CCFR study plan

Build a personal forensic toolchain (write-blocker workflow, imaging tool, hashing utility, timeline generator) and verify each tool runs end to end on a test image

Explain and document the order of volatility and how it drives collection sequencing, citing at least five artifact sources

Demonstrate correct chain-of-custody documentation by completing a sample form for a simulated acquisition, including hash values before and after imaging

Identify the file systems and partition schemes most likely to appear in the exam scenarios and note where key metadata lives for each

Map Windows artifacts (registry hives, event logs, prefetch, shimcache, amcache, USN journal, recycle bin) to the investigative question each answers

Map Linux and macOS artifacts (auth logs, shell history, cron, systemd journal, unified logs, launch agents) to the same investigative questions

Practice extracting and interpreting at least ten artifacts from a sample image and record the finding each supports

Distinguish volatile memory artifacts (process lists, network connections, injected code) from disk-only evidence and state when memory capture must occur

Construct a super-timeline from at least three artifact sources and annotate five correlated events that together describe an intrusion

Detect and explain anti-forensics techniques including timestomping, log deletion, secure wiping, and steganography, and state the residual evidence each leaves

Perform file carving and deleted-file recovery on a test image and validate recovered items by hash or content match

Interpret network forensic evidence (packet captures, proxy logs, DNS logs, NetFlow) to reconstruct a data exfiltration sequence

Assemble a forensic report template that states scope, methodology, findings, limitations, and conclusions in language a non-technical decision maker can follow

Apply legal and evidentiary constraints (search authorization, privacy limits, admissibility, expert-witness conduct) to two hypothetical scenarios and justify each decision

Define the incident response lifecycle phases and describe how forensic preservation interacts with each phase

Write the containment, eradication, and recovery decision points for a ransomware scenario, naming the evidence to preserve before each action

Draft a severity classification scheme and escalation matrix that assigns owners and response time targets to at least four incident tiers

Build a triage checklist that separates true positives from noise for phishing, malware, and unauthorized-access alerts

Practice initial containment decisions (host isolation, credential reset, blocklisting, account disablement) and record the tradeoff each imposes on evidence and business continuity

Prepare the first-hour communication set: internal notification, stakeholder update, and evidence-preservation instruction to the system owner

Execute a tabletop exercise for a business email compromise scenario, covering detection, scoping, containment, and notification

Collect and preserve host and network evidence during the exercise without altering it, documenting each action with timestamps

Identify the regulated notification triggers (breach reporting, law-enforcement referral, contractual obligations) and state who decides and on what timeline

Produce an incident log that would withstand later review, including decision rationale for each action taken

Trace lateral movement and persistence in a simulated multi-host intrusion using log and endpoint evidence, and list every affected asset

Perform root-cause analysis that distinguishes the initial access vector from contributing control failures

Write eradication and recovery steps that include validation criteria for declaring the incident closed

Design post-incident monitoring and detection improvements that would catch the same intrusion earlier next time

Complete two timed mixed-domain practice sets and log every missed question by domain, subtopic, and error type (knowledge gap versus misread)

Re-teach the three weakest subtopics from source material and write a short summary of each in your own words

Rehearse explaining forensic methodology and incident-response decisions aloud as if briefing a stakeholder, keeping each answer under two minutes

Review the personal artifact matrix, playbooks, and reports to confirm each key fact is recalled without notes