CF-L3 / CCFT study plan

Rank evidence sources by volatility and justify a collection order for a mixed live-memory-plus-disk scenario

Select the correct hardware, software, or inline write-blocker for each media type and defend the choice

Compute and verify MD5/SHA-256 hashes across acquisition, transport, and storage to prove integrity

Construct chain-of-custody entries for physical media and for provider-held cloud data that would survive cross-examination

Distinguish logical, physical, sparse, and targeted acquisitions and state when each is defensible

Map Windows registry hives to the user behaviors they evidence (USB connections, Run/RunMRU, ShellBags, autoruns)

Interpret Security, System, and Sysmon event IDs to reconstruct logon sessions and process execution chains

Normalize timestamps from $MFT, $UsnJrnl, and Prefetch into a single unified timeline and explain each timestamp's meaning

Identify Linux access and persistence artifacts in auth.log, cron, systemd units, and shell history

Parse NTFS structures ($MFT records, $LogFile, $Bitmap, alternate data streams, INDX) and state what each can and cannot establish

Explain file creation, deletion, and slack-space behavior at the structure level in NTFS, FAT/exFAT, and ext4

Recover deleted content and metadata, then document why full recovery is or is not possible in each case

Correlate file system metadata with operating system artifacts to resolve timestamp inconsistencies (timestomping indicators)

Differentiate search authorization mechanisms (warrant, consent, subpoena, exigent circumstances) and match each to a fact pattern

Apply admissibility standards and recognized good-practice principles to examiner decisions and tool validation

Connect each procedural step to the documentation that makes it defensible in court

Resolve ethical conflicts such as scope creep, conflicts of interest, and data minimization with a stated course of action

Decode packet captures at the protocol level (DNS, HTTP, SMB, TLS handshake) to identify command-and-control and exfiltration patterns

Reconstruct a session timeline from firewall, proxy, and flow-record logs while reconciling clock skew between sources

Attribute activity to an internal host using web server, DHCP, and VPN logs

Rank log sources by evidentiary weight and account for retention gaps in the final narrative

Extract and interpret mobile artifacts (message databases, location history, app sandbox data) from logical and file-system-level extractions

Apply the shared-responsibility model to determine what a cloud provider can and cannot produce under legal process

Preserve and authenticate cloud-native and emerging-source evidence such as SaaS audit logs, container images, and IoT device data

Document the limitations of each acquisition method (logical, file system, chip-off, JTAG) where it affects conclusions

Structure an expert report with explicit scope, methodology, findings, limitations, and appendix conventions

Restate technical findings in plain language for a non-technical decision maker without losing accuracy

Prepare direct and cross-examination answers that separate observed fact, inference, and opinion

Apply disclosure obligations and handle exculpatory findings transparently

Complete a full-length timed mock exam and score results by domain

Close the three weakest domain gaps with targeted drills and re-testing

Reproduce from memory a one-page summary of legal standards and procedural flow

Finalize an exam-day plan covering pacing, flagging strategy, and common terminology traps