Mile2 CDFE study guide
Mile2 CDFE · Work through your exam, one topic at a time.
The C)DFE (Certified Digital Forensics Examiner, also written CDFE™) is a Mile2® certification aimed at professionals who need to acquire, handle, examine, and report on digital evidence in a defensible way. Mile2 positions the C)DFE alongside its other role-based credentials, describing its certification portfolio as university and ANSI/ANAB-aligned and its course content as aligned with NIST, ISO, and NICE Framework standards. That framing tells you the intended audience: security analysts, network engineers, IT managers, and incident or investigative staff who may be called on to preserve and explain digital artifacts rather than simply administer systems. Because the source material does not publish a public C)DFE exam blueprint, treat the five study areas below - fundamentals, forensic readiness and evidence handling, disk and file system forensics, network and log forensics, and reporting and legal considerations - as a study plan rather than an official domain breakdown. The Mile2 CDFE study guide has 5 sections and about 1,824 words.
01Digital Forensics Fundamentals
This domain tests the vocabulary and method behind a defensible digital investigation: what counts as digital evidence, how the forensic process is sequenced, and why repeatability matters. Expect questions that distinguish live from dead-box acquisition and ask which action comes first.
366 words, about 2 min02Forensic Readiness and Evidence Handling
This domain tests preparation before an incident and the physical and logical handling that keeps evidence usable: policies, roles, seizure, packaging, transport, storage, and chain of custody. Questions often present a scenario and ask what breaks defensibility.
370 words, about 2 min03Disk and File System Forensics
This domain tests how storage media and file systems record activity, how to recover deleted content, and how to interpret metadata without overclaiming. Expect questions on MBR/GPT, FAT, NTFS, ext, slack space, carving, and timelines.
378 words, about 2 min04Network and Log Forensics
This domain tests reconstruction of network activity from packets, flows, and logs, and the limits of each source. Expect questions on PCAP, NetFlow, firewall/proxy/DNS/DHCP logs, Windows Event Logs, syslog, time synchronization, and correlation.
366 words, about 2 min05Forensic Reporting and Legal Considerations
This domain tests how findings become a defensible report and testimony: structure, objectivity, admissibility, privilege, and disclosure. Expect questions on expert opinion limits, legal standards, and report quality.
344 words, about 2 min