If you are an expert, become an

X-Ways Professional in Evidence Recovery Techniques
certified user of X-Ways Forensics -

You must not disclose any information about the X-PERT certification process
other than what is publicly available here to anyone. Terms subject to change.

What it takes to become an X-PERT

You do not only have relatively broad practical knowledge of computer forensics and the concepts that play a role in this field (physical data storage concepts, operating system data structures, file types, file formats, file systems, hashing, character sets, ...), you are in particular also very familiar with the X-Ways Forensics software. You are a competent and efficient user, able to identify suitable available functionality for various tasks at hand, not afraid of customizing the configuration where possible and necessary. You can demonstrate your proficiency with the X-PERT certification.

Preconditions for starting the X-PERT certification process (all three required):

  • You own a license for X-Ways Forensics with active update maintenance yourself, or your employer has one and allows you to use it. You have to tell us the ID of the dongle that you are using when you sign up. 

  • One of the following:

    • You have attended our training* within the last ~4 years, and we have your name in our records. You have kept yourself up to date in the meantime and confirm you have studied the announcements of new features in X-Ways Forensics since the time of your training (see newsletter archive). 

      *Our training = the X-Ways Forensics course that is delivered by X-Ways itself and occasionally was/is delivered by a few other companies in the world: CBIT Forensics, AFS Computer Forensics, Redeye Forensics, Tracip, Jens Training. If you attended our training at any of these other companies, they must have passed on your name to us or need to confirm your attendance (name, location and date) when you apply for the X-PERT exam.


    • You are a self-taught user of X-Ways Forensics for more than 2 years (we will check the purchase date of your license) and you own a current CFCE, CCE, or EnCE certification or a similar current certification with a strong technical background that is regarded as equivalent by X-Ways, and provide proof of that. Most certifications not listed here are not considered equivalent by X-Ways. There is some reliable information about you (on trusted web sites, in your CV, provided by your employer, in your own technical blog, and/or from other sources) that supports that you are well-versed in computer forensics, and there is no doubt about your competence (e.g. doubt resulting from previous communication with us).

      X-Ways and only X-Ways makes the final determination about approval or decline, perhaps after letting you answer a few test questions, and does not have to give an explanation. If you apply for taking the X-PERT exam based on this provision and your application is declined at X-Ways' discretion, please do not take it personally. Another such application can be made after 1 year! 

  • You know either English or German plus a little bit of English. You can take the exam in either English or German.

Please note that merely having attended the X-Ways Forensics course does not guarantee that you master all relevant functionality in X-Ways Forensics and will pass the exam. That course is just a very, very good foundation. The exam may cover additional functionality. Please familiarize yourself with all functionality in the software that is relevant for computer forensics and also consider attending the X-Ways Forensics II course. Thanks.

Suitable self-study material: User manual Quick Start Guide videos Videos about settings and setup  Ted Smith's videos Newsletter archive Forum announcements Book


How to become an X-PERT

If you meet the above-mentioned conditions, apply online to take the exam (not necessary if you had already paid for the certification process at the same time when signing up for the training!). If your application is approved, we ask you to pay the certification fee (see below), and after that you can take the exam at any time when it suits you. The exam is taken remotely, i.e. from your private home or at your workplace or your hotel room when on a trip. You will need Windows XP or later, X-Ways Forensics (latest version), an Internet connection, an e-mail account, perhaps also a common tool such as a simple text editor or a spreadsheet software. Images will have to be downloaded prior to taking the test. Your Windows system will require support for characters of East Asian languages installed (usually already available on Windows 7, but not necessarily on Windows XP).

The entire certification process is rather unbureaucratic. The exam will not take much time. On the contrary, time will be limited (3 hours at most), so it is essential that you make sure you can work undisturbed. You will be asked to download a few images beforehand and then start the exam when you are ready, at latest within 1-2 months after being accepted for the certification process. Answering the questions will require some related technical background knowledge and efficient use of X-Ways Forensics, and attention to detail. You will not be asked questions like “In which window in X-Ways Forensics can you find so-and-so?”. Rather you need to be able to creatively combine available functionality to be able to answer more practical questions. General computing and computer forensics knowledge will help. The pass mark is 75%. If your answers suspiciously resemble those of another candidate, we may decide to not accept your submission and not to accept further employees in your organization for the certification process. More disadvantages for you and your organization are possible.

More information will be provided when your application is accepted. If you have questions, you may send e-mail to exam at (about the examination) or training at (about signing up or payment questions).


Benefits of the X-PERT certification

Immediate benefit:

  • Immediately after being accepted for the certification process and after sending payment for it, before or after taking the exam, at latest within 2 years, previous attendees of our training course “X-Ways Forensics” may request a PDF copy of the latest available revision of the training material that accompanies our X-Ways Forensics course, at no charge, for their own use only, in either English or German, once. Warning: All other requests for free copies of the training material will be rejected and may be a reason for you to be denied future acceptance for the certification process.

After passing the exam:

  • You become a certified user of X-Ways Forensics, certified by the makers of the tool, for 3 years. You may identify yourself as a certified X-Ways Professional in Evidence Recovery Techniques (X-PERT) wherever you like: Your CV, e-mail signature, business card, LinkedIn profile, company web site, when asked about your qualification in legal proceedings or in a job interview, ...

  • We include you in our official public list of certified users (X-PERTs), if you like with a link to your company's web site or LinkedIn profile or blog etc., to give you more exposure.

  • You may link to your online certificate, which is hosted on our web site and proves your achievement.

  • You may designate a colleague or friend who wishes to attend our X-Ways Forensics training course, who will be granted a 10% discount on the tuition once, or you may request a 10% discount for yourself, or 20% if it is your 2nd time!*

  • Additionally you may request a EUR 75/GBP 60/USD 100 discount on one of our other courses for yourself!*

  • To renew your certification by another 3 years, we ask you to pass a new exam. This recertification exam requires only half the amount of time and costs 50% of the initial certification.

If you do not pass the exam:

  • You are not alone. Note that the exam is intentionally challenging and requires knowledge of a broad range of features in X-Ways Forensics as well as attention to detail, and that it is more challenging than exams of our competitors. You may request a 10% discount should you wish to attend the X-Ways Forensics course, or 20% if it is your 2nd time.* You may apply for the X-PERT certification one more time after 9 months has passed, at a discounted rate. 

*For publicly advertised training events worldwide offered by X-Ways within 2 years from your exam. The X-PERT training discounts may be applied to the regular rate, the government rate, or the flexible rate (if the rate is still being offered).


Fee structure

1 candidate: EUR 199

Reduced rates available for multiple candidates from the same organization, if paid together (no collaborative exam efforts are allowed). Repeater discount: 20%

Subject to 19% German VAT if applicable. Not if you are outside of the EU or if you are in the EU and have a valid a VAT ID. Prices are subject to change. No refunds.


Copyright by X-Ways Software Technology AG
Carl-Diem-Str. 32 • 32257 Bünde • Germany