CF-L3 / CCFT study guide
CF-L3 / CCFT · Work through your exam, one topic at a time.
The CF-L3 / CCFT is a digital forensics certification aimed at practitioners who must show they can carry an investigation end to end - from the first decision about scope and authority, through acquisition and analysis, to a defensible written report and testimony. It suits forensic examiners, incident responders, security analysts moving into investigations, and law-enforcement or e-discovery staff who already work with evidence and want an external benchmark of that skill. The CF-L3 / CCFT study guide has 7 sections and about 2,871 words.
01Forensic Fundamentals, Legal and Ethical Considerations
Forensic soundness rests on three pillars: the process must not alter the source, it must be documented well enough for an independent examiner to repeat it, and every action must be attributable to a person and a time. The widely cited ACPO principles capture this: no action should change data that may later be relied on in court; where change is unavoidable, the examiner must be competent and able to explain why; an audit trail must exist; and the case officer holds overall responsibility.
707 words, about 4 min02Evidence Identification, Acquisition and Preservation
Evidence identification is the mapping phase: deciding what exists, where it lives, and whether it is probative. Sources include allocated files, deleted files, file slack and unallocated space, registry hives, event and application logs, memory, network captures, mobile app databases, cloud accounts, and physical media.
683 words, about 3 min03File Systems and Storage Media Analysis
Understand partition schemes (MBR with its 4-primary-partition limit, GPT with backup headers and CRC), then the file systems. On NTFS , the Master File Table holds one record per file, with attributes including STANDARD INFORMATION and FILE NAME , each carrying its own MACB timestamps.
303 words, about 2 min04Operating System and Application Artifacts
Windows offers the richest artifact set. Registry hives - SAM , SYSTEM , SOFTWARE , SECURITY , and per-user NTUSER.DAT and UsrClass.dat - record configuration, devices, and user activity.
296 words, about 1 min05Network Forensics and Log Analysis
Network evidence falls into three layers. Full packet capture (PCAP) preserves content and protocol detail but is storage-heavy and often encrypted.
304 words, about 2 min06Mobile, Cloud and Emerging-Source Forensics
Mobile forensics is shaped by architecture: full-disk encryption, secure enclaves, and screen-lock state. Distinguish Before First Unlock (BFU) from After First Unlock (AFU) - far more data is accessible AFU.
298 words, about 1 min07Reporting, Documentation and Expert Testimony
A forensic report must let a competent independent examiner understand and reproduce what you did. Structure it: authority and scope, executive summary, background, methodology and tools (with versions), findings with supporting exhibits, opinion, limitations and assumptions, and appendices (hash lists, exhibit index, glossary).
280 words, about 1 min