Computer Forensic Examiner
Examination of computers and their storage: file systems, operating system artifacts, timelines and the traces users and attackers leave behind.
What you earn
- Your certificateA4, with your name, ready to print or attach as a PDF.
- A public verification pageEmployers and courts check the code or scan the QR code at idfe.global/verify.
- A digital badgeAdd it to LinkedIn in one click, or keep it in any Open Badges 3.0 wallet.
- Valid for 5 yearsRenew it by passing the current exam before it expires.
Who it is for
Examiners and incident responders who analyse disk images of Windows, macOS and Linux systems.
Exam format
40 multiple-choice questions in 60 minutes
Concepts, artifacts and interpretation, weighted by the blueprint.
15 tasks on an evidence package, within 6 hours
You download a sealed package, verify its SHA-256 and answer with exact values: paths, timestamps, identifiers. Part A counts for 40% and Part B for 60% of the score.
See what it looks like
When (UTC) was “contracts_v2.pdf” last opened by the user “m.lima”?
Hash of the acquired data from the source media. Illustrative values.
Exact values are graded automatically. Paths are case-insensitive and timestamps accept a ±1 second difference. Any tool may be used.
Blueprint
These domains are the course modules and the weights used to draw exam questions.
| Domain | Weight | |
|---|---|---|
| 01File systems | 20% | |
| 02Windows artifacts | 25% | |
| 03Timeline analysis | 15% | |
| 04Browser, email and cloud sync | 15% | |
| 05Memory and volatile data | 10% | |
| 06macOS and Linux essentials | 10% | |
| 07Anti-forensics | 5% |
Course syllabus
- 01File systemsIn preparation
- 02Windows artifactsIn preparation
- 03Timeline analysisIn preparation
- 04Browser, email and cloud syncIn preparation
- 05Memory and volatile dataIn preparation
- 06macOS and Linux essentialsIn preparation
- 07Anti-forensicsIn preparation
Exam languages
An exam opens in a language only when its whole item bank has been translated and reviewed.