Practitioner
Certified Digital Forensics Examiner
2026 edition
Self-paced PECB training delivered via myPECB.
Global training partner Aegentra is an official PECB authorised training partner and an official CompTIA partner.
Gain the expertise to conduct digital forensic investigations and obtain legally admissible digital evidence. Certified Digital Forensics Examiner (CDFE) builds a comprehensive command of forensic analysis across Windows, macOS, Linux, and mobile devices — acquiring, analysing, and preserving evidence to industry best practice. Through hands-on labs you work across file-system forensics, memory forensics, network analysis, and advanced malware analysis with the tools examiners actually use — Wireshark, Zeek, Ghidra, and YARA — so you can handle complex investigations, secure evidence from a range of devices and systems, and defend the integrity of digital evidence in court.
- CPD credits
- 31
- Course languages
- English
Who it is for
- Digital forensics analysts and investigators
- IT security professionals and incident responders
- Legal professionals involved in cybercrime cases
- Corporate security officers and compliance managers
- Information security team members and cyber intelligence analysts
- Professionals seeking to advance their knowledge in digital forensics
What you will learn
- Demonstrate an in-depth understanding of digital forensic principles, legal considerations, and investigative procedures for cybercrime and incident response.
- Collect, preserve, and analyse digital evidence from various sources while adhering to chain-of-custody and evidentiary standards.
- Use industry-standard forensic tools to examine file systems, recover deleted data, and detect tampering or malicious activity.
- Produce comprehensive forensic reports and communicate findings clearly to both technical and legal audiences in investigations and potential litigation.
Course content
Day 1 — Foundations of digital forensics
- Training course objectives and structure
- Introduction to digital forensics
- Digital forensics tools and techniques
- Network analysis with Wireshark
- Basics of malware analysis
Day 2 — File system analysis and reverse engineering
- File system forensics
- Memory forensics
- Reverse engineering in Windows (PE files)
- Reverse engineering in Linux (ELF files)
- x86 architecture fundamentals
Day 3 — Malware analysis and threat hunting
- Advanced malware analysis techniques
- Introduction to Zeek for network analysis
- Ghidra for malware analysis
- YARA rule development for threat hunting
Day 4 — Advanced forensic analysis and incident response
- Dark web forensics
- Interactive behaviour analysis
- Memory and file-system techniques
- Advanced scripting and automation with Zeek
- Patch analysis and modifications with Ghidra
Day 5 — Certification exam
- PECB Certified Digital Forensics Examiner exam
- 3 hours, five competency domains
Prerequisites
- Before attending, have foundational knowledge of cybersecurity and digital forensics.
- Professional and forensic-project experience requirements apply separately to the credential application.
The exam
- Format
- Open-book, technical exam
- Duration
- 3 hours
- Questions
- 20 technical questions in the current English PECB examination record
- Pass mark
- Confirm the current technical-exam passing requirements with PECB
What is included
Course materials
- 300+ pages of explanatory information, examples, and best practices
- Hands-on forensics labs, exercises, and quizzes
- 12 months access via myPECB
Exam package
- Official PECB CDFE exam voucher
- 3-hour exam, remotely proctored
- Two attempts (initial + one free resit within 12 months)
- PECB digital certificate on pass