- The GBFA at a Glance: Identity, Format, and Rules
- Fees, Access Window, and Proctoring Logistics
- All 19 Domains on One Page
- Acquisition Core: Dead Box, Live, Remote, and Mobile
- Storage, Filesystems, and Where Data Hides
- Triage and Evidence File Handling
- Open-Book Strategy for a 75-Question Sprint
- Validity, Renewal, and Where the Credential Is Used
- A Domain-Sequenced Review Plan
- Frequently Asked Questions
- GBFA is the GIAC Battlefield Forensics and Acquisition exam: 75 questions, 2 hours, minimum passing score of 69%.
- The exam fee is USD 999, a retake is USD 899, and renewal is USD 499, excluding tax.
- GIAC publishes 19 objective headings with no official percentage weights, so study breadth matters more than guessing weightings.
- The exam is open book for paper references only; electronic materials and Q&A-style notes are prohibited.
The GBFA at a Glance: Identity, Format, and Rules
GBFA stands for GIAC Battlefield Forensics and Acquisition. It is issued by GIAC Certifications, administered by GIAC, LLC, and it validates a practitioner's ability to acquire and triage digital evidence quickly and correctly, often under field conditions rather than in a leisurely lab. If you are still orienting yourself, the explainers at What Is GBFA Certification? and What Does GBFA Stand For? cover the naming and purpose in more depth. This cheat sheet is the compressed, review-the-night-before version.
| Item | Must-Know Fact |
|---|---|
| Full name | GIAC Battlefield Forensics and Acquisition (GBFA) |
| Governing body | GIAC Certifications; administered by GIAC, LLC |
| Exam format | One web-based proctored exam |
| Question count | 75 questions |
| Time limit | 2 hours |
| Minimum passing score | 69% (exam versions released on or after 2020-08-01) |
| Prerequisites | None required to begin; training is optional |
| Validity | 4 years |
| Recommended preparation | SANS FOR498: Digital Acquisition and Rapid Triage |
Two small but important clarifications. First, the 2020-08-01 date attached to the 69% passing score identifies which exam versions that standard applies to; it is not an outline edition. Second, GIAC's public objectives page publishes a passing score but no candidate pass rate, so any specific pass-rate figure you see quoted elsewhere is not from that source. For a sober treatment of what is and is not known, see GBFA Pass Rate 2026: What the Data Shows, and for the score mechanics see GBFA Passing Score 2026: Exactly What You Need to Pass.
Fees, Access Window, and Proctoring Logistics
The money side
- Exam attempt: USD 999
- Retake: USD 899
- Optional practice exam: USD 399
- Renewal: USD 499
- All prices exclude tax, per GIAC's pricing page.
Training is optional and priced separately from the exam attempt, which is why total cost varies so much from candidate to candidate. The full breakdown, including how different purchase paths change the bottom line, is in GBFA Certification Cost 2026: Complete Pricing Breakdown.
Access window and scheduling
A standalone attempt gives you initial access of 120 days from activation, and extensions are available under GIAC's certification attempt delivery policy. Treat activation as the starting gun: do not activate until your preparation is substantially complete. Scheduling windows and deadlines are covered in GBFA Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Proctoring
Testing is delivered through Pearson VUE (onsite) or ProctorU (remote), subject to the modality GIAC assigns. Eligibility details, including the fact that no prerequisites are required, are laid out in GBFA Requirements 2026: Eligibility, Prerequisites & How to Qualify.
All 19 Domains on One Page
GIAC's published objectives list 19 headings. Importantly, no official percentage weights are published, so you should not allocate study time on the basis of invented weightings. Plan for breadth, then deepen where your hands-on experience is thinnest. A detailed walk-through of each area lives in GBFA Exam Domains 2026: Complete Guide to All 19 Content Areas; here is the cheat-sheet grouping.
| Theme | Domains |
|---|---|
| Foundations | Computer Fundamentals; Physical Storage Devices; Storage Technologies; Specialty Device Fundamentals |
| Filesystems and data location | Filesystem Fundamentals; Windows Filesystems; Data on Drives; Manually Finding Data |
| Acquisition methods | Acquisition Preparation; Dead Box Acquisition; Host Based Live Acquisition; Acquiring RAM and OS Artifacts; Remote Acquisition; Data on the Network |
| Mobile | Mobile Device Acquisition; Mobile Device Triage |
| Triage and evidence | Manual Triage; Using Forensic Tools for Triage; Working With Evidence Files |
Acquisition Core: Dead Box, Live, Remote, and Mobile
The word "Acquisition" is in the credential's name for a reason. Expect scenario-driven questions that ask you to choose the right acquisition approach for a given situation and to understand the consequences of that choice.
Acquisition Preparation
Decisions made before you touch a device determine whether the evidence is usable.
- Know what to assemble and verify before arriving on scene
- Understand how scope, legal authority, and device type shape your plan
- Be able to justify the order of acquisition when volatility differs across sources
Dead Box Acquisition
Imaging a powered-off system's storage with the original media protected.
- Understand write-blocking concepts and why they matter for integrity
- Know how physical storage type affects the imaging method you choose
- Recognize when powering down is and is not appropriate
Host Based Live Acquisition and Acquiring RAM and OS Artifacts
Collecting from a running system, where order of volatility drives your decisions.
- Know why memory and other volatile data are collected first
- Understand the footprint your collection tools leave on the target
- Be able to explain which OS artifacts are only available while the system runs
Remote Acquisition and Data on the Network
Collecting across a network instead of at the keyboard.
- Know the trade-offs of remote collection versus local imaging
- Understand what network-resident data can reveal and how it is captured
- Think through bandwidth, access, and integrity considerations
Mobile Device Acquisition and Mobile Device Triage
Phones and tablets behave differently from PCs, and the exam treats them as their own domains.
- Understand how acquisition options differ for mobile versus traditional storage
- Know how to triage a mobile device quickly to decide what warrants deeper collection
- Appreciate how device state affects what you can obtain
Key Takeaway
Do not memorize acquisition methods as a flat list. For each one, be able to state when you would choose it, what it preserves, what it destroys or alters, and how you would document that decision. Scenario questions reward that reasoning.
Storage, Filesystems, and Where Data Hides
Roughly a third of the domain list is foundational knowledge that supports everything else. Candidates with strong tool skills but thin fundamentals often struggle here, because questions probe why something happens, not just which button to press.
Hardware and storage layers
- Computer Fundamentals: how systems boot and how data moves between components
- Physical Storage Devices and Storage Technologies: how different media store and manage data, and how that influences recovery and imaging
- Specialty Device Fundamentals: devices outside the typical desktop and laptop mold, where standard assumptions may not hold
Filesystem knowledge
- Filesystem Fundamentals: the structures that map files to storage, and how deletion and allocation behave
- Windows Filesystems: the on-disk structures and metadata specific to Windows environments, which dominate real-world casework
- Data on Drives: how data is organized across a drive, including areas outside normal file content
- Manually Finding Data: locating evidence without relying on an automated tool, which tests whether you understand the underlying structures
Triage and Evidence File Handling
Triage is the defining mindset of this credential: get the most decision-relevant information, fast, without compromising evidentiary value.
Manual Triage vs. Using Forensic Tools for Triage
Two separate domains, because both capabilities matter.
- Understand what can be learned quickly by hand-inspecting artifacts
- Know how triage tools accelerate collection and what their limits are
- Be able to decide when triage is sufficient and when full imaging is required
Working With Evidence Files
Once data is acquired, it must be handled in a way that preserves its integrity and usability.
- Know common evidence file concepts and how they are opened and verified
- Understand integrity verification and why it underpins defensibility
- Be comfortable moving between acquisition outputs and analysis workflows
The optional but recommended preparation course, SANS FOR498: Digital Acquisition and Rapid Triage, is aligned with this subject area. Its syllabus is a useful source of topic ideas, but it is a preparation curriculum, not an official statement of exam coverage, so always reconcile your study against GIAC's 19 published headings. For a fuller preparation roadmap, see GBFA Study Guide 2026: How to Pass on Your First Attempt and the overview at GBFA Training.
Open-Book Strategy for a 75-Question Sprint
An open-book exam with paper references sounds forgiving, but 96 seconds per question punishes anyone who has to hunt through a binder for every answer. The reference material should accelerate recall of things you already understand.
- Index by domain name. Use GIAC's 19 headings as your tab structure so you can jump to the relevant area immediately.
- Record structures and syntax, not prose. Compact tables of artifact locations, filesystem structure elements, and tool command patterns beat paragraphs.
- Keep Q&A out. Notes derived from exam or practice question content are prohibited, so build from concepts.
- Mark and move. If a question needs more than a quick lookup, flag it and return after the easy points are banked.
- Verify allowed materials before exam day. Confirm the proctor rules in GIAC's reference guide so nothing is confiscated mid-session.
Key Takeaway
If you cannot answer a topic without your notes during practice, you will lose time on exam day. Use the open-book allowance as insurance for details, not as a substitute for understanding. For a candid read on difficulty, see How Hard Is the GBFA Exam? Complete Difficulty Guide 2026.
Timed practice is the best way to calibrate your pace and reference-lookup speed; the GBFA practice tests are built for exactly that kind of rehearsal.
Validity, Renewal, and Where the Credential Is Used
Keeping the certification current
- Validity: 4 years
- Renewal path A: 36 approved CPE credits earned during the active four-year cycle
- Renewal path B: pass a renewal exam
- Fee either way: USD 499 renewal fee
Plan your CPE accumulation across the cycle rather than scrambling in the final months. Details are in GIAC's renewal how-to guide.
Who this credential is for
GBFA fits roles where evidence must be collected quickly and defensibly: digital forensics and incident response teams, corporate investigators, law enforcement and government digital evidence units, and consultants who deploy to client sites. It signals practical acquisition and triage competence rather than deep malware analysis or advanced artifact interpretation. For hiring-side detail, see GBFA Jobs; for compensation context without invented figures, GBFA Salary Guide 2026: Complete Earnings Analysis; and to weigh the investment, Is the GBFA Certification Worth It? Complete ROI Analysis 2026.
A Domain-Sequenced Review Plan
Because there are no published weights, sequence your review by dependency: foundations first, then acquisition, then triage and evidence handling. This is the single study-planning section in this cheat sheet, and it is tied directly to the GBFA domain list.
Foundations
- Computer Fundamentals, Physical Storage Devices, Storage Technologies
- Specialty Device Fundamentals, to close any gaps beyond PCs
Filesystems and Data Location
- Filesystem Fundamentals, Windows Filesystems, Data on Drives
- Manually Finding Data, practiced without tool assistance
Acquisition Methods
- Acquisition Preparation, Dead Box Acquisition, Host Based Live Acquisition
- Acquiring RAM and OS Artifacts, Remote Acquisition, Data on the Network
Mobile, Triage, and Evidence Files
- Mobile Device Acquisition and Mobile Device Triage
- Manual Triage, Using Forensic Tools for Triage, Working With Evidence Files
- Timed full-length practice and reference-index refinement
Adjust the pace to your background; an experienced responder may compress the foundations, while a newcomer may need more time on filesystems. Remember the 120-day access window when deciding when to activate your attempt. For an at-a-glance companion to this page, you can also revisit the broader GBFA Certification overview, and when you are ready to test yourself, head to the practice test site.
Frequently Asked Questions
The GBFA is one web-based proctored exam with 75 questions and a 2-hour time limit. Confirm any attempt-specific details, such as question types, in your GIAC account's Certification Information.
The minimum passing score is 69%, applicable to exam versions released on or after 2020-08-01. GIAC publishes the passing score but not a candidate pass rate.
Yes, paper references are allowed because the exam is open book. Electronic references, internet access, and materials containing exam or practice Q&A are prohibited, so build your notes from concepts rather than question content.
No. There are no prerequisites to begin the certification process and training is optional. SANS FOR498: Digital Acquisition and Rapid Triage is the recommended preparation, but it is not required.
The certification is valid for 4 years. Renewal requires either 36 approved CPE credits earned during the cycle or passing a renewal exam, plus the USD 499 renewal fee.