CCFH study guide
CCFH · Work through your exam, one topic at a time.
The Certified Cyber Forensics Examiner (CCFH) is a vendor-neutral credential aimed at practitioners who acquire, analyse and present digital evidence in a defensible way. Candidates typically come from law enforcement, incident response, litigation support, internal audit and consulting backgrounds, and usually already hold a baseline security or investigative certification. The CCFH study guide has 9 sections and about 3,884 words.
01Forensic Science and Legal Foundations
This domain tests whether you can frame technical work in a defensible legal structure: the authority to collect, the standards that govern handling, and the rules a court applies when deciding whether your evidence and your opinion come in. Two admissibility gateways.
464 words, about 2 min02Digital Evidence Handling and Chain of Custody
This domain tests whether you can show continuous, documented control of an item from seizure to courtroom, and whether you can justify every change in its state. Chain-of-custody record.
444 words, about 2 min03Forensic Imaging, Acquisition, and Verification
This domain tests whether you can produce a duplicate that another examiner can reproduce and verify, and whether you can explain what the verification actually proves. Physical (bit-stream) acquisition captures the whole device including unallocated space and file slack.
484 words, about 2 min04File Systems and Data Recovery
This domain tests whether you can navigate NTFS, FAT, and ext-family structures, interpret timestamps correctly, and recover or explain the absence of deleted content. The Master File Table holds 1024-byte records with attributes that are resident (inside the record) or non-resident (in clusters).
436 words, about 2 min05Operating System and Artifact Forensics
This domain tests whether you can answer behavioural questions, such as what ran, what was attached, and who logged on, using operating-system artifacts and their corroboration. Windows registry hives.
383 words, about 2 min06Network and Log Forensics
This domain tests whether you can reconstruct network activity from packet captures, flow records, and device logs, and attribute that activity to a host or user with the right caveats. Capture versus flow.
408 words, about 2 min07Mobile, Cloud, and Emerging Technology Forensics
This domain tests whether you can adapt acquisition and interpretation to devices and services where you rarely hold the original media: phones, cloud tenants, containers, and connected devices. Mobile acquisition levels.
444 words, about 2 min08Incident Response and Malware Analysis
This domain tests whether you can run a structured response, preserve volatile evidence, and produce defensible conclusions about malicious code and attacker behaviour. NIST SP 800-61 phases are preparation, detection and analysis, containment, eradication, and recovery, followed by post-incident lessons learned.
406 words, about 2 min09Forensic Reporting and Expert Testimony
This domain tests whether you can convert technical work into a report and oral evidence that survive scrutiny, keep fact separate from opinion, and stay inside the limits of your expertise. Executive summary, scope and authority, items examined with identifiers and hashes, methodology and tools with versions, findings, interpretation, limitations, and appendices such as logs and verification output.
415 words, about 2 min