PECB Certified Digital Forensics Examiner (CDFE)
Gain expertise in uncovering, analyzing, and preserving digital evidence for legal investigations.
The target audience for the training
- Digital forensics analysts and investigators
- IT security professionals and incident responders
- Legal professionals involved in cybercrime cases
- Corporate security officers and compliance managers
- Professionals seeking to advance their knowledge in digital forensics
- Information security tea m members
- Cybersecurity professionals and cyber intelligence analysts
What you will learn
The Certified Digital Forensics Examiner (CDFE) training provides the expertise to conduct digital forensic investigations and obtain legally admissible digital evidence. This course provides a comprehensive understanding of forensic analysis techniques across various platforms, including Windows, macOS, Linux, and mobile devices.
Throughout the course, you will learn about the latest tools and methods for acquiring, analyzing, and preserving digital evidence, all while adhering to best practices in the industry. You will also explore core areas such as file system forensics, memory forensics, network analysis, and advanced malware analysis. By mastering the critical components of digital forensics, you will be well-prepared to handle complex investigations and secure evidence from a range of devices and systems.
Upon successful completion of the training, you will be eligible to sit for the PECB Certified Digital Forensics Examiner (CDFE) exam. Earning this credential will demonstrate your capability to lead advanced investigations, perform in-depth analysis, and ensure the integrity of digital evidence across diverse environments.
Training program
- Duration : 5 days
Day 1 : Foundations of digital forensics
- Training course objectives and structure
- Introduction to digital forensics
- Digital forensics tools and techniques
- Network analysis with Wireshark
- Basics of malware analysis
Day 2 : File system analysis and reverse engineering
- File system forensics
- Memory forensics
- Reverse engineering in Windows (PE files)
- Reverse engineering in Linux (ELF files)
- x86 architecture fundamentals
Day 3 : Malware analysis and threat hunting
- Advanced malware analysis techniques
- Introduction to Zeek for network analysis
- Ghidra for malware analysis
- Yara rule development for threat hunting
Day 4 : Advanced forensic analysis and incident response
- Dark web forensics
- Interactive behavior analysis
- Memory and file system techniques
- Advanced scripting and automation with Zeek
- Patch analysis and modifications with Ghidra
- Closing of the training course
Day 5: Certification Exam
The “PECB Certified Digital Forensics Examiner” exam fully meets the PECB Examination and Certification Program (ECP) requirements. It covers the following competency domains: Duration : 3 hours
- Domain 1 : Network traffic and protocol analysis
- Domain 2 : Memory acquisition and forensics
- Domain 3 : File-system and disk forensics
- Domain 4 : Malware analysis and reverse engineering
- Domain 5 :Threat hunting, automation, and correlation
Training objectives
By the end of this training course, the participants will be able to :
- Demonstrate an in-depth understanding of digital forensic principles, legal considerations, and investigative procedures applicable to cybercrime and incident response
- Effectively collect, preserve, and analyze digital evidence from various sources, ensuring adherence to chain-of-custody and evidentiary standards
- Utilize industry-standard forensic tools and methodologies to examine file systems, recover deleted data, and detect evidence of tampering or malicious activity
- Produce comprehensive forensic reports and communicate findings clearly, supporting both technical and legal audiences in investigations and potential litigation
Examination guide
Download the exam guide
- Language : English
- Level : Fundamental
- Certification body : PECB
- Certification: Yes
- Accessibility : Yes
- Duration: 5 days
Important information:
Our courses are not registered with the Répertoire National des Certifications Professionnelles (RNCP), but they do comply with the requirements of the Répertoire Spécifique (RS).