CDFE study guide
CDFE · Work through your exam, one topic at a time.
The Certified Digital Forensics Examiner (CDFE™) is one of the certifications in the Mile2® portfolio, listed by the vendor alongside credentials such as CISSO®, CPTE®, CAICSO™ and C)CSO®. Mile2® describes its certification portfolio as university and accredited, ANSI/ANAB-aligned, and designed to give holders hands-on, job-ready skills that employers trust. The vendor positions its courses for roles including security analyst, network engineer, IT manager and executive leader, and states that it trains students in penetration testing, disaster recovery, incident handling and network forensics - the last being the discipline the CDFE™ name points to. The source page does not publish CDFE™-specific exam objectives, so candidates should confirm the current detailed course outline and exam requirements directly with the vendor before scheduling. Preparation is flexible: Mile2® states that its training courses are not required in order to take a Mile2 certification exam, and that most Mile2 Certification Exam products include an unlimited-use practice quiz and an exam prep guide. Optional routes include self-study combos with 24/7 access to learning materials plus the certification exam, live-online instructor-led classes with a Mile2 Certified Instructor, or the Cyber Range labs referenced on the site. Topics on this exam: Digital Forensics. The CDFE study guide has 1 section and about 438 words.
01Digital Forensics: Defensible Process, Acquisition, and Artefact Interpretation
The Digital Forensics domain tests whether you can run an investigation that survives cross-examination: preserve evidence, acquire it without alteration, interpret artefacts correctly, and report conclusions tied to specific findings. Expect questions on process models, chain of custody, hashing, volatile-data ordering, and file-system and Windows artefact interpretation. NIST SP 800-86 describes four phases: collection, examination, analysis, reporting. The ACPO principles add four duties: no action should change the data; where change is unavoidable the examiner must be competent and able to explain it; an audit trail must let a third party reproduce the result; the case officer carries overall responsibility.
438 words, about 2 minMore study resources for CDFE
- Practice questionsDuring acquisition of a suspect's hard drive, which practice best preserves the evidentiary value of the original media?
- FlashcardsOrder of volatility. RFC 3227 guidance to collect the most volatile evidence first: CPU registers and cache, then memory and network state, then disk, then remote logs, then archival media.
- Cheat sheetOrder of volatility (RFC 3227), most to least volatile: CPU registers and cache, routing table/ARP cache/process table/memory, temporary file systems, disk storage, remote logs and monitoring data, archival media.
- Key termsChain of Custody. A documented, chronological record of who handled a piece of evidence, when, where, and for what purpose, used to prove the evidence was not altered or contaminated between seizure and presentation.
- Study planMap the full CDFE exam blueprint into a one-page table listing every subtopic under Digital Forensics and rate your current confidence from 1 to 5 for each.
- Common mistakesCandidates learned file-type identification from a GUI or one CLI tool and assume a consistent mapping; CDFE-style forensics items test whether the examiner validates evidence rather than trusting metadata that an attacker can trivially alter.
- Exam-day guideBring the original, unexpired ID whose name matches your registration exactly.