CAWFE Passing Score 2026: Exactly What You Need to Pass

The Real Number: 80% on the Written Exam

If you searched for this article, you probably want one number, and here it is: the IACIS written exam for Certified Advanced Windows Forensic Examiner requires a minimum score of 80% to pass. With 125 questions on the exam, that means you need to answer roughly 100 questions correctly, depending on how the Advanced Certification Subcommittee weights any short fill-in items. There is no sliding scale, no scaled scoring model, and no partial-credit curve published for candidates - 80% is 80%.

That threshold applies specifically to the Exam line of the assessment, which IACIS defines as the written component only. The 30-day practical that follows is graded on a different, non-percentage basis discussed later in this article. Conflating the two is one of the most common mistakes candidates make when researching CAWFE, so it's worth separating them clearly before you build a study plan.

Two Components, Two Different "Passing" Standards

CAWFE certification is not a single exam event. It is a two-stage assessment:

• A 125-question written exam with an eight-hour time limit and an 80% minimum passing score.
• A 30-day practical exercise using forensic images and Windows artifacts, completed after the written exam is passed.

You must clear the written threshold before the practical becomes relevant, and the practical has its own evaluation criteria that don't reduce to a simple percentage. Candidates who treat CAWFE prep as "study until I hit 80% on practice questions" without accounting for the practical often end up unprepared for the second stage. For a full breakdown of both stages and how they interact, see the CAWFE Study Guide 2026: How to Pass on Your First Attempt.

How the 125 Questions Are Actually Scored

The written exam mixes format types: true/false, multiple choice, matching, and short fill-in answers. This variety matters for scoring strategy. True/false and multiple choice questions are typically the fastest to answer with confidence, while matching and short fill-in items tend to consume more of your eight-hour window and carry higher risk of small errors - a misspelled registry key path or an imprecise artifact name can cost you a point on a fill-in question in a way it wouldn't on a multiple-choice item.

Because the passing bar is a flat 80% across all 125 questions, there's no mechanism to "skip" a weak format type and make it up elsewhere. Every question type counts equally toward the same threshold. This is a key reason candidates should rehearse fill-in and matching formats specifically, not just multiple-choice recall, when preparing.

Domain Weight and Where Points Are Lost

The written exam draws from six official WFE core competencies (version 1.1, effective April 4, 2024). While IACIS does not publish a public per-domain point breakdown, candidates preparing for the 80% threshold should assume every domain is fair game across the 125 questions:

For a deeper, standalone treatment of each area, read the CAWFE Exam Domains 2026: Complete Guide to All 6 Content Areas. Because the passing score is a single blended 80%, a candidate who is excellent in Domains 3 and 5 but weak in Domain 1 can still fail - there's no domain-level minimum published, but a low score in any one area drags down the composite percentage that matters.

The 30-Day Practical: A Different Kind of Passing

Once you clear 80% on the written exam, you move to the 30-day practical, which uses forensic images and real Windows artifacts. This component does not use the same percentage-based passing score. Instead, it evaluates whether your findings, methodology, and reporting meet the standard expected of a certified examiner working with the same six core competencies tested on the written exam.

Any forensic tool may be used during the practical - there is no restriction to a specific commercial suite or open-source toolset. This flexibility is a double-edged sword: it means you can use tools you're already fluent in, but it also means there's no "approved workflow" to memorize. Your methodology needs to hold up regardless of tool choice.

The Shared Retest Rule You Cannot Ignore

One of the most overlooked facts about CAWFE scoring mechanics is this: only one retest is shared across both the written exam and the practical. This is not two separate safety nets - it's one. If you fail the written exam and use your retest there, you have no retest cushion left if the practical doesn't meet standard. Conversely, if you pass the written exam comfortably but stumble on the practical, that single retest is your only path back in.

This structural detail should directly influence how you prepare. It means the written exam isn't just a "get past 80% and move on" hurdle - a shaky pass increases the pressure on the practical, because you've spent your only mistake allowance. For a broader look at how this affects overall difficulty perception, see How Hard Is the CAWFE Exam? Complete Difficulty Guide 2026, and for context on how candidates fare in aggregate, review CAWFE Pass Rate 2026: What the Data Shows.

The Eight-Hour Clock and Open-Book Reality

The written exam is open-book and unproctored, administered remotely through IACIS Moodle - but the eight-hour clock cannot be paused once started. That is roughly 3.8 minutes per question if you spent the entire window evenly, though in practice most candidates move faster through true/false and multiple-choice items to bank time for matching and fill-in questions that require lookup or careful phrasing.

Open-book access is genuinely useful for Domains 2 through 4, where exact terminology and structural details (partition offsets, registry hive names, file system metadata fields) are easy to verify quickly if you know where to look. It is far less useful for Domains 1, 5, and 6, where the questions tend to test applied judgment - recognizing what an artifact means in context, or reasoning through a memory acquisition sequence - rather than something you can simply look up under time pressure.

Because the clock keeps running regardless of interruptions, treat the eight hours as a hard budget. Practicing full-length timed question sets on the CAWFE practice test platform before exam day helps you calibrate pacing so you're not still working through Domain 5 questions with an hour left and Domain 6 untouched.

Mapping Study Time to the 80% Threshold

Because the passing score is fixed and non-negotiable, your preparation should be structured around closing specific gaps rather than generic review. A domain-weighted study rhythm works better than a uniform week-by-week plan, since Domain 5 (Windows Artifacts) is broader than the others and Domain 1 (virtualization) is often the least familiar to examiners who mostly work physical disk images.

Running timed, full-length practice sessions on our CAWFE practice test site is one of the few ways to simulate the actual pressure of an unpausable eight-hour clock before it counts. For a consolidated review resource once you've covered all six domains, the CAWFE Cheat Sheet 2026: One-Page Review of Must-Know Facts is useful in the final days before your exam window.

It's also worth factoring the $800 certification-only entry fee and 36-hour training documentation requirement into your timeline - you can't sit the written exam until eligibility documentation is in order. Full mechanics are covered in CAWFE Requirements 2026: Eligibility, Prerequisites & How to Qualify and CAWFE Certification Cost 2026: Complete Pricing Breakdown.

Frequently Asked Questions