Certified Advanced Windows Forensic Examiner

The Certified Advanced Windows Forensic Examiner (CAWFE) program is administered by the IACIS Advanced Certification Subcommittee. The CAWFE Certification is drawn from a set of competencies approved by several committees and the IACIS Board of Directors.

The CAWFE program is an assessment process and not a simple, single test.  The process is composed of two separate assessments. The first component is the written examination, administered via the IACIS Moodle site. The second component is a practical assessment whereby candidates must answer questions that relate directly to a series of image files and Windows artifacts.

Application for the CAWFE Certification program must be made directly to the IACIS Advanced Certification Subcommittee prior to being enrolled in the CAWFE Moodle assessment program. If the candidate is required to pay a fee to register for the CAWFE certification, the requisite fee must be paid to the IACIS Treasurer BEFORE submitting the CAWFE application.

The next CAWFE cycle will be announced soon.

General qualifications for enrollment in the CAWFE Certification

Those desiring to enter the CAWFE Certification Program must be:

  • Be an IACIS member in good standing
  • Be a non-IACIS member meeting all the below requirements
  • Program fees must be paid if required (fee waived for students attending training class for next offered cycle only)

 The CAWFE Certification Program is a two-step process in which you must first successfully complete the written examination. This written examination is a TIMED exam which will test your knowledge of the CAWFE competencies. The entire written examination consists of questions broken up into (4) four separate timed examinations. Each part of the written examination has a time limit of 80 minutes. Although the written exam is not proctored and is open book, once you commence one part of the examination, you must complete it in one sitting.  “Pausing” of the exam time clock is not permitted. 

Candidates do not have to take all four parts of the written examination at once.  For example, a candidate may elect to take part 1 of the written exam on Monday, part 2 on Tuesday, part 3 on Thursday, and part 4 on Saturday. The candidate would have 1.5 hours to complete each part.  The exam can be taken at any location the candidate chooses that has a reliable high-speed Internet connection.

The written exam consists of questions composed of true/false, multiple-choice, matching, and short answer (fill in the blank) questions. There are no questions that require full sentences or an essay answer. The exam is graded by combining the scores from all four parts of the written examination.  Candidates must obtain a minimum score of 80% on the exam to pass. Candidates who achieve a passing score will be allowed to proceed onto the practical exam.

Candidates who receive a failing score on the exam will have their exams reviewed by the Chairman of Advanced Certification and will be notified by e-mail of their official results after the review is conducted. The exam is designed to be pass/fail and candidates will not see the actual percentage score. There will be only one attempt on each part of the CAWFE examination. Failure on the written examination will result in the candidate being removed from the CAWFE certification program and not continuing to the next phase of the certification process.

What do you need to take the exam:

  • Enough time set aside to complete each segment in the time required.
  • Good internet connection
  • Computer with Moodle compatible browser.

What do you need to take the practical exam:

  • Any forensic tool of your choice
  • Access to Internet with good speed to download image file
  • Moodle compatible browser

CAWFE Recertification

The same requirements of our CFCE Recertification apply to the CAWFE certification.

The Recertification Requirements are:

  1. One proficiency exercise must be successfully completed in the third year following initial certification or recertification.  The exercise only counts when taken in the final year of certification period.
  2. Previous three years dues paid (if IACIS member), Recertification Fee* paid (if non-Member or delinquent in any previous dues year).
  3. Forty (40) hours of continuing education in the field of computer/digital forensics.
    • Only classes where attendance is documented and certificates issued will be accepted.  No webinars or other undocumented training can be submitted. Certificants must provide copies of completed courses, training certificates, or other documentation to the Recertification Subcommittee when the application for recertification is submitted.
    • Certificants who teach related topics in computer/digital forensics,information technology, or investigations may apply formal classroom hours to this requirement.  The Recertification Committee reserves the right to verify training documented by a certificant.
  4. Certificants must demonstrate that they are working in the field of computer/digital forensics accomplishing one of the following:
    • Completing at least three (3) computer/digital forensic examinations.
    • Supervising or managing a related function
    • Completing three (3) IACIS proficiency tests within three years.
  5. Certificants must read and agree to uphold the current IACIS Ethical Code of Conduct.

The CFCE Recertification provides more details on the Recertification Process. Questions about the CAWFE Recertification should be directed to the CAWFE Certification Chair.