Digital Forensic Examiner Certification

The Digital Forensics Examiner certification is awarded after successful completion of a hands-on, competency based practical examination that covers basic digital forensics knowledge areas and skills that every Digital Forensics Examiner must master.
 

Exam Overview

The Digital Forensics Examiner certification exam is included as part of the of the Digital Forensics Examiner course instructed by CyberSecurity Academy. digital forensic examiner certificationSince 2002, it is also been awarded to digital forensics students at Edmonds Community College who are able to demonstrate their ability to perform a comprehensive digital forensic investigation in their upper level digital forensic courses.

The vendor-neutral exam consists of 25 multiple choice questions that integrate the examination of two or more forensic images. Two hours are alloted for the exam, with a minimum required passing score of 70%.

If not taken as part of the Digital Forensics Examiner course, the exam cost is $185.00. It is not currently offered via the typical computer based testing providers due to the hands-on component. If you wish to schedule an exam to be administered remotely, please send an email to DFE@cybersecurityacademy.com for the Test Candidate Agreement and information on remitting payment. You must have a Web cam, Skype account, and hardware write blocker in order to take the examination. You may use any software of your choosing to process the images that are part of your exam.

 

Exam Knowledge Areas

  • Active, archival and latent data
  • Hashes and checksums
  • Creating forensically sound working copies or images of media
  • Common file header formats
  • Documentation, chain of custody, and evidence handling procedures
  • File slack, ram slack, drive slack, and unallocated space
  • Rules of evidence
Digital Forensics Examiner
 

Preparing For Your Exam

The questions for the DFE are changed and updated every six months, as are the images used for the hands-on component. No two exams are alike. A course of instruction to prepare you for performing work as a digital forensic examiner such as the Digital Forensics Examiner course should prepare you for the exam, as well as familiarization with manually recovering and carving various types of files from storage media. Practice and familiarity with acquiring forensic images is a must.