CFCE study plan

Diagram the NTFS on-disk layout from boot sector through MFT, MFT mirror, cluster runs, and attribute headers, labeling every structure you can name from memory

Parse a raw $MFT record by hand (hex editor) and identify the signature, fixup array, sequence number, flags, and resident versus non-resident attribute headers

Compare FAT12/16/32, exFAT, and NTFS directory entry structures and explain how each stores file names, timestamps, and cluster allocation

Explain how file slack, unallocated space, and volume slack arise from cluster allocation and where each is likely to hold residual data

Enumerate the Windows registry hives relevant to user activity (NTUSER.DAT, UsrClass.dat, SYSTEM, SOFTWARE, SAM, SECURITY) and state what each proves

Trace execution evidence across ShimCache, Amcache, Prefetch, UserAssist, and BAM/DAM, and explain the limits and reliability caveats of each

Interpret $StandardInformation versus $FileName timestamps and describe the timestamp-manipulation scenarios (timestomping) that create mismatches

Locate and interpret event log sources for logon, service installation, and USB connection activity, including relevant event IDs

Map LNK files, Jump Lists, Shellbags, and RecentDocs to specific user actions such as opening a file or browsing a folder

Recover deleted NTFS files using both MFT-record analysis and $LogFile/$UsnJrnl review, and document why each recovery succeeded or failed

Carve files from unallocated space using signature-based and structure-based methods, and explain when each approach produces false positives

Distinguish deleted-file recovery from file carving and identify the file-system conditions that make each viable

Document a recovery attempt end to end with hashes, offsets, and a defensible statement of what the recovered data does and does not prove

Compare logical, physical, and sparse imaging and select the correct method for a given scenario with justification

Compute and verify MD5 and SHA-256 hashes at acquisition and re-verification, and explain hash collisions and the limits of hash equality as proof of identity

Draft a chain-of-custody form that captures seizure, transfer, storage, and access events with the fields needed for admissibility

Write acquisition notes that record write-blocker model, tool and version, source geometry, errors encountered, and any deviation from procedure

Explain how to handle a drive that fails during imaging, including documentation of the failure and options for a second attempt

Extract and interpret browser history, cache, cookies, downloads, and bookmarks from at least two browser families and state what each record proves

Parse email headers to trace delivery path and identify spoofing indicators, and locate mail stores for at least one desktop and one webmail scenario

Analyze network evidence such as firewall logs, DHCP leases, and packet captures to place a device on a network at a given time

Explain how NAT, VPNs, and cloud sync complicate attribution of internet activity to a specific person

Carve deleted browser and email artifacts from unallocated space and validate the results against known-good records

Draft a forensic readiness assessment for an organization covering logging, retention, time synchronization, and evidence preservation gaps

Explain the legal and ethical boundaries on consent, scope of authorization, privacy, and handling of incidental findings, and apply them to two written scenarios

Describe acquisition and analysis approaches for mobile devices, including logical versus physical extraction, backups, and cloud-synced data

Identify challenges in non-traditional media such as SSDs (TRIM, wear leveling), cloud storage, IoT devices, and game consoles, and state what evidence may be unrecoverable

Apply order-of-volatility principles to a live-response scenario and justify what to collect first

Structure a forensic report with scope, methodology, findings, limitations, and conclusions that withstand cross-examination

Write findings that separate observation from inference and state confidence levels explicitly

Prepare and rehearse direct-examination answers and anticipate cross-examination challenges to your methodology

Validate a forensic tool by documenting version, test data, known-answer results, and limitations, and explain why tool output alone is not proof

Describe peer review and quality-assurance practices, including what a reviewer checks and how discrepancies are resolved

Re-run a full end-to-end scenario from acquisition through reporting under time pressure and document every decision point

Audit your own prior deliverables against a checklist for chain-of-custody gaps, unhashed evidence, and unsupported conclusions, then correct them

Re-drill weak areas identified in earlier milestones using timed practice sets weighted to the heaviest domains

Summarize the ten domains' key facts into a single condensed reference sheet you can review in under 30 minutes