CDFE study plan
CDFE · Give each week a clear focus.
8 weeks · About 6 hours per week
Digital Forensics
Map the full CDFE exam blueprint into a one-page table listing every subtopic under Digital Forensics and rate your current confidence from 1 to 5 for each
Define and write flashcards for the core forensic principles: chain of custody, order of volatility, forensic soundness, hashing for integrity, and write blocking
Compare the four main acquisition types (static dead-box, live, logical, physical) and record when each is appropriate in a decision table
Set up a lab notebook template that records tool version, hash values, timestamps, and examiner initials for every exercise you run
Your checkpoint
A completed blueprint coverage table with confidence ratings plus a reusable lab notebook template populated with your first 20 principle flashcards
Digital Forensics
Explain how NTFS, FAT32, ext4, and APFS differ in metadata structures, timestamps, and slack space, and summarize each in your own notes
Trace the full boot and file-creation lifecycle on a Windows system to identify where artifacts such as $MFT, $LogFile, and $UsnJrnl are written
Practice calculating file offsets and interpreting hexadecimal disk structures by hand for at least five sample structures
Build a personal glossary of at least 40 file system and storage terms with one-line definitions
Your checkpoint
A 1,500-word file system reference document covering the four file systems with annotated examples of key metadata structures
Digital Forensics
Perform a physical image acquisition of a practice drive or USB device and verify the resulting hash against the source
Execute a live acquisition on a running practice VM and document the volatile data you captured and why
Demonstrate proper chain-of-custody documentation from seizure through storage for your practice evidence
Configure a forensic workstation with write blockers, imaging tools, and a verified tool inventory
Your checkpoint
A complete acquisition report for two practice images including hashes, tool versions, chain-of-custody form, and a verification screenshot log
Digital Forensics
Identify and extract Windows artifacts including registry hives, event logs, prefetch, shimcache, and amcache from a practice image
Correlate at least three artifacts to construct a timeline of a simulated user session
Interpret Linux artifacts such as bash history, auth logs, systemd journal, and cron entries on a practice image
Analyze browser and email artifacts to determine user activity patterns
Your checkpoint
A reconstructed activity timeline spanning at least 24 hours of a practice image, citing the specific artifact source for each event
Digital Forensics
Describe how deleted file recovery works on NTFS and ext4 and attempt recovery of at least five deleted files from a practice image
Analyze unallocated space and slack space to locate residual data and document your method
Examine log and registry artifacts for signs of anti-forensics such as timestomping, log clearing, and secure deletion
Explain the forensic significance of each artifact category in a written summary suitable for a report reader
Your checkpoint
A recovery and anti-forensics findings memo listing each recovered or suspicious item with its location, method used, and forensic interpretation
Digital Forensics
Analyze network capture data and firewall or proxy logs to reconstruct a suspected exfiltration event
Examine mobile device backups and cloud sync artifacts to identify data movement
Trace how malware persistence mechanisms leave forensic evidence in registry, scheduled tasks, and services
Document the limits of each network and mobile artifact so you can state confidently what cannot be concluded
Your checkpoint
An incident narrative of at least 1,000 words reconstructing a simulated exfiltration using network, host, and mobile artifacts, with explicit evidence citations
Digital Forensics
Draft a full forensic report following a standard structure: scope, methodology, findings, limitations, and conclusions
Write an expert-style summary that translates technical findings for a non-technical reader
Review legal and ethical considerations including jurisdiction, privacy, authorization, and admissibility, and note how each affects your report language
Peer-review your own report against a checklist and correct at least five weaknesses
Your checkpoint
A polished 2,000-word forensic report on a practice case, including an executive summary, methodology section, and evidence appendix
Digital Forensics
Complete two full timed practice exams under realistic conditions and log every missed question by subtopic
Re-drill weak subtopics until you can explain each answer choice and why the distractors are wrong
Condense all notes into a single two-page quick-reference sheet for final review
Simulate explaining your methodology aloud for ten minutes without notes to confirm retention
Your checkpoint
A scored practice exam log showing improvement between attempts plus a final two-page quick-reference sheet covering all blueprint subtopics
Milestones
Week 2: You can sketch the NTFS and ext4 metadata layout from memory and explain where three key artifacts live without consulting notes
Week 4: You produce a verified image with matching hashes and a timeline that cites at least three independent artifact sources
Week 6: You reconstruct a multi-source incident narrative and correctly distinguish observed evidence from inference in every paragraph
Week 8: You score at least 80 percent on a timed practice exam and can explain every missed item by subtopic without notes