preparation on the lab platform.	Recommended rather than required: Windows and Linux fundamentals, basic command-line use and general networking knowledge for CCDL1. CCDL2 targets experienced analysts with a year or more of experience.
BTL1 — Blue Team Level 1	Centri (trading as Security Team Training Ltd; formerly Security Blue Team)	£399.00, which includes about 30 hours of coursework, four months of on-demand material access and one free resit voucher. Priced in pounds only; the dollar cost moves with the exchange rate.As published 2026-09-12 · source for BTL1 — Blue Team Level 1 cost	About 30 hours of coursework followed by one 24-hour practical incident-response exam with immediate grading and feedback.Four months of material access; the exam itself is a 24-hour window.	None. The provider states plainly that there are no entry requirements for the exam, and recommends it for people with zero to two years of experience.
BTL2 — Blue Team Level 2	Centri (formerly Security Blue Team)	£1,999.00, including five months of material access. Priced in pounds only.As published 2026-09-12 · source for BTL2 — Blue Team Level 2 cost	Up to 72 hours to complete a practical assessment and submit a written report, hand-graded, 70% to pass, with a distinction at 90% or above.Five months of material access; the assessment window is up to 72 hours.	No formal prerequisites. The provider recommends two or more years of experience and completing BTL1 first.
HTB Certified Defensive Security Analyst	Hack The Box Academy	$490, described on the certification page as covering fifteen modules with the exam included.As published 2026-09-12 · source for HTB Certified Defensive Security Analyst cost	Fifteen Academy modules followed by an included examination. Hack The Box's certification exams are practical; the precise structure is set out in the exam documentation rather than on the preview page.Self-paced through the modules, then the exam.	None stated.
CEDS — Certified E-Discovery Specialist	ACEDS (Association of Certified E-Discovery Specialists)	Not published in the pages we could read — ACEDS's pricing is served by a scripted page that returned no figures. Do not rely on a second-hand number; ask ACEDS for current exam and membership pricing.As published 2026-09-12 · source for CEDS — Certified E-Discovery Specialist cost	A proctored certification exam. The question count, time limit and pass mark were not retrievable from the pages we could read, so treat the exam mechanics as unconfirmed.Self-paced preparation, then the exam.	Not stated in the content we could retrieve. Study support includes a candidate handbook, a study manual and a mentorship programme.