CFCE study guide
CFCE · Work through your exam, one topic at a time.
The Certified Forensic Computer Examiner (CFCE) is a vendor-neutral credential for practitioners who examine computers and storage media in support of investigations, litigation, or incident response. It is aimed at examiners who already handle evidence and want independent confirmation that their methods, documentation, and reporting meet a defensible standard. The CFCE study guide has 14 sections and about 4,193 words.
01Forensic Readiness
This domain tests whether an organization can produce reliable digital evidence before an incident is known. Readiness is proactive: governance, logging, retention, trained responders, and tested procedures.
337 words, about 2 min02Legal and Ethical Considerations
This domain tests lawful authority, privacy boundaries, and expert ethics. The examiner must know when a search is permitted, what consent covers, and how to stay objective under adversarial pressure.
352 words, about 2 min03Evidence Handling
This domain tests identification, collection, and preservation. The exam expects an order-of-volatility approach, minimal interaction with original media, and documentation that another examiner could follow.
335 words, about 2 min04Chain of Custody and Documentation
This domain tests continuity of evidence and the records that make it credible. Chain of custody is not a single form; it is an unbroken, contemporaneous account of possession, handling, and storage.
311 words, about 2 min05Storage Media
This domain tests how media store data and how technology affects acquisition and recovery. The examiner must distinguish magnetic, flash, optical, and tape behavior rather than treating all media as equivalent.
306 words, about 2 min06File Systems and Data Structures
This domain tests file-system metadata and where evidence hides. The exam favors NTFS and FAT, with awareness of exFAT, APFS, HFS+, and ext4.
300 words, about 2 min07Forensic Imaging and Verification
This domain tests acquisition and integrity proof. The examiner must create a defensible duplicate, document errors, and verify hashes before analysis.
298 words, about 1 min08Windows Artifact Analysis
This domain tests correlation of Windows artifacts to answer who, what, when, and how. No single artifact proves user action; the exam rewards corroboration.
284 words, about 1 min09Deleted File Recovery and File Carving
This domain tests recovery from file-system metadata and reconstruction from unallocated space. The examiner must distinguish recovery from carving and validate every result.
275 words, about 1 min10Network, Internet and Email Evidence
This domain tests network logs, browser artifacts, and email headers. The exam stresses attribution limits: an IP address is not a person.
297 words, about 1 min11Mobile Device and Other Non-Traditional Media Forensics
This domain tests mobile acquisition states, cloud and carrier evidence, and newer media such as IoT, drones, and vehicles. The examiner must match the acquisition method to the lock state and authority.
298 words, about 1 min12Reporting, Testimony and Peer Review
This domain tests whether findings can be understood, defended, and reviewed. The report is the primary deliverable; testimony is a test of its clarity and limits.
277 words, about 1 min13Forensic Tool Use
This domain tests tool selection, operation, and limitations. A tool's output is evidence only when the examiner understands and documents how it was produced.
267 words, about 1 min14Validation and Quality Assurance
This domain tests laboratory quality systems: method validation, proficiency testing, audits, and records. Quality assurance makes findings reproducible and defensible.
256 words, about 1 min