CCFH study plan

Build a written chain-of-custody procedure for a simulated seizure, covering labeling, transfer log entries, and storage conditions, then have a peer audit it for gaps

Demonstrate three acquisition methods (physical, logical, and targeted collection) on a lab image and record which method you chose for each scenario and why

Compute and verify MD5 and SHA-256 hashes before and after a copy, and explain in writing why dual hashing and re-verification at access time matter

Draft a one-page evidence-intake form that captures device identifiers, hash values, custodian signatures, and anomaly notes

Compare write-blocking approaches (hardware bridge, software block, and live-response tradeoffs) and document when each is defensible

Perform a full disk image of a practice drive and validate image integrity against the source using two independent hash algorithms

Map the on-disk layout of at least two file systems (NTFS and ext4, or FAT32 and APFS) including boot sectors, metadata structures, and allocation tables

Recover deleted files from a practice image using both metadata-based and signature-based carving, and record recovery rates for each

Parse NTFS artifacts including $MFT records, $UsnJrnl, and $LogFile to reconstruct file creation, modification, and deletion timelines

Extract and interpret Windows registry hives for persistence, USB device history, and user activity

Correlate Windows event log entries with file-system timestamps to build a defensible timeline of a simulated intrusion

Explain timestamp behavior including tunneling and time-zone normalization, and correct for them in your timeline

Analyze Linux artifacts including shell history, cron jobs, systemd units, and authentication logs to reconstruct user actions

Compare macOS and mobile-adjacent artifact sources (unified logs, plists, knowledgeC) and note what each can and cannot prove

Summarize the legal standards for admissibility of digital evidence in your jurisdiction, including relevance, authenticity, and hearsay exceptions

Write a short memo distinguishing expert witness testimony from lay testimony and identifying where forensic examiners commonly overstate conclusions

Analyze firewall, proxy, DNS, and NetFlow logs to identify command-and-control traffic and lateral movement in a practice capture

Correlate network indicators with host-based artifacts to confirm or reject a suspected compromise

Perform static triage of a malware sample (strings, imports, PE headers, packing indicators) without executing it

Document an incident response sequence from detection through containment, including what evidence must be preserved at each stage

Extract and interpret mobile artifacts from a provided logical or file-system extraction, including message stores, location data, and app databases

Describe the forensic implications of cloud storage sync, shared responsibility models, and the limits of obtaining provider-held data through legal process

Explain how containerization and ephemeral infrastructure complicate acquisition and attribution, and list the artifacts that survive

Identify at least three emerging-technology evidence sources (IoT, vehicle telematics, wearables) and state what acquisition method applies to each

Write a full forensic report for one of your earlier lab exercises following a structure of scope, methodology, findings, limitations, and conclusions

Rewrite three conclusions to separate observed fact from inference and remove language that exceeds what the evidence supports

Prepare and rehearse direct-examination answers for five likely questions about your methodology and tool validation

Draft responses to three likely cross-examination challenges, including chain-of-custody gaps and tool error rates

Complete two timed full-length practice exams and score each domain separately to locate remaining weak areas

Re-review your weakest two domains using your own notes and reference sheets rather than new material

Recite from memory the hash verification, chain-of-custody, and report-writing checklists without referring to notes

Build a one-page exam-day reference card limited to formulas, standards names, and artifact locations