- How the 19 GBFA Domains Are Published
- Exam Format and Registration Mechanics
- Foundations: Computer, Storage, and Filesystem Domains
- Acquisition Domains: Dead Box, Live, Remote, and RAM
- Triage Domains: Manual, Tool-Based, and Mobile
- Data Location, Network Data, and Evidence Files
- Sequencing the Domains Across Your Preparation
- Where the Credential Fits in the Job Market
- Domain and Exam FAQ
- GIAC publishes 19 exam-objective headings for GBFA, but no official percentage weights for any of them.
- The exam is one proctored session: 75 questions in 2 hours, with a 69% minimum passing score.
- The exam is open book with paper references only; electronic materials and internet access are prohibited.
- The recommended course is SANS FOR498: Digital Acquisition and Rapid Triage, though training is optional.
How the 19 GBFA Domains Are Published
GIAC Battlefield Forensics and Acquisition (GBFA) is a GIAC certification aimed at collecting and triaging digital evidence quickly, often outside a comfortable lab setting. GIAC's public certification page lists 19 exam-objective headings, and this guide walks through every one of them using GIAC's own names. If you are new to the credential, start with our explainers on what GBFA certification is and what GBFA stands for, then return here.
Two points about the published outline deserve attention before you build a plan:
- No official weights. GIAC's public page names the 19 areas but does not assign percentages to them. Any site that claims "Domain 6 is 14% of the exam" is inventing a number. Treat all 19 areas as fair game and weight your time by your own gaps.
- No separately versioned outline. The page does not identify an outline edition. The 69% passing score applies to exam versions released on or after 2020-08-01, which tells you about scoring, not about when the objectives were last revised.
Exam Format and Registration Mechanics
Knowing the format shapes how you study each domain. GBFA is a single web-based proctored exam with 75 questions and a 2-hour limit, which works out to well under two minutes per question. The minimum passing score is 69%. For a deeper look at scoring, see our GBFA passing score breakdown.
| Item | GBFA Detail |
|---|---|
| Questions | 75 |
| Time limit | 2 hours |
| Minimum passing score | 69% |
| Exam fee | USD 999 (excludes tax) |
| Retake fee | USD 899 |
| Optional practice exam | USD 399 |
| Renewal fee | USD 499 |
| Proctoring | Pearson VUE onsite or ProctorU remote, per GIAC's assigned modality |
| Reference materials | Open book, paper references only |
| Attempt access | 120 days from activation; extensions available |
| Certification validity | 4 years |
Our GBFA certification cost guide covers how these fees combine, and the GBFA requirements article confirms that no prerequisites are needed to begin the process and that training is optional.
What "open book" means for domain study
You may bring paper references, but electronic references, internet access, and any materials containing exam or practice Q&A are prohibited. That rule shapes preparation: your index, notes, and course books are your lookup system, and a 2-hour clock means you cannot afford to hunt for answers on every question. Build a paper index organized by the 19 domain names so you can find a topic in seconds. Our GBFA cheat sheet shows a compact way to structure the most important facts.
Foundations: Computer, Storage, and Filesystem Domains
Six of the 19 domains build the technical vocabulary that every acquisition decision depends on. These are the areas where a candidate with an IT background moves fastest, and where a candidate from a purely investigative background needs the most reading.
Domain 3: Computer Fundamentals
The base layer: how a system boots, how components interact, and where evidence can reside in a running or powered-off machine.
- Know what state a system is in (running, sleeping, off) and what each state means for volatile data.
- Understand how hardware and firmware influence what an examiner can access.
Domain 13: Physical Storage Devices
The hardware you will actually pick up, connect, and image.
- Distinguish device types and the interfaces used to connect them.
- Recognize how a device's physical design affects safe handling and acquisition approach.
Domain 16: Storage Technologies
How data is organized and managed across storage systems, beyond a single bare drive.
- Understand how storage layers can change what you see versus what is physically present.
- Be able to reason about why an acquisition of one configuration differs from another.
Domain 7: Filesystem Fundamentals
The general principles behind how filesystems map names, metadata, and content to storage.
- Know the difference between file content, file metadata, and filesystem structures.
- Understand how deletion and allocation affect recoverable data.
Domain 18: Windows Filesystems
The Windows-specific application of filesystem concepts, which is where most field acquisitions land.
- Focus on how Windows filesystem structures record and preserve activity.
- Expect scenario questions where you must identify what a structure can or cannot tell you.
Domain 4: Data on Drives
What lives on a drive and how it is arranged, including areas that ordinary file browsing does not reveal.
- Understand the layers between raw sectors and user-visible files.
- Be able to explain where hidden or unallocated data can persist.
If you are weighing how much foundational reading to do, our GBFA difficulty guide discusses which backgrounds tend to find these domains easy and which find them steep.
Acquisition Domains: Dead Box, Live, Remote, and RAM
The word "Acquisition" is in the certification's name, and six domains are devoted to collection methods and their preparation. Questions here tend to be decision-oriented: given a situation, which approach preserves the most valuable evidence with the least risk?
Choosing between methods
| Domain | Core Question It Tests |
|---|---|
| Domain 2: Acquisition Preparation | What must be ready, documented, and decided before you touch the evidence? |
| Domain 6: Dead Box Acquisition | How do you image a powered-down system or removed media correctly? |
| Domain 8: Host Based Live Acquisition | How do you collect from a running system while minimizing changes to it? |
| Domain 14: Remote Acquisition | How do you collect from a system you are not physically beside? |
| Domain 1: Acquiring RAM and OS Artifacts | How do you capture volatile memory and operating-system artifacts before they vanish? |
| Domain 11: Mobile Device Acquisition | How do you collect from phones and similar devices, given their different constraints? |
Why preparation gets its own domain
Domain 2, Acquisition Preparation, is easy to underestimate because it sounds administrative. In practice, preparation decisions determine whether an acquisition holds up: what tools and write-protection you have ready, what you document, and how you plan around the target's state. Candidates who treat it as common sense tend to lose points on questions that test specific, deliberate choices.
The recommended SANS course, FOR498: Digital Acquisition and Rapid Triage, is structured around these skills, and the public brochure is a reasonable orientation to the practical flavor of the material. Course sections are unweighted preparation curriculum, not an exhaustive map of exam coverage, so use them to build skill rather than to predict question counts. Our GBFA training overview compares course-based and self-directed routes.
Triage Domains: Manual, Tool-Based, and Mobile
"Battlefield" in the certification name points to speed-sensitive work: deciding quickly which devices and data matter. Four domains address triage directly.
Domain 9: Manual Triage
Reviewing a system by hand to find high-value evidence quickly, without a full forensic suite.
- Know which locations and artifacts answer the most common investigative questions fastest.
- Understand the trade-off between speed and completeness.
Domain 17: Using Forensic Tools for Triage
Applying forensic software to prioritize evidence rapidly.
- Be able to explain what a triage tool collects and what it leaves behind.
- Recognize when a tool-driven approach is appropriate versus a full acquisition.
Domain 12: Mobile Device Triage
Quickly assessing phones and similar devices to decide what warrants deeper acquisition.
- Understand what can be learned on the spot and what requires a formal extraction.
- Know how device state affects what you can safely do.
Domain 15: Specialty Device Fundamentals
Devices outside the standard laptop-and-phone category that still hold evidence.
- Recognize that unusual devices need adapted acquisition thinking.
- Be ready to apply general principles to hardware you have not seen before.
A useful way to separate Domains 9 and 17: manual triage tests whether you know where to look and why, while tool-based triage tests whether you understand what the tool is doing on your behalf. Both reward the same underlying knowledge of artifacts.
Data Location, Network Data, and Evidence Files
The remaining domains cover finding data and handling what you have collected.
- Domain 10: Manually Finding Data. Locating evidence without relying on automated parsing, which depends on solid filesystem knowledge from Domains 4, 7, and 18.
- Domain 5: Data on the Network. What evidence exists in network activity and infrastructure, and how it relates to endpoint evidence.
- Domain 19: Working With Evidence Files. Handling acquired images and evidence containers: how they are stored, verified, and used in later analysis.
Key Takeaway
Domain 19 is where acquisition quality becomes provable. Understand how evidence files are structured and verified, because a flawless collection is of little use if you cannot demonstrate its integrity afterward.
Because the exam is open book, Domains 10 and 19 lend themselves well to well-built paper references: tables of locations, file structure notes, and verification steps are exactly what an index can accelerate.
Sequencing the Domains Across Your Preparation
Generic scheduling advice is less useful than a sequence that follows how the domains depend on one another. A reasonable order moves from foundations to collection to triage, with evidence handling threaded throughout. For full planning detail, see our GBFA study guide.
Foundations
- Domains 3, 13, 16, 4: hardware, storage, and what lives on drives.
- Domains 7 and 18: filesystem principles, then Windows specifics.
Collection methods
- Domains 2, 6, 8, 14, 1: preparation, dead box, live, remote, and RAM.
- Practice articulating why one method fits a scenario better than another.
Triage and devices
- Domains 9, 17, 10: manual and tool-based triage, plus finding data by hand.
- Domains 11, 12, 15: mobile acquisition, mobile triage, and specialty devices.
Integration and indexing
- Domains 5 and 19: network data and evidence files.
- Finish your paper index by domain name and run timed practice sets against the 2-hour limit.
Foundations come first because the acquisition and triage questions assume you already understand the storage and filesystem concepts underneath them. When you reach timed practice, the GBFA practice tests let you rehearse the 75-question, 2-hour pacing. Remember that GIAC does not publish a candidate pass rate, so our GBFA pass rate article explains what can and cannot be said about it.
Where the Credential Fits in the Job Market
GBFA targets practitioners who collect and triage digital evidence under time pressure: incident responders, digital forensic examiners, and investigators who deploy to scenes or remote sites. The domain list reflects that mix, covering endpoints, mobile devices, specialty hardware, and network data. Roles that touch these tasks span corporate security teams, consultancies, and government and law-enforcement settings. For openings and role titles, see GBFA jobs, and for compensation context without invented figures, read the GBFA salary guide and the GBFA ROI analysis.
The certification stays valid for 4 years. Renewal requires 36 approved CPE credits earned during the active cycle, or a passing renewal exam, plus the renewal fee. Practical consequence: the domain knowledge you build now should be maintained through ongoing hands-on work rather than treated as one-time memorization. To try questions in the same style as the real exam, take a set on the main practice test site.
Domain and Exam FAQ
GIAC's public objectives page lists the 19 headings without official percentage weights, so no weighting should be assumed. Prepare across all 19 and use your own practice results to decide where to spend extra time.
Yes, in paper form. The exam is open book with paper references, but electronic references, internet access, and materials containing exam or practice Q&A are prohibited. Organizing your paper index by domain name makes lookups faster within the 2-hour limit.
No. No prerequisites are required to begin the certification process, and training is optional. FOR498: Digital Acquisition and Rapid Triage is the recommended preparation, but the course is separate from the proctored exam and does not define exhaustive exam coverage.
The exam has 75 questions and a 2-hour time limit, delivered as one web-based proctored session. The minimum passing score is 69%. Your GIAC account's Certification Information governs the details of your specific attempt.
Initial standalone-attempt access is 120 days from activation, and extensions are available under GIAC's attempt delivery policy. See our GBFA exam dates guide for scheduling considerations.