CDFE common mistakes
CDFE · Understand the traps and how to avoid them.
Treating a file's extension or the output of a single tool as proof of its true type, instead of verifying content with magic-number/signature analysis and corroborating tools.
Candidates learned file-type identification from a GUI or one CLI tool and assume a consistent mapping; CDFE-style forensics items test whether the examiner validates evidence rather than trusting metadata that an attacker can trivially alter.
What to do instead
For every artifact, record the claimed type (extension, MIME, tool guess) separately from the verified type (hex signature at offset 0, container structure, embedded strings), and state explicitly when they disagree. Practice writing the two-column comparison for common formats (JPEG, PNG, ZIP/Office, PDF, PE, ELF).
Confusing allocated, unallocated, and slack space, and misstating where deleted-file content or hidden data actually resides on a volume.
These terms are taught together and sound interchangeable; candidates memorize definitions without mapping them to on-disk structures (MFT records, FAT entries, cluster boundaries), so they pick the plausible-sounding but wrong location.
What to do instead
Build a one-page diagram of a volume: file record, data runs, cluster allocation, slack at the tail of the last cluster, unallocated clusters. For each scenario (deleted file, appended data, file shrinking), trace byte-by-byte where the residual data lives before answering.
Answering timeline questions by sorting only one artifact source (e.g., filesystem MAC times) and ignoring corroborating sources such as logs, registry, or prefetch.
Tooling makes a single-source timeline easy to generate, and candidates stop there; exam items deliberately include conflicting timestamps to see whether the candidate reconciles them.
What to do instead
Adopt a habit of naming at least two independent sources for any time claim, and note which timestamps are user-controllable or updated by copy operations. Practice explaining why a file's modified time can precede its creation time in a copied archive.
Describing the correct forensic process in general terms but failing to apply the order-of-volatility or order-of-operations principle to the specific scenario given.
Candidates memorize 'collect volatile data first' as a slogan but do not connect it to concrete artifacts (RAM, network connections, running processes vs. disk images), so they choose a defensible-sounding but wrong sequence.
What to do instead
For each practice scenario, list every artifact mentioned and rank it by lifetime (seconds to permanent), then justify the collection order in one sentence per artifact. Include the effect of powering down versus hibernating versus live acquisition.
Confusing hashing for integrity with hashing for identification, or claiming a hash proves authorship or uniqueness of a file's content.
Hash functions are introduced in the context of evidence integrity, and candidates over-generalize; items probe whether the candidate knows that a matching hash shows byte-identical content, not origin, intent, or legal authenticity.
What to do instead
Write out what a hash does and does not establish: integrity of the imaged copy versus the original, collision resistance properties, and why hash sets are used for known-file filtering. Practice phrasing conclusions that stop at 'byte-identical to the reference copy'.
Mishandling the chain-of-custody narrative: omitting who had the evidence, when, and under what conditions, or treating a hash value as a substitute for documented transfers.
Candidates focus on the technical acquisition steps and treat paperwork as boilerplate; exam items test whether the candidate understands that admissibility depends on an unbroken, documented record, not just a correct image.
What to do instead
Draft a sample custody form and a short narrative for a mock seizure, covering seizure, transport, storage conditions, access events, and return. For each entry, state the purpose it serves if challenged in court.
Interpreting a carving result as a recovered file without validating that the carved object is complete and internally consistent.
Carving tools output plausible-looking files, and candidates equate 'tool produced output' with 'evidence recovered'; items test awareness of fragmentation, false positives, and truncated objects.
What to do instead
For each carved item, check header/footer consistency, embedded length fields, and whether the object renders or parses. Document the validation step and flag partial recoveries explicitly rather than counting them as intact.
Misapplying the distinction between an image and a working copy, or answering questions as if analysis were performed on original media.
Lab workflows blur the steps, so candidates skip the write-blocking and verification stage in their reasoning; exam items test whether the candidate can articulate why originals are preserved and how the working copy is verified.
What to do instead
Rehearse the full pipeline aloud: write-block, acquire, hash original and image, compare, analyze the copy, store the original. For each step, state the failure it prevents and the record it produces.
Confusing network-level evidence (packets, flows, logs) with host-level evidence and attributing a packet capture observation to a specific user or process without support.
Candidates treat any log line as ground truth and forget that IP addresses identify interfaces, not people; exam items include NAT, shared hosts, and spoofing to test attribution discipline.
What to do instead
For any network claim, write the inference chain explicitly (packet to IP to host to account to person) and mark each link as supported or assumed. Practice stating what additional evidence would be needed to close each gap.
Presenting conclusions in a report without separating observation, interpretation, and opinion, or without stating limitations and confidence.
Candidates write reports as narratives aimed at demonstrating knowledge rather than as evidence documents; exam items test whether the candidate can distinguish what the data shows from what the examiner infers.
What to do instead
Use a three-part structure per finding: what was observed (with artifact and location), what it means, and how confident the examiner is plus what could change that conclusion. Practice rewriting a vague finding into that structure.