Mile2 CDFE case studies
Mile2 CDFE · Put your knowledge to work in context.
The C)DFE (Certified Digital Forensics Examiner, also written CDFE™) is a Mile2® certification aimed at professionals who need to acquire, handle, examine, and report on digital evidence in a defensible way. Mile2 positions the C)DFE alongside its other role-based credentials, describing its certification portfolio as university and ANSI/ANAB-aligned and its course content as aligned with NIST, ISO, and NICE Framework standards. The Mile2 CDFE case studies are 5 cases and about 2,496 words.
1Live Windows Host With a Failed Outbound Transfer
At 09:12, a helpdesk analyst escalates a Windows 11 laptop used by a payroll administrator. EDR flagged a PowerShell process that archived Documents and attempted an outbound connection to 198.51.100.77 on TCP 443; the connection failed.
525 words, about 3 min2USB Drive Handled Before Forensic Submission
A cleaning contractor finds a USB flash drive in a conference room and gives it to the facility security officer. The officer plugs it into his Windows workstation to identify the owner, opens a folder named Finance, then logs out and places the drive in an envelope.
527 words, about 3 min3NTFS Timestamp Conflict on a Payroll Spreadsheet
You receive an E01 image of a 500 GB NTFS volume from a Windows Server 2016 file server. A spreadsheet named Q3 payroll.xlsx is central to an internal fraud inquiry.
461 words, about 2 min4NAT Overload and Clock Skew in an Outbound Transfer Timeline
At 02:14 UTC, a SIEM alert shows 4.8 GB outbound from 10.20.4.15 to 203.0.113.88:443. The firewall log is in UTC but its NTP sync failed and is 7 minutes slow; the proxy log is in local time (UTC-5) and records CONNECT requests to cdn-update.example.
478 words, about 2 min5Draft Report Overstates Cloud Exfiltration
You are the forensic examiner for a company investigating an employee who copied source code to a personal Google Drive. The laptop is company-owned; the employee signed an acceptable-use policy and a monitoring notice.
505 words, about 3 min