- CAWFE is administered by IACIS through its Advanced Certification Subcommittee via IACIS Moodle.
- Assessment has two parts: an 8-hour, 125-question written exam and a 30-day practical.
- The written exam requires an 80% minimum score and is open-book but not pausable.
- The 2026 certification-only entry fee is $800 USD, plus 36 documented training hours.
What Is CAWFE?
CAWFE stands for Certified Advanced Windows Forensic Examiner, a credential issued by the International Association of Computer Investigative Specialists (IACIS). It is administered specifically through IACIS's Advanced Certification Subcommittee, with registration, coursework documentation, and exam access handled through the IACIS Moodle learning platform. Unlike entry-level forensic credentials that test broad digital investigation concepts, CAWFE is narrowly and deliberately focused on Windows-based systems: how they store data, how they hide it, how they log activity, and how examiners recover and interpret that evidence.
If you're comparing certifications and searching for a plain-language definition, our companion piece on What Is CAWFE Certification? covers the same ground from a slightly different angle, and CAWFE Meaning breaks down the acronym itself. This article goes deeper into the mechanics: how the exam is structured, what it actually tests, and what it costs to pursue in 2026.
Who Issues CAWFE and Who It's For
IACIS is a nonprofit professional association built around digital forensic training and certification for practitioners who examine computer evidence, and CAWFE sits at the advanced end of its certification track, distinct from IACIS's foundational credential. Because the exam assumes prior forensic competency, candidates typically arrive already working in or adjacent to digital forensics: law enforcement digital evidence units, corporate incident response and eDiscovery teams, government forensic labs, and private forensic consulting firms.
The credential's narrow focus on Windows internals - partitioning, file systems, registry, and artifacts - makes it particularly relevant to examiners whose casework centers on Windows workstations and servers rather than mobile devices or network traffic. If you're evaluating whether this specialization fits your career path, Is the CAWFE Certification Worth It? Complete ROI Analysis 2026 walks through the tradeoffs in more depth, and CAWFE Jobs looks at where the credential tends to show up in job postings and role expectations.
The Two-Part Assessment Structure
CAWFE assessment is not a single sitting. Candidates must clear two distinct components before certification is awarded, and they are evaluated differently.
Component 1: The Written Exam
The written exam consists of 125 questions delivered in a mix of formats - true/false, multiple choice, matching, and short fill-in answers. Candidates have an eight-hour limit to complete it, and a minimum score of 80% is required to pass. Two structural details matter a lot for planning: the exam is open-book and unproctored, meaning it can be taken remotely with reference materials on hand, but its clock cannot be paused once started. Eight hours sounds generous until you're deep into registry key paths and artifact timestamps with no way to stop the timer for a break.
Component 2: The Practical
After passing the written exam, candidates move into a 30-day practical exercise built around forensic images and real Windows artifacts. Any forensic tool may be used to complete the practical - there is no mandated software platform, which means candidates are expected to already have a working toolkit and the judgment to apply it correctly rather than follow a scripted process.
Key Takeaway
Only one retest is shared across both the written exam and the practical, so treat each attempt as final rather than a low-stakes trial run.
For a full breakdown of scoring mechanics and what "passing" actually requires numerically, see CAWFE Passing Score 2026: Exactly What You Need to Pass. If you want a sense of how challenging candidates generally find the combined written-and-practical format, How Hard Is the CAWFE Exam? Complete Difficulty Guide 2026 is worth reading before you register.
The Six CAWFE Exam Domains
Scope for CAWFE follows six official WFE core competencies, version 1.1, effective April 4, 2024. These domains define what the written exam and practical draw from, and understanding each one's boundaries is the difference between generic Windows knowledge and exam-ready knowledge.
Domain 1: Windows Virtualization Technologies and Inbuilt Security Mechanisms
Covers how virtualization platforms interact with Windows evidence and how built-in OS security features affect what an examiner can and cannot recover.
- Understand how virtual machine artifacts differ from native host artifacts
Domain 2: Windows Partitioning Schemes
Tests knowledge of how Windows structures disks at the partition level, including how that structure affects acquisition and analysis order.
- Know how partition layout influences where evidence physically resides
Domain 3: Windows File Systems
Focuses on how Windows file systems organize, allocate, and track files and metadata over time.
- Be able to explain how file system metadata supports timeline reconstruction
Domain 4: Windows Registry
Covers registry structure and the specific keys examiners rely on to reconstruct user and system activity.
- Practice locating and interpreting registry hives under time pressure
Domain 5: Windows Artifacts
The broadest domain, spanning the many OS-generated traces of user and application activity across a live or imaged system.
- Build fluency across multiple artifact types rather than memorizing one
Domain 6: Live Memory Acquisition and Analysis
Tests understanding of how to acquire and analyze volatile memory, a skill set distinct from disk-based forensics.
- Know acquisition order-of-operations to avoid contaminating volatile evidence
Each domain contributes to both the written exam's question pool and the scenarios embedded in the 30-day practical. A candidate who studies Domain 5 thoroughly but skims Domain 6 is likely to find gaps show up in the practical, where memory analysis and disk artifacts often intersect in the same case file. For a deeper walkthrough of each domain with more granular subtopics, CAWFE Exam Domains 2026: Complete Guide to All 6 Content Areas is the more detailed companion resource.
Fees, Training Hours, and Eligibility
The 2026 certification-only entry fee for CAWFE is $800 USD. Before sitting the written exam, candidates must document 36 hours of competency-aligned training - meaning coursework or instruction that maps to the six domains above rather than generic digital forensics content. This documentation requirement is a gatekeeping step administered through the IACIS Moodle system alongside registration.
For candidates budgeting ahead of registration, CAWFE Certification Cost 2026: Complete Pricing Breakdown lays out the fee structure in more detail, and CAWFE Requirements 2026: Eligibility, Prerequisites & How to Qualify covers the eligibility and documentation steps candidates need before they can even schedule the written exam. It's also worth checking CAWFE Exam Dates 2026: Testing Windows, Deadlines & Scheduling so the eight-hour written exam and the 30-day practical window don't collide with work deadlines or other commitments.
Keeping CAWFE Current: Renewal Requirements
CAWFE is not a one-time credential. Renewal occurs every three years, and the third year specifically requires a proficiency exercise in addition to standard maintenance activities. Across the renewal cycle, holders must also document 40 continuing-education hours, complete qualifying forensic work or proficiency tests, remain in ethical compliance, and keep dues current - or pay the applicable $150 nonmember/delinquent renewal fee if dues lapse.
| Renewal Element | Requirement |
|---|---|
| Renewal cycle | Every 3 years |
| Third-year requirement | Proficiency exercise |
| Continuing education | 40 documented hours |
| Other conditions | Qualifying forensic work/proficiency tests, ethical compliance |
| Fee if dues lapse | $150 nonmember/delinquent renewal fee |
This renewal structure means CAWFE holders can't simply pass the exam once and stop engaging with Windows forensic work - the proficiency exercise and continuing-education hours assume ongoing casework or active study.
Building a CAWFE-Specific Study Plan
Generic study techniques - spaced repetition, timed practice blocks, flashcard review - only help if they're pointed at the right material. For CAWFE, that means allocating study weeks around the six domains rather than around a generic exam-prep template, since domains like Windows Artifacts and Windows Registry tend to require more repetition than more contained domains like Windows Partitioning Schemes.
Foundations: Domains 1-2
- Review virtualization security mechanisms and partitioning schemes before moving to file-level detail
Core Depth: Domains 3-4
- Drill file system metadata and registry key locations against practice scenarios
Breadth and Volatility: Domains 5-6
- Work through varied Windows artifacts and live memory acquisition workflows
Simulated Exam Conditions
- Run a timed, unpaused practice session to mirror the eight-hour written exam clock
Because the written exam clock cannot be paused, at least one full practice run under realistic time pressure is worth more than several relaxed review sessions. A structured walkthrough of this kind of preparation, including which resources map to each domain, is covered in CAWFE Study Guide 2026: How to Pass on Your First Attempt. You can also run timed, domain-organized practice questions on our practice test platform to get a feel for the pacing before exam day, and return to the main practice site periodically as you move through each domain to check retention.
Key Takeaway
Since only one retest is shared across the written exam and the practical, prioritize honest self-assessment during practice over rushing to schedule the real exam.
Frequently Asked Questions
CAWFE is administered by the International Association of Computer Investigative Specialists (IACIS) through its Advanced Certification Subcommittee, with registration and exam access managed via IACIS Moodle.
It has two parts: a 125-question written exam with an eight-hour limit and 80% minimum passing score, followed by a 30-day practical using forensic images and Windows artifacts.
Yes. Any forensic tool may be used to complete the 30-day practical component; there is no mandated software platform.
The certification-only entry fee is $800 USD, and candidates must also document 36 hours of competency-aligned training before sitting the written exam.
Every three years, with a proficiency exercise required in the third year, 40 continuing-education hours, qualifying forensic work or proficiency tests, ethical compliance, and paid dues or the $150 nonmember/delinquent renewal fee.