CAWFE Exam Information and Outline
Certified Advanced Windows Forensic Examiner
Syllabus Update Checked on: November 9, 2026
CAWFE Exam Syllabus & Study Guide
Before you start practicing with our exam simulator, it is essential to understand the
official CAWFE exam objectives. This course outline serves as your roadmap.
The information below reflects the 2026 syllabus defined by
IACIS.
Below are complete topics detail with latest syllabus and course outline, that will help you good knowledge about exam objectives and topics that you have to prepare. These contents are covered in questions and answers pool of exam.
- Exam Format
- Practical examination and written test on advanced Windows forensics
- NTFS Internals
- MFT, $LogFile, $UsnJrnl, ADS
- Windows Registry Forensics
- Windows Event Logs and Timeline Analysis
- Volume Shadow Copies
- User Activity Artefacts
- Jump Lists, ShellBags, SRUM
- Memory Forensics Basics
- Windows 10/11 Specific Artefacts and Cloud Sync
- Advanced Reporting