CCFH case studies
CCFH · Put your knowledge to work in context.
The Certified Cyber Forensics Examiner (CCFH) is a vendor-neutral credential aimed at practitioners who acquire, analyse and present digital evidence in a defensible way. Candidates typically come from law enforcement, incident response, litigation support, internal audit and consulting backgrounds, and usually already hold a baseline security or investigative certification. The CCFH case studies are 5 cases and about 3,207 words.
1Scope Expansion During an Off-Site Fraud Examination
On 3 March at 09:10, investigators serve a warrant at a 40-person logistics company. The warrant authorizes seizure of computers and storage used in a wire-fraud scheme involving three customer invoices sent between 6 January and 21 February; the affidavit focuses on email, accounting files, and payment instructions.
713 words, about 4 min2Imaging an Unstable Drive with Read Errors
At 14:05 on 12 August, a laptop is seized from a suspect’s apartment. The internal 4 TB SATA hard drive is removed and connected through a hardware write blocker to a forensic workstation.
635 words, about 3 min3Quick-Formatted NTFS Drive and a Disputed Creation Time
An external 1 TB NTFS drive is seized from a small accounting office after an employee reports that invoice PDFs disappeared. The drive was quick-formatted on 2 June at 16:18, and about 2.1 GB of new files were copied onto it afterward.
653 words, about 3 min4Correlating NAT, DHCP, VPN, and Web Logs After an Admin Login
On 18 September, a public-facing web server is suspected of compromise. The application logs use local time (UTC−5), the firewall and VPN concentrator use UTC, and the DHCP server retains 8-day leases.
629 words, about 3 min5Ransomware Containment and Evidence Preservation Under Pressure
At 07:40 on 4 November, the help desk receives 12 reports of files renamed with .locked and a ransom note named READ ME.txt. The affected hosts include the finance file server FS-01 and 11 Windows 10 workstations.
577 words, about 3 min