If you are an expert, become an

X-Ways Professional in Evidence Recovery Techniques
- certified user of X-Ways Forensics -

You must not disclose any information about the X-PERT certification process
other than what is publicly available here to anyone. Terms subject to change.

What it takes to become an X-PERT

You do not only have relatively broad practical knowledge of computer forensics and the concepts that play a role in this field (physical data storage concepts, operating system data structures, file types, file formats, file systems, hashing, character sets, ...), you are in particular also very familiar with the X-Ways Forensics software. You are a competent and efficient user, able to identify suitable available functionality for various tasks at hand, not afraid of customizing the configuration where possible and necessary. You can demonstrate your proficiency with the X-PERT certification.

Preconditions for starting the X-PERT certification process (all three required):

  • You own a license for X-Ways Forensics with active update maintenance yourself, or your employer has one and allows you to use it. You have to tell us the ID of the dongle that you are using when you sign up. 

  • One of the following:

    • You have attended our training* within the last ~4 years, and we have your name in our records. You have kept yourself up to date in the meantime and confirm you have studied the announcements of new features in X-Ways Forensics since the time of your training (see newsletter archive). 

      *Our training = the X-Ways Forensics course that is delivered by X-Ways itself and occasionally was/is delivered by a few other companies in the world: CBIT Forensics, AFS Computer Forensics, H-11 Digital Forensics Co. LLC, F111th Consulting, Tracip in 2017 or later, Jens Training. If you attended our training at any of these other companies, they must have passed on your name to us or need to confirm your attendance (name, location and date) when you apply for the X-PERT exam.


    • You are a self-taught user of X-Ways Forensics for more than 2 years (we will check the purchase date of your license) and you own a current CFCE, CCE, or EnCE certification or a similar current certification with a strong technical background that is regarded as equivalent by X-Ways, and provide proof of that. Most certifications not listed here are not considered equivalent by X-Ways. There is some reliable information about you (on trusted web sites, in your CV, provided by your employer, in your own technical blog, and/or from other sources) that supports that you are well-versed in computer forensics, and there is no doubt about your competence (e.g. doubt resulting from previous communication with us).

      X-Ways and only X-Ways makes the final determination about approval or decline, perhaps after letting you answer a few test questions, and does not have to give an explanation. If you apply for taking the X-PERT exam based on this provision and your application is declined at X-Ways' discretion, please do not take it personally. Another such application can be made after 1 year! 

  • You know either English or German plus a little bit of English. You can take the exam in either English or German.

Please note that merely having attended the X-Ways Forensics course does not guarantee that you master all relevant functionality in X-Ways Forensics and will pass the exam. That course is just a very, very good foundation. The exam may cover additional functionality. Please familiarize yourself with all functionality in the software that is relevant for computer forensics and also consider attending the X-Ways Forensics II course. Thanks.

Suitable self-study material: User manual Quick Start Guide videos Videos about settings and setup  Ted Smith's videos Newsletter archive Forum announcements Book


How to become an X-PERT

If you meet the above-mentioned conditions, apply online to take the exam (not necessary if you had already paid for the certification process at the same time when signing up for the training!). If your application is approved, we ask you to pay the certification fee (see below), and after that you can take the exam at any time when it suits you. The exam is taken remotely, i.e. from your private home or at your workplace or your hotel room when on a trip. You will need Windows 7 or later, X-Ways Forensics (latest version), an Internet connection, an e-mail account, perhaps also a common tool such as a simple text editor or a spreadsheet software. Images will have to be downloaded prior to taking the test.

The entire certification process is rather unbureaucratic. The exam will not take much time. On the contrary, time will be limited (3 hours at most), so it is essential that you make sure you can work undisturbed. You will be asked to download a few images beforehand and then start the exam when you are ready, at latest within 6 months. Answering the questions will require some related technical background knowledge and efficient use of X-Ways Forensics, and attention to detail. You will not be asked questions like “In which window in X-Ways Forensics can you find so-and-so?”. Rather you need to be able to creatively combine available functionality to be able to answer more practical questions. General computing and computer forensics knowledge will help. The pass mark is 75%. If your answers suspiciously resemble those of another candidate, we may decide to not accept your submission and not to accept further employees in your organization for the certification process. More disadvantages for you and your organization are possible.

More information will be provided when your application is accepted. If you have questions, you may send e-mail to exam at (about the examination) or training at (about signing up or payment questions).

Public list of our active X-PERTs


Benefits of the X-PERT certification

Immediate benefit:

  • Immediately after being accepted for the certification process and after sending payment for it, before or after taking the exam, at latest within 2 years, previous attendees of our training course “X-Ways Forensics” may request a copy of the latest available revision of the training material that accompanies our X-Ways Forensics course, at no charge, for their own use only, in either English or German, once. Warning: All other requests for free copies of the training material will be rejected and you will be denied a second chance even if later the preconditions are fulfilled. For example, if you did not attend the training or did not pay for the certification process yet and still request the copy, you will never receive it.

After passing the exam:

  • You become a certified user of X-Ways Forensics, certified by the makers of the tool, for 3 years. You may identify yourself as a certified X-Ways Professional in Evidence Recovery Techniques (X-PERT) wherever you like: Your CV, e-mail signature, business card, LinkedIn profile, company web site, when asked about your qualification in legal proceedings or in a job interview, ...

  • We include you in our official public list of certified users (X-PERTs), if you like with a link to your company's web site or LinkedIn profile or blog etc., to give you more exposure.

  • You may link to your online certificate, which is hosted on our web site and proves your achievement.

  • You may designate a colleague or friend who wishes to attend our X-Ways Forensics training course, who will be granted a 10% discount on the tuition once, or you may request a 10% discount for yourself, or 20% if it is your 2nd time!*

  • Additionally you may request a EUR 75/GBP 60/USD 100 discount on one of our other courses for yourself!*

  • To renew your certification by another 3 years, we ask you to pass a new exam. This recertification exam requires about half the amount of work and costs 50% of the initial certification. If recertification is not undertaken before the expiration of the previous three-year period the certification status is deemed temporarily expired for the first three months. If recertification is not undertaken within at most three months after the current certification period has ended, certification is deemed permanently expired and a new full exam would be required to regain certification status.

If you do not pass the exam:

  • You are not alone. Note that the exam is intentionally challenging and requires knowledge of a broad range of features in X-Ways Forensics as well as attention to detail, and that it is more challenging than exams of our competitors. You may request a 10% discount should you wish to attend the X-Ways Forensics course, or 20% if it is your 2nd time.* You may take the X-PERT exam a 2nd time after 6 months have passed, at a 30% discount. 

*For publicly advertised training events worldwide offered by X-Ways within 2 years from your exam. The X-PERT training discounts may be applied to the regular rate, the government rate, or the flexible rate (if the rate is still being offered).



1 candidate: EUR 199

Reduced rates available for 5+ candidates from the same organization, if paid together (but no collaborative exam efforts are allowed!).

Subject to VAT if applicable. Prices are subject to change. No refunds.


Copyright by X-Ways Software Technology AG
Carl-Diem-Str. 32 • 32257 Bünde • Germany