Certifications
Each fact below comes from the issuing body's own page, checked on 28 October 2026. Exam fees, exam length, question counts and pass marks are not listed here: they change, and the issuer's page shows the current figures. Where a page does not state a fact, such as validity, we say so.
GIACGIAC Certified Forensic Examiner (GCFE)
- Issuer
- GIAC
- Covers
- Collecting and analysing data from Windows systems: data triage, the registry, event logs, USB devices and shell items, browser artefacts, cloud storage and e-mail.
- Prerequisites
- None is stated. The page describes the audience as people with a background in information systems, information security or computers.
- Validity
- No validity period is stated. The page says renewal is done by earning CPE credits.
GIACGIAC Certified Forensic Analyst (GCFA)
- Issuer
- GIAC
- Covers
- Advanced incident response and forensics: memory forensics, file-system timelines, NTFS artefacts, detection of malicious activity, and intrusion investigation in enterprise environments.
- Prerequisites
- None is stated. The page says practical work experience can help candidates master the skills the exam tests. This is advice, not a requirement.
- Validity
- No validity period is stated. The page says renewal is done by earning CPE credits.
OpenText, through its EnCase certification programmeEnCase Certified Examiner (EnCE)
- Issuer
- OpenText, through its EnCase certification programme
- Covers
- Investigations with EnCase Forensic, covering both the method and the software. Aimed at investigators in the public and private sectors.
- Structure
- Two phases: a written phase first, then a practical phase.
- Prerequisites
- One of two options: 64 hours of authorised computer forensics training (CPE hours, online or in a classroom), or 12 months of work experience in computer forensics.
- Validity
- Valid for three years from the date it is obtained. The page links a renewal form, but does not list the renewal conditions for EnCE.
EC-CouncilComputer Hacking Forensic Investigator (CHFI)
- Issuer
- EC-Council
- Covers
- Digital forensic investigation across Windows, Linux and macOS, networks, malware, cloud, e-mail, mobile and IoT, from the investigation process to reporting.
- Prerequisites
- The page says candidates must have basic knowledge of IT and cybersecurity, computer forensics and incident response. No certificate or years of experience is named as a requirement.
- Validity
- The page states no validity period, renewal cycle or continuing-education requirement. This is EC-Council's own description of the programme.
Magnet ForensicsMagnet Certified Forensics Examiner (MCFE)
- Issuer
- Magnet Forensics
- Covers
- Examiner competence with Magnet Forensics products, mainly Magnet AXIOM. The exam is online and timed, with scenario questions based on a case the candidate builds in AXIOM from supplied files.
- Product
- Tied to a vendor's product.
- Prerequisites
- Completion of a course track named on the page (AX200, CY200, or BCERT offered at NCFI), or a custom course judged against the AX200 curriculum.
- Validity
- Valid for two years from the date the exam is passed. The page does not describe a renewal process.
A standard, not a certification
ISO/IEC 27037Guidelines for identification, collection, acquisition and preservation of digital evidence
Published in October 2012 (edition 1) by ISO/IEC JTC 1/SC 27. It is a standard, not a certification. It gives guidelines for specific activities in handling digital evidence.
Certificate and expert witness
A certificate shows that a person has knowledge and skill in a tool or subject. Serving as an expert witness is a task given by a court or prosecutor, and it is governed by Law No. 6754 and the documents issued under it. Do not treat the two as the same thing.
Study and expert witness rules in Türkiye
Degree programmes
Programmes in computer engineering, computer science and information security technology build the base: operating systems, networks and databases. Programme names and content differ between universities, so this page lists none. Current programmes are in the YÖK Atlas database.
Expert witnesses: Law No. 6754
Expert witnesses in Türkiye are governed by Law No. 6754 (Bilirkişilik Kanunu). It was accepted on 3 November 2016 and published in the Official Gazette of 24 November 2016, number 29898.
Article 3(1), principles
The expert carries out the duty independently, impartially and objectively, within the rules of honesty.
Article 10(1), admission conditions
Conditions include completing the basic expert training; at least five years of actual work in the field of expertise; not being registered on another regional board's list; not having been removed from the register other than at one's own request; and meeting the competence conditions set for each field. The law also bars certain criminal convictions and professional bans.
Article 11, registration
Article 11 sets out the procedure for application and registration.
The field-specific qualifications sit in the Ministry's document "Bilirkişilik Temel ve Alt Uzmanlık Alanları ile Bilirkişilerde Aranan Nitelikler". The procedure and principles for admission are in "Bilirkişilik Siciline Kabule İlişkin Usul ve Esaslar". Regional boards publish results and lists. These documents are on the Ministry's Bilirkişilik Daire Başkanlığı site.
Ministry of Justice, Bilirkişilik Daire Başkanlığı
None of the conditions the law lists names a certificate. Check the field-specific qualifications in the current document yourself; this page does not replace it.
Work roles
In-house examiner
Acquisition, examination and technical reports for an organisation's own cases.
Expert witness
Examination and report for a court or prosecutor, under the rules above.
Incident response analyst
Investigating compromises, timelines and malicious activity.
Compliance and internal investigation
Reviewing records and data within an organisation.
These are general descriptions of the work. They include no job listings and no pay information.