- Who Qualifies for CAWFE in 2026
- Core Prerequisites: Training and Documentation
- Registration Mechanics and the $800 Fee
- Two-Part Assessment Structure
- The Six WFE Core Competencies
- Retest Policy and What Happens If You Fail
- Renewal: Keeping CAWFE Active
- Building Your Qualification Timeline
- Frequently Asked Questions
- The 2026 certification-only entry fee is $800 USD, plus proof of 36 hours of competency-aligned training.
- The written exam has 125 questions, an eight-hour limit, and requires an 80% minimum score to pass.
- Passing the written exam opens a 30-day practical using forensic images and real Windows artifacts.
- Only one retest is shared across both the written and practical components - there is no separate retake for each.
Who Qualifies for CAWFE in 2026
The Certified Advanced Windows Forensic Examiner (CAWFE) credential is administered by the International Association of Computer Investigative Specialists (IACIS) through its Advanced Certification Subcommittee, with candidate activity managed inside the IACIS Moodle platform. Unlike entry-level digital forensics certificates that assume little prior knowledge, CAWFE is positioned as an advanced credential for examiners who already have working familiarity with Windows-based forensic analysis and want a rigorous, third-party validation of that skill set.
Because the program is training- and competency-based rather than purely experience-gated, "eligibility" is less about job titles and more about whether you can document the required preparation and demonstrate mastery across a defined set of technical domains. If you are still deciding whether this credential fits your career stage, it helps to first understand what CAWFE actually is and how it differs from adjacent forensic certifications that share similar-sounding names.
Core Prerequisites: Training and Documentation
Before you can sit for the written component, IACIS requires documentation of 36 hours of competency-aligned training. This isn't a vague suggestion - it's a hard prerequisite tied directly to the six WFE core competencies that structure the exam. Candidates need to be able to show, in documented form, that their prior coursework, agency training, or vendor instruction maps onto the domains being tested.
Practically, this means before you register you should:
- Inventory your prior training hours and match them against the six competency areas.
- Identify any domain where you have thin or no documented training and close that gap before applying.
- Keep certificates, transcripts, or training rosters organized, since the Advanced Certification Subcommittee reviews this documentation as part of qualification.
If you're unsure whether your background clears this bar, a structured breakdown of CAWFE's six exam domains is the fastest way to audit your existing training against what's actually tested.
Registration Mechanics and the $800 Fee
The 2026 certification-only entry fee for CAWFE is $800 USD. This fee covers your access to the certification track through IACIS Moodle, not separate charges per attempt of each component. Because the written exam and practical exercise are bundled under one certification pathway, understanding what that fee does and doesn't include matters before you commit financially.
Key Takeaway
Budget for the $800 certification-only fee plus the time cost of documenting 36 training hours - both are prerequisites for registration, not optional add-ons. For a full cost breakdown including what happens if you need the shared retest, see the CAWFE certification cost breakdown.
Once registered, candidates move through the two assessment stages described below. There is no path to certification that skips either the written or practical component - both must be completed and passed under the shared retest policy explained further down this page.
Two-Part Assessment Structure
CAWFE's assessment is built in two distinct stages, and understanding the mechanics of each is essential to qualifying successfully.
Stage One: The Written Exam
The written exam consists of 125 questions with an eight-hour time limit and a required 80% minimum passing score. Question formats include true/false, multiple choice, matching, and short fill-in answers - a mix that rewards both recognition and recall, not just elimination of wrong answers.
- The exam is open-book, meaning you may reference notes and documentation while testing.
- It is unproctored and remotely accessible, so you take it on your own schedule within the access window.
- The eight-hour clock cannot be paused once started - plan for an uninterrupted block of time.
Note that within IACIS terminology, the "Exam" line item refers specifically to this written component - the practical exercise is treated as a separate stage in the certification pathway, not part of the "Exam" designation. Candidates who understand this distinction plan their preparation more accurately; see the CAWFE passing score breakdown for exactly how the 80% threshold is calculated against the 125-question format.
Stage Two: The 30-Day Practical
After passing the written exam, candidates move into a 30-day practical exercise using forensic images and real Windows artifacts. This stage tests whether you can actually apply the concepts validated on the written exam to a realistic investigative scenario.
- You may use any forensic tool of your choosing to complete the practical - there is no mandated software.
- The 30-day window means pacing and time management across the exercise matter as much as technical accuracy.
- Because the practical draws on artifacts and images tied to the same six domains as the written exam, strong domain knowledge carries directly into this stage.
The Six WFE Core Competencies
CAWFE's scope is defined by six official WFE core competencies, version 1.1, effective April 4, 2024. Every written question and practical task traces back to one of these areas.
Domain 1: Windows Virtualization Technologies and Inbuilt Security Mechanisms
Covers how virtualized Windows environments and built-in OS security features affect evidence acquisition and analysis.
- Understand how virtualization layers alter artifact locations and timelines
Domain 2: Windows Partitioning Schemes
Requires solid knowledge of how Windows systems structure disk partitions and how that structure impacts forensic imaging and recovery.
- Recognize partition scheme variations across Windows versions and hardware configurations
Domain 3: Windows File Systems
Tests depth of understanding of Windows file system internals and how they store, timestamp, and delete data.
- Be able to trace file system metadata to reconstruct user and system activity
Domain 4: Windows Registry
Focuses on registry structure, key hives, and how registry data reveals system configuration and user behavior.
- Know which hives and keys are most frequently relevant to investigative questions
Domain 5: Windows Artifacts
Broadly covers the range of Windows-generated artifacts examiners rely on to build a forensic narrative.
- Practice correlating multiple artifact types to corroborate a single event timeline
Domain 6: Live Memory Acquisition and Analysis
Tests methodology and tool-agnostic understanding of capturing and analyzing volatile memory on live Windows systems.
- Understand acquisition order of operations and what's lost if steps are skipped
For a deeper walkthrough of how these six areas interrelate and where candidates commonly underestimate difficulty, the complete CAWFE exam domains guide breaks down each competency further.
Retest Policy and What Happens If You Fail
One of the most misunderstood mechanics of CAWFE qualification is the retest policy: only one retest is shared across both the written exam and the practical exercise combined. This means candidates cannot treat the written exam and the practical as two independently retestable stages - a failure on either one draws from the same single retest allowance.
Key Takeaway
Because only one retest applies across both stages, treat your first attempt at the written exam and the practical as effectively your only real margin for error. Thorough preparation before scheduling matters more here than in certifications offering unlimited retakes.
This retest structure is a major reason candidates benefit from understanding pass/fail data before attempting the exam. Reviewing what the CAWFE pass rate data shows can help calibrate expectations and preparation intensity realistically.
Renewal: Keeping CAWFE Active
Qualifying for CAWFE is not a one-time event - the credential requires renewal every three years, and the renewal requirements are as concrete as the initial qualification path:
- A third-year proficiency exercise demonstrating continued competency
- 40 documented continuing-education hours accumulated across the renewal cycle
- Qualifying forensic work experience or completion of proficiency tests
- Ongoing ethical compliance with IACIS standards
- Paid dues, or the applicable $150 nonmember/delinquent renewal fee if dues lapse
Candidates evaluating whether the credential is worth pursuing long-term should factor these recurring obligations into their decision - not just the upfront $800 fee and 36-hour training requirement. A fuller cost-benefit view is available in the CAWFE ROI analysis, and career-focused readers may also want to review how CAWFE factors into forensic examiner earnings before weighing the renewal commitment against career benefit.
| Requirement | Detail |
|---|---|
| Certification-only fee (2026) | $800 USD |
| Training documentation | 36 hours, competency-aligned |
| Written exam | 125 questions, 8-hour limit, 80% minimum passing score |
| Practical exercise | 30 days, forensic images and Windows artifacts, any tool permitted |
| Retest allowance | One retest shared across written and practical combined |
| Renewal cycle | Every 3 years: proficiency exercise, 40 CE hours, ethical compliance, dues or $150 fee |
Building Your Qualification Timeline
Because CAWFE bundles a demanding written exam with a 30-day hands-on practical, most candidates benefit from a structured lead-up rather than cramming immediately before registration. The timeline below assumes you already have most of your 36 training hours documented and are focused purely on domain mastery.
Foundational Domains
- Review Windows Partitioning Schemes and Windows File Systems (Domains 2-3) since later domains build on this structural knowledge
Registry and Artifacts
- Work through Windows Registry and Windows Artifacts (Domains 4-5), practicing correlation exercises across multiple artifact types
Virtualization and Memory
- Cover Windows Virtualization Technologies and Live Memory Acquisition and Analysis (Domains 1 and 6), the two areas candidates most often underestimate
Timed Practice
- Run full-length timed drills mimicking the eight-hour, 125-question format before registering for the actual written exam
For a more detailed week-by-week study framework tied specifically to CAWFE's format and domain weighting, see the complete CAWFE study guide. Once you're ready to test your recall under realistic conditions, practicing with exam-style questions on our CAWFE practice test platform is one of the most direct ways to gauge readiness before committing to the $800 registration fee.
It's also worth confirming current testing windows before finalizing your prep schedule - registration timing and access periods are covered in the CAWFE exam dates and scheduling guide, and a condensed one-page reference of must-know facts is available in the CAWFE cheat sheet for quick review in your final week.
Frequently Asked Questions
CAWFE's stated prerequisite is documentation of 36 hours of competency-aligned training rather than a specific prior certification. What matters is that your training history maps onto the six WFE core competencies tested on the exam.
No. The written exam is open-book, unproctored, and remotely accessible. However, its eight-hour clock cannot be paused once started, so candidates should treat the testing window as a single uninterrupted session.
Only one retest is shared across both the written exam and the practical exercise combined. There is no separate retake allowance for each stage individually, so preparation before your first attempt is critical.
Yes. Any forensic tool may be used to complete the 30-day practical, which is based on forensic images and Windows artifacts. There is no mandated toolset.
Renewal is required every three years and includes a third-year proficiency exercise, 40 documented continuing-education hours, qualifying forensic work or proficiency tests, ethical compliance, and paid dues or the applicable $150 nonmember/delinquent renewal fee.