Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by GIAC
Exam Format
120 min
75
69%
Practitioner
Registration
$999 USD
ProctorU, PearsonVUE, or online proctoring
Validity
4 years
Pass current version of exam; Earn 36 CPE credits in approved categories
GBFA Exam Topics and Domains
GBFA is organized into 12 weighted domains. Expect to work with Autopsy, AWS, Azure, BitLocker, and more.
1
Computer Fundamentals
5%
Machine Configuration and Boot Processes
Basic Computer ConceptsNetwork Fundamentals for Acquisition
- Be familiar with basic computer concepts in preparation for acquisition
- Understand boot processes and firmware types
- Recognize network fundamentals relevant to forensic acquisition
2
Physical Storage Devices and Technologies
8%
Physical Storage Devices
Storage Device Types
- Compare and contrast different forms of physical storage devices
- Understand device interfaces and connection types
- Identify common HDD problems affecting acquisition
Storage Technologies
RAID Configurations
- Summarize, compare, and contrast common storage technologies
- Understand different RAID configurations and their implications
3
Filesystem Fundamentals
10%
Common Filesystems
Filesystem Types
- Describe basic concepts of common filesystems
- Understand functionality of Master File Tables and File Allocation Tables
Windows Filesystems
FAT, exFAT, and NTFS
- Compare and contrast major Windows filesystems
- Understand differences between FAT, exFAT, and NTFS
4
Data Storage and Access
8%
Data on Drives
Data Storage Methods
- Summarize different ways data on drives can be stored and accessed
- Understand encryption challenges in forensic acquisition
- Handle deleted files appropriately
Working With Evidence Files
Evidence File Formats
- Compare and contrast common evidence file formats
- Understand how evidence files can be accessed and used in investigations
5
Acquisition Preparation and Management
8%
Scene Management and Evidence Assessment
Scene ManagementAcquisition Verification
- Summarize the goals of scene management
- Assess evidence and recognize tampering
- Verify acquisitions using hash algorithms
6
Dead Box Acquisition
10%
Dead Box Acquisition Methods
Write BlockingMedia Removal and Imaging
- Describe different methods for performing dead box acquisition
- Understand write blocking techniques
- Execute proper media removal and imaging
7
Host Based Live Acquisition
10%
Live Acquisition Techniques
Live System AcquisitionAcquiring RAM and OS Artifacts
- Describe different methods for host based live acquisition
- Use software and hardware write blocking in live environments
- Acquire RAM, macOS systems, and Shadow copies
8
Remote and Network Acquisition
8%
Remote Acquisition
Network-Based Acquisition
- Describe different methods for performing remote acquisitions
- Leverage common cloud provider products for acquisition
Data on the Network
Network Traffic and Tools
- Describe different ways data can exist in motion
- Use network tools to discover networked devices
- Capture and analyze network traffic
9
Mobile Device Acquisition
10%
Mobile Device Acquisition Methods
Mobile Acquisition Techniques
- Describe different methods used to perform mobile device acquisition
- Isolate portable devices from radio signals
- Identify specific mobile devices
Mobile Device Triage
Mobile Data Triage
- Outline ways to triage data from mobile devices
- Handle Android and Apple specific scenarios
- Triage mobile apps, calendars, and emails
10
Specialty Device Acquisition
6%
Specialty Device Fundamentals
macOS Acquisition
- Describe basic concepts of common specialty devices
- Use System Profiler and Device Information Collection on macOS
11
Manual Triage and Data Discovery
10%
Manual Triage
Manual Triage Techniques
- Be familiar with manual techniques and tools used to select and triage data
- Identify quick wins in forensic investigations
Manually Finding Data
Data Discovery Methods
- Outline different ways data can be manually found
- Carve metadata and recover files
- Locate hidden or deleted data
12
Using Forensic Tools for Triage
7%
Forensic Tool Usage
Popular Forensic Tools
- Compare and contrast ways popular forensic tools can be used in data triage
- Select appropriate tools for specific triage scenarios
How do I earn this certification?
Passing GBFA earns the GIAC Battlefield Forensics and Acquisition certification. It sits in the Digital Forensics and Incident Response track.
Next Level Options
- GCFA - GIAC Certified Forensic AnalystAdvanced forensic analysis and incident investigation
- GCFE - GIAC Certified Forensic Examiner Windows forensic examination
- GNFA - GIAC Network Forensic AnalystNetwork-based forensic analysis
Alternative Paths
- GIME - GIAC iOS and macOS Examiner Specialized mobile device forensics for Apple ecosystem
- GMON - GIAC Continuous Monitoring CertificationContinuous monitoring and threat detection skills
- GCIH - GIAC Certified Incident HandlerBroader incident handling and response capabilities
- GREM - GIAC Reverse Engineering MalwareDeep malware analysis complementing forensic skills
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for GBFA is by using the PlanetCert Simulator to practice questions and review detailed explanations.
Who should take this exam?
This exam is typically taken by Federal agents and law enforcement personnel and Digital forensic analysts.
- Background in information security
- Basic understanding of digital forensics concepts
- Experience with Windows and Linux operating systems
- Familiarity with file systems and storage devices