GCFE practice labs, one case at a time
The GCFE objectives expect an examiner who can read Windows artifacts without a cheat sheet: program execution from Prefetch, UserAssist and Amcache; file knowledge from LNK files and jump lists; USB device history from the registry; persistence in Run keys, services and scheduled tasks; browser activity; and the Security event log, all pulled together into one defensible timeline.
This pathway builds those skills in that order, all but Amcache and scheduled tasks, which its evidence doesn't include. Five First Look cases isolate one artifact family each, two medium cases apply them to a departing engineer's workstation and a customer export, two hard cases add a mailbox, memory and a packet capture, and the capstone rebuilds a quiet intrusion from disk, memory and cloud logs. Each case generates a different variant per student, so the practice is on reading evidence, not memorizing answers.
10 cases · ~17 h 57 min of lab time · Easy to Expert · a different variant for everyone · verified answer keys
The pathway, in order
10 cases, about 17 h 57 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
First Look: What Ran on This Machine
Execution: Prefetch, UserAssist and shortcuts.
EASY~33 minUp to 15 questions -
02
First Look: Recent Files and Jump Lists
Recent files, LNK and jump lists.
EASY~33 minUp to 15 questions -
03
First Look: USB Device History
USB device history in the registry.
EASY~33 minUp to 15 questions -
04
First Look: What Runs at Startup
Find autostart entries in the registry and services.
EASY~33 minUp to 15 questions -
05
First Look: Building a Timeline
Assemble a multi-artifact timeline.
EASY~37 minUp to 15 questions -
06
Paper Trail (Insider Data Theft via USB)
Apply execution and USB artifacts to a full insider case.
MEDIUM~1 h 50 minUp to 20 questions -
07
Two Weeks' Notice (The Customer Export)
Follow a file through browser history, shortcuts and mail.
MEDIUM~1 h 20 minUp to 20 questions -
08
Blank Cheque (The Vanished Tokens)
Work browser history and a mailbox to explain a wallet loss.
HARD~1 h 30 minUp to 20 questions -
09
Pivot Point (Credential Theft and Lateral Movement)
Correlate logs, memory and a capture across hosts.
HARD~2 h 4 minUp to 20 questions -
10
Silent Harvest (Espionage Intrusion)
Capstone: rebuild a quiet intrusion from disk, memory and cloud logs.
EXPERT~8 h 24 minUp to 30 questions
What this pathway covers
Who it's for
- Candidates preparing for the GCFE who want hands-on reps against real registry hives, event logs and link files rather than another question bank.
- Instructors running a Windows forensics unit who need labs that drop into a 14-week course and grade themselves across sections.
- Analysts moving from triage into disk forensics who already know what Prefetch is and need to prove they can use it under time.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
Mobile Forensics (GASF)
Messages, app data, deleted records and device activity from mobile extractions.
8 cases · ~16 h 27 min · GIAC GASF
Network Forensics (GNFA)
Reading packet captures: DNS, beacons, cleartext credentials and exfiltration.
6 cases · ~19 h 9 min · GIAC GNFA
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.