CFCE case studies
CFCE · Put your knowledge to work in context.
The Certified Forensic Computer Examiner (CFCE) is a vendor-neutral credential for practitioners who examine computers and storage media in support of investigations, litigation, or incident response. It is aimed at examiners who already handle evidence and want independent confirmation that their methods, documentation, and reporting meet a defensible standard. It suits law-enforcement examiners, private consultants, and corporate investigators alike, and it is generally pursued by people with hands-on case experience rather than newcomers to the field. The exam is practical rather than purely academic. The CFCE case studies are 5 cases and about 4,302 words.
1Hash Mismatch After Imaging a Failing Drive
You are the examiner on a commercial espionage matter. The custodian's laptop was seized and its 1 TB SATA hard drive removed.
900 words, about 5 min2User Denies Connecting a USB Drive
A Windows 10 22H2 desktop is seized from a finance employee suspected of copying client data. and a first-install timestamp of 2024-03-11 09:14:22Z.
904 words, about 5 min3Payment-Change Email With SPF Fail but DKIM Pass
A CFO forwards a payment-change request to you. The message appears to come from [email protected], a long-standing supplier, and asks that future invoices be paid to a new bank account.
866 words, about 4 min4Locked iPhone, iCloud Backup, and Warrant Scope
An iPhone 13 running iOS 17.4 is seized from a suspect in a harassment case. The handset is powered off in a Faraday bag; the passcode is unknown and the device is at the 'before first unlock' state.
810 words, about 4 min5Carving 12,000 JPEGs From Unallocated Space
A 500 GB NTFS image from a laptop is being examined in a fraud case. Analysis shows approximately 180 GB of unallocated space and an MFT with 40,000 entries, many marked as deleted but not overwritten.
822 words, about 4 min