Mile2 CDFE study plan
Mile2 CDFE · Give each week a clear focus.
8 weeks · About 6 hours per week
Digital Forensics Fundamentals & Forensic Readiness and Evidence Handling
Define the forensic process phases (identification, preservation, acquisition, examination, analysis, reporting) and map each CDFE domain to them in your own outline
Distinguish volatile vs non-volatile evidence sources and state the order of volatility for at least six source types
Explain chain of custody requirements and list the minimum data points a custody form must capture
Differentiate forensic imaging from logical backup and describe when each is appropriate
Your checkpoint
A one-page evidence-handling cheat sheet covering order of volatility, chain-of-custody fields, and imaging vs backup, self-quizzed to 90% recall
Forensic Readiness and Evidence Handling & Digital Forensics Fundamentals
Describe forensic readiness planning activities: policy, tooling, logging baselines, and staff roles
Compare hashing algorithms (MD5, SHA-1, SHA-256) and justify integrity verification practice
Outline write-blocking approaches (hardware, software, native) and their limitations
Identify legal and privacy constraints that shape evidence collection decisions
Your checkpoint
A written forensic readiness checklist of at least 15 items with a short justification for each, plus a sample acquisition procedure
Disk and File System Forensics
Explain disk geometry, partitioning schemes (MBR vs GPT), and how to interpret a partition table
Describe file system structures for FAT, NTFS, and ext4 at the metadata level (boot sector, MFT, inodes)
Differentiate allocated, unallocated, and slack space and explain how each is examined
Perform file carving logic on a hypothetical deleted-file scenario and justify the recovery steps
Your checkpoint
A worked disk analysis walkthrough (2-3 pages) tracing one deleted NTFS file from MFT record to recovered content, with commands or tool steps listed
Disk and File System Forensics & Network and Log Forensics
Interpret file system timestamps (MACB) and explain common timestamp anomalies and their causes
Identify artifacts useful for user activity reconstruction (recent files, prefetch, registry, shellbags, logs)
Explain log sources (OS, application, network device) and what each contributes to a timeline
Build a timeline methodology that merges disk and log events with time zone normalization
Your checkpoint
A sample super-timeline of at least 20 events from a practice image or log set, annotated with source and confidence
Network and Log Forensics
Describe network forensics data sources: packet capture, flow records, firewall/proxy logs, DNS logs
Explain how to read packet headers and reconstruct a session from a provided capture description
Identify indicators of exfiltration and lateral movement in logs
Correlate authentication logs with network events to establish an intrusion narrative
Your checkpoint
An incident narrative of 400-600 words built from a described log/capture scenario, citing specific event types as evidence
Network and Log Forensics & Forensic Reporting and Legal Considerations
Explain log integrity concerns and methods to preserve and validate log evidence
Draft findings that separate observation from inference and state confidence levels
Apply the Daubert-style reliability considerations to a forensic method you used
Describe how to document tool validation and examiner qualifications in a report
Your checkpoint
A report appendix documenting methodology, tools, and limitations for the week 5 scenario, with each finding tagged observation or inference
Forensic Reporting and Legal Considerations & Digital Forensics Fundamentals
Structure a forensic report with executive summary, scope, methodology, findings, and conclusions
Write findings that are defensible under cross-examination, avoiding conclusory language
Explain admissibility concepts: relevance, authenticity, best evidence, hearsay exceptions for records
Identify ethical duties around bias, scope limits, and disclosure of exculpatory findings
Your checkpoint
A complete mock forensic report (800-1000 words) on a practice scenario, reviewed against a self-built rubric of 10 criteria
Digital Forensics Fundamentals & Forensic Readiness and Evidence Handling & Disk and File System Forensics & Network and Log Forensics & Forensic Reporting and Legal Considerations
Consolidate all five domains into a single review matrix mapping key concepts to exam objectives
Re-test weak areas identified in weeks 1-7 and close gaps with targeted re-study
Practice timed scenario questions and justify each answer in writing
Verify recall of definitions, standards terminology, and procedural sequences without notes
Your checkpoint
A scored practice exam result plus a one-page remediation list of remaining weak topics with a re-study plan
Milestones
Week 2: Can state the order of volatility, list chain-of-custody fields, and explain imaging vs backup without notes, scoring 90% or higher on a self-made quiz
Week 4: Can trace a deleted file through file system metadata and produce a time-normalized timeline of at least 20 events
Week 6: Can build an intrusion narrative from logs and clearly separate observed facts from inferences in writing
Week 7: Mock report passes your 10-criteria rubric with no unsupported conclusions and full methodology disclosure
Week 8: Practice exam score at or above your target pass threshold, with a written remediation list for any domain below 75%