Mile2 CDFE common mistakes
Mile2 CDFE · Understand the traps and how to avoid them.
Treating the order of volatility as a rigid rule that always starts with RAM, then collecting a full disk image before capturing volatile state such as running processes, network connections, and ARP cache.
Candidates memorize the volatility list as a slogan and apply it mechanically, forgetting that the correct collection order depends on the scenario (e.g., live incident response versus a powered-off seized machine) and on what will be lost first.
What to do instead
For each scenario, first identify what will disappear soonest (registers/cache, RAM, network state, then disk) and justify the sequence in the case notes. Practice writing a short collection plan for both a live server and a powered-off laptop before answering questions.
Confusing chain of custody with evidence integrity: assuming that a signed chain-of-custody form alone proves the data was not altered, or conversely that a hash value alone satisfies chain-of-custody requirements.
Both concepts are taught together, so candidates blur them into a single 'evidence handling' idea and pick whichever answer sounds most procedural.
What to do instead
Learn the distinct purpose of each: chain of custody documents who had the evidence, when, and why (accountability and continuity); hashing demonstrates integrity of the content. A defensible case needs both, so evaluate answer choices on which purpose they actually serve.
Selecting the wrong hash algorithm for a forensic context, or stating that MD5 and SHA-1 differences make one 'admissible' and the other not.
Candidates conflate cryptographic collision weaknesses discussed in security news with forensic integrity verification, and assume newer always means legally required.
What to do instead
Know that MD5 and SHA-1 are still widely used for integrity verification of images, that courts generally accept them, and that stronger algorithms (SHA-256) are preferred for new work. Focus on whether the hash was recorded before analysis and re-verified afterward, not on admissibility by algorithm name.
Imaging a drive without write blocking and then asserting the original was unchanged, or failing to document the write blocker model and its verification.
Candidates focus on the imaging tool and forget that the hardware or software write blocker is the control that prevents modification of the source.
What to do instead
Always pair the image with documentation of the write-blocking method, and note that a hash of the source taken before and after imaging must match. When a question asks what prevents alteration of the original, the write blocker is the answer; hashing only detects alteration afterward.
Mixing up deleted-file recovery concepts: assuming deleted data is always recoverable, or that a file's content is destroyed the moment its directory entry is removed.
Candidates learn 'deleted files can be carved' as a rule of thumb without understanding that the directory entry is unlinked while clusters remain until overwritten, and that metadata such as timestamps may persist in the MFT or inode.
What to do instead
Study the deletion sequence for the file systems on the exam (NTFS MFT entry flags and $Bitmap, FAT directory entries and FAT chains, ext inodes and block bitmaps). Be able to state what remains after deletion and what determines recoverability: whether the clusters have been reused.
Misreading NTFS timestamps, particularly confusing the $STANDARD_INFORMATION timestamps with the $FILE_NAME timestamps and ignoring that $FILE_NAME times are not updated by normal user-mode file operations.
Both attribute sets exist in the MFT entry and candidates treat them as duplicates, missing the timestomping and provenance value of comparing them.
What to do instead
Memorize that $STANDARD_INFORMATION holds the four times updated by the OS, while $FILE_NAME holds times typically set at creation or rename. Learn that a mismatch, especially $STANDARD_INFORMATION times earlier than $FILE_NAME times, is a timestomping indicator worth flagging.
Treating a single log line as proof of an event, or building a timeline from one source (e.g., only Windows Event Logs) while ignoring corroborating sources like firewall, proxy, DNS, and authentication logs.
Candidates answer from the perspective of the one artifact they studied most, and forget that log forensics is about corroboration and time normalization.
What to do instead
For any log-based question, ask what other source would confirm the event and whether timestamps are in a common time zone and format. Practice converting between local time, UTC, and log-specific formats, and note clock skew as a documented limitation.
Confusing the forensic value of NetFlow/IPFIX records with full packet capture, claiming flow data provides payload content or user commands.
Candidates see 'network evidence' and assume all network logs contain the same detail, so they overstate what flow records show.
What to do instead
Learn the boundary: flow records give metadata (source/destination IP and port, protocol, byte and packet counts, timestamps) but not payload. Use flow data to establish communication patterns and then pivot to full packet capture or host logs for content.
Writing a report that presents conclusions without linking them to specific artifacts, or that omits the examiner's methodology, tools and versions, and limitations.
Candidates treat the report as a narrative summary of findings and underestimate how much of the exam tests defensibility and reproducibility of the analysis.
What to do instead
Structure reports so each finding cites the artifact, its location, and the tool used, and include a methodology section covering acquisition, verification hashes, analysis steps, and known limitations. Practice writing findings in an observation-plus-interpretation format that separates fact from opinion.
Assuming forensic evidence must follow the same rules as criminal procedure in every engagement, or ignoring that admissibility depends on relevance, authenticity, and integrity rather than on the examiner's certification alone.
Candidates memorize 'chain of custody' and 'hashing' as the legal answer and miss that the legal foundation is about the evidence being relevant, authentic, and unaltered, with the examiner able to testify to the process.
What to do instead
Frame legal questions around the three pillars: relevance, authenticity/integrity, and a documented, repeatable process the examiner can explain. Distinguish criminal, civil, and internal corporate investigations, since the applicable rules and privacy constraints differ.