Certified Advanced Windows Forensic Examiner
The Certified Advanced Windows Forensic Examiner (CAWFE) program is administered by the IACIS Advanced Certification Subcommittee. The CAWFE Certification is drawn from a set of competencies approved by several committees and the IACIS Board of Directors.
The CAWFE program is an assessment process and not a simple, single test. The process is composed of two separate assessments. The first component is the written examination, administered via the IACIS Moodle site. The second component is a practical assessment whereby candidates must answer questions that relate directly to a series of image files and Windows artifacts.
Application for the CAWFE Certification program must be made directly to the IACIS Advanced Certification Subcommittee prior to being enrolled in the CAWFE Moodle assessment program. If the candidate is required to pay a fee to register for the CAWFE certification, the requisite fee must be paid to the IACIS Treasurer BEFORE submitting the CAWFE application.
The next CAWFE cycle will be announced soon.
General qualifications for enrollment in the CAWFE Certification
Those desiring to enter the CAWFE Certification Program must be:
- Be an IACIS member in good standing
- Be a non-IACIS member meeting all the below requirements
- Program fees must be paid if required (fee waived for students attending training class for next offered cycle only)
The CAWFE Certification Program is a two-step process in which you must first successfully complete the written examination. This written examination is a TIMED exam which will test your knowledge of the CAWFE competencies. The written examination consists of a timed test of 125 questions. The maximum time allowable is eight hours. Although the written exam is not proctored and is open book, once you commence the examination, you must complete it within the allotted time. “Pausing” of the exam time clock is not permitted. The Moodle test platform does allow you to leave and re-enter, but the test “end time” does not change.
The exam can be taken at any location the candidate chooses. A reliable high-speed Internet connection is recommended.
The written exam consists of questions composed of true/false, multiple-choice, matching, and short answer (fill in the blank) questions. There are no questions that require full sentences or an essay answer. Candidates must obtain a minimum score of 80% on the exam to pass. The exam is designed to be pass/fail and candidates will not see the actual percentage score. Candidates who achieve a passing score will be allowed to proceed on to the practical exam.
Once admitted to the next phase, candidates will have 30 days to complete the practical exam.
Candidates who receive a failing score on the written or practical exams are eligible for one retest of one exam. The retest is available immediately upon notification that the candidate did not achieve a passing score. It is advisable that the candidate review course material before attempting the retest. Note that only ONE retest is allowed. If the candidate fails the written test and successfully completes the written retest, and subsequently fails the practical, it will not be possible to retest the practical.
The written exam phase, including any retest, MUST be completed by November 30. The practical phase, including any retest, MUST be completed by December 31.
What you need to take the exam:
- Enough time set aside to complete the exam in the time required.
- Good internet connection
- Computer with Moodle compatible browser.
What you need to take the practical exam:
- Any forensic tool of your choice
- Access to Internet with good speed to download image file
- Moodle compatible browser
CAWFE Recertification
The same requirements of our CFCE Recertification apply to the CAWFE certification.
The Recertification Period is open from February 1st through December 31st of every year. Registration will close on December 15th.
The Recertification Requirements are:
- One proficiency exercise must be successfully completed in the third year following initial certification or recertification. The exercise only counts when taken in the final year of certification period.
- Previous three years dues paid (if IACIS member), Recertification Fee* paid (if non-Member or delinquent in any previous dues year).
- Forty (40) hours of continuing education in the field of computer/digital forensics.
- Only classes where attendance is documented and certificates issued will be accepted. No webinars or other undocumented training can be submitted. Certificants must provide copies of completed courses, training certificates, or other documentation to the Recertification Subcommittee when the application for recertification is submitted.
- Certificants who teach related topics in computer/digital forensics,information technology, or investigations may apply formal classroom hours to this requirement. The Recertification Committee reserves the right to verify training documented by a certificant.
- Certificants must demonstrate that they are working in the field of computer/digital forensics accomplishing one of the following:
- Completing at least three (3) computer/digital forensic examinations.
- Supervising or managing a related function
- Completing three (3) IACIS proficiency tests within three years.
- Certificants must read and agree to uphold the current IACIS Ethical Code of Conduct.
The CFCE Recertification provides more details on the Recertification Process. Questions about the CAWFE Recertification should be directed to the CAWFE Certification Chair.
