Certified Advanced Windows Forensic Examiner

The Certified Advanced Windows Forensic Examiner (CAWFE) program is administered by the IACIS Advanced Certification Subcommittee. The CAWFE Certification is drawn from a set of competencies approved by several committees and the IACIS Board of Directors.

The CAWFE program is an assessment process and not a simple, single test.  The process is composed of two separate assessments. The first component is the written examination, administered via the IACIS Moodle site. The second component is a practical assessment whereby candidates must answer questions that relate directly to a series of image files and Windows artifacts.

Application for the CAWFE Certification program must be made directly to the IACIS Advanced Certification Subcommittee prior to being enrolled in the CAWFE Moodle assessment program. If the candidate is required to pay a fee to register for the CAWFE certification, the requisite fee must be paid to the IACIS Treasurer BEFORE submitting the CAWFE application.

The next CAWFE cycle will be announced soon.

General qualifications for enrollment in the CAWFE Certification

Those desiring to enter the CAWFE Certification Program must be:

  • Be an IACIS member in good standing
  • Be a non-IACIS member meeting all the below requirements
  • Program fees must be paid if required (fee waived for students attending training class for next offered cycle only)

 The CAWFE Certification Program is a two-step process in which you must first successfully complete the written examination. This written examination is a TIMED exam which will test your knowledge of the CAWFE competencies. The entire written examination consists of questions broken up into (4) four separate timed examinations. Each part of the written examination has a time limit of 80 minutes. Although the written exam is not proctored and is open book, once you commence one part of the examination, you must complete it in one sitting.  “Pausing” of the exam time clock is not permitted. 

Candidates do not have to take all four parts of the written examination at once.  For example, a candidate may elect to take part 1 of the written exam on Monday, part 2 on Tuesday, part 3 on Thursday, and part 4 on Saturday. The candidate would have 1.5 hours to complete each part.  The exam can be taken at any location the candidate chooses that has a reliable high-speed Internet connection.

The written exam consists of questions composed of true/false, multiple-choice, matching, and short answer (fill in the blank) questions. There are no questions that require full sentences or an essay answer. The exam is graded by combining the scores from all four parts of the written examination.  Candidates must obtain a minimum score of 80% on the exam to pass. Candidates who achieve a passing score will be allowed to proceed onto the practical exam.

Candidates who receive a failing score on the exam will have their exams reviewed by the Chairman of Advanced Certification and will be notified by e-mail of their official results after the review is conducted. The exam is designed to be pass/fail and candidates will not see the actual percentage score. There will be only one attempt on each part of the CAWFE examination. Failure on the written examination will result in the candidate being removed from the CAWFE certification program and not continuing to the next phase of the certification process.

What do you need to take the exam:

  • Enough time set aside to complete each segment in the time required.
  • Good internet connection
  • Computer with Moodle compatible browser.

What do you need to take the practical exam:

  • Any forensic tool of your choice
  • Access to Internet with good speed to download image file
  • Moodle compatible browser

What happens if I fail either part:

  • Failure to pass the written exam will result in not being eligible to take the practical exam
  • You must wait a minimum of 60 days to take the test again. No more than 180 days to retry at no additional cost.
  • After 180 days, you will be require to reapply and pay the fee for the exam.
  • To re-enter, you must apply to the CAWFE chairman.

Note: Each candidate will be allowed to be re-examined one time without an additional charge. For subsequent attempts the candidate will be assessed the requisite fees as set by the Board of Directors and posted on the IACIS web site. A candidate must complete at least 80% of the initial exam attempt to be eligible to be re-examined.