CF-L3 / CCFT case studies
CF-L3 / CCFT · Put your knowledge to work in context.
The CF-L3 / CCFT is a digital forensics certification aimed at practitioners who must show they can carry an investigation end to end - from the first decision about scope and authority, through acquisition and analysis, to a defensible written report and testimony. It suits forensic examiners, incident responders, security analysts moving into investigations, and law-enforcement or e-discovery staff who already work with evidence and want an external benchmark of that skill. The CF-L3 / CCFT case studies are 5 cases and about 4,069 words.
1The Payment Portal With a Six-Hour SLA
At 22:10 on a Friday you arrive at a co-located Ubuntu 22.04 server that hosts a customer payment portal. The IR lead tells you the host must be reimaged by 06:00 to meet a contractual SLA.
1,003 words, about 5 min2The Frankfurt Laptop and the Friday Deadline
Your company's headquarters in Texas asks you to image the laptop of a Frankfurt-based engineer suspected of copying source code to a personal cloud account. The laptop is in Frankfurt, is enrolled in MDM, and the engineer is on extended medical leave.
701 words, about 4 min3Two Creation Times, Two Years Apart
On a Windows 10 workstation seized from a departing employee you find C: 19 Q4 forecast.xlsx. Its STANDARD INFORMATION attribute shows created and modified 2021-02-03 11:02:10 UTC.
796 words, about 4 min4Naming a Workstation From NetFlow and a Fast Clock
A victim web server logs in US Eastern local time with daylight saving observed and is NTP-synced. The edge firewall's NAT log records internal-IP:port to public IP with UTC timestamps and is NTP-synced.
786 words, about 4 min5The Opinion You Have to Take Back
Eight months ago you signed a report concluding that the defendant 'never opened' Schedule A.xlsx, based on the absence of a corresponding LNK file and no RecentDocs entry. The report was produced under a litigation hold, has been exchanged, and the defendant's expert has already cited it.
783 words, about 4 min