Digital Forensics Foundation
The common ground of every digital investigation: how evidence is identified, acquired, preserved, analysed and reported without losing its integrity.
Who it is for
Newcomers to forensics, investigators, IT and security staff, lawyers and auditors who work with digital evidence.
Exam format
50 multiple-choice questions in 75 minutes
Questions are drawn at random from the item bank, weighted by the blueprint below. Answers are saved after every question, and the exam is submitted automatically when time runs out.
See what it looks like
An examiner records the SHA-256 of a disk image at acquisition and again before analysis. The values differ. What is the most appropriate next step?
The correct option is shown. In the exam, questions are drawn at random from a bank of several hundred items. Exams are written in English first; other languages open once their translation is reviewed.
Blueprint
These domains are the course modules and the weights used to draw exam questions.
| Domain | Weight | |
|---|---|---|
| 01Digital evidence fundamentals | 15% | |
| 02Legal and ethical principles | 10% | |
| 03Identification and seizure | 15% | |
| 04Acquisition and integrity | 20% | |
| 05Chain of custody and documentation | 15% | |
| 06Analysis fundamentals | 15% | |
| 07Reporting basics | 10% |
Course syllabus
- 01Digital evidence fundamentalsIn preparation
- 02Legal and ethical principlesIn preparation
- 03Identification and seizureIn preparation
- 04Acquisition and integrityIn preparation
- 05Chain of custody and documentationIn preparation
- 06Analysis fundamentalsIn preparation
- 07Reporting basicsIn preparation
Exam languages
An exam opens in a language only when its whole item bank has been translated and reviewed.