IDFEInstitute of Digital Forensic Examiners
IDFE-CFSpecialistFree course

Certified Crypto Forensics Specialist

Crypto forensics for investigators: tracing through bridges and mixers, attribution, device artifacts, evidence integrity and asset freezing, proven in a hands-on lab.

Modules
9
Lessons
45
Length
About 8 h
Pace
Self-paced
Languages
EN · ES · PT
Free · about 8 hStart course

Before you start

Detailed prerequisites are published with the first lessons.

Recommended pathBEDFDA·CCBA·CFA recommendation, not a rule: every course and exam is open to anyone, in any order.

How to get the most from it

Short, regular sessions work better than one long read.

  1. 1
    Go in order

    Each lesson builds on the one before, and later modules refer back to earlier ones.

  2. 2
    One module per sitting

    A module is about 20 minutes of reading. Add 10 minutes for the checks and your notes.

  3. 3
    Read the Exam focus box first

    It says what the exam expects from that lesson, so you read with a purpose.

  4. 4
    Answer before you look

    Commit to an answer in each knowledge check, then read the explanation, even when you were right.

  5. 5
    Redraw the diagram

    Every lesson has one diagram that sums it up. If you can sketch it from memory, you have the lesson.

  6. 6
    The cases are fictional

    People and companies in the examples are invented, and some of them come back across lessons.

  7. 7
    Sign in and come back

    Your place is kept and finished lessons are marked, so short sessions add up.

Course content

9 modules · 45 lessons · 5 h 56 min of reading. Each module shows the exam domains it prepares for.

01Investigation lifecycle and legal framework5 lessons · 38 minExam domain 01

Prepares for: 01 Investigation methodology & legal process (13%)

  1. 1.1What crypto forensics is7 min
  2. 1.2The investigation lifecycle8 min
  3. 1.3Legal authority and international cooperation8 min
  4. 1.4Working with service providers8 min
  5. 1.5Ethics, privacy and investigator safety7 min
02Tracing fundamentals5 lessons · 40 minExam domain 02

Prepares for: 02 Tracing across chains & bridges (21%)

  1. 2.1Tracing to an evidential standard8 min
  2. 2.2Tracing methods and their consequences8 min
  3. 2.3Tracing through custodial services8 min
  4. 2.4Account-model and token tracing8 min
  5. 2.5Tooling, reproducibility and validation8 min
03Cross-chain bridges and swaps5 lessons · 41 minExam domain 02

Prepares for: 02 Tracing across chains & bridges (21%)

  1. 3.1Chain-hopping as an obfuscation and laundering pattern9 min
  2. 3.2Bridges: lock-and-mint, burn-and-release and liquidity bridges8 min
  3. 3.3Swaps, DEXs and instant exchanges8 min
  4. 3.4Layer 2s, sidechains and other chains8 min
  5. 3.5Case study: a multi-chain laundering trail8 min
04Mixers, CoinJoin and privacy coins5 lessons · 41 minExam domain 03

Prepares for: 03 Mixers, privacy coins & obfuscation (13%)

  1. 4.1Custodial mixers9 min
  2. 4.2CoinJoin8 min
  3. 4.3Smart-contract mixers8 min
  4. 4.4Privacy coins8 min
  5. 4.5Other obfuscation techniques8 min
05Attribution and OSINT5 lessons · 41 minExam domain 04

Prepares for: 04 Attribution & OSINT (13%)

  1. 5.1From address to entity to person8 min
  2. 5.2Attribution sources and their reliability8 min
  3. 5.3OSINT methodology8 min
  4. 5.4Linking on-chain and off-chain identifiers9 min
  5. 5.5Attribution in practice: ransomware, scams and DPRK thefts8 min
06Device artifacts and wallet recovery5 lessons · 39 minExam domain 05

Prepares for: 05 Evidence handling & chain of custody (19%)

  1. 6.1Wallets on seized devices8 min
  2. 6.2Search and seizure of crypto at the scene7 min
  3. 6.3Acquisition and analysis of devices8 min
  4. 6.4Wallet recovery under lawful authority9 min
  5. 6.5Exchange and cloud accounts as evidence7 min
07Evidence integrity and chain of custody5 lessons · 39 minExam domain 05

Prepares for: 05 Evidence handling & chain of custody (19%)

  1. 7.1Digital evidence principles8 min
  2. 7.2Preserving on-chain evidence8 min
  3. 7.3Hashing, logging and chain of custody8 min
  4. 7.4Quality management in the forensic unit8 min
  5. 7.5Disclosure and defense scrutiny7 min
08Expert reports and courtroom testimony5 lessons · 37 minExam domain 06

Prepares for: 06 Expert reports & testimony (11%)

  1. 8.1The expert's role and duties8 min
  2. 8.2Writing the forensic report8 min
  3. 8.3Visual evidence for courts7 min
  4. 8.4Testimony and cross-examination7 min
  5. 8.5Working with lawyers, courts and joint expert meetings7 min
09Freezing, seizure and asset recovery5 lessons · 40 minExam domain 07

Prepares for: 07 Seizure, freezing & recovery (10%)

  1. 9.1Freezing and seizure options8 min
  2. 9.2Securing seized crypto-assets8 min
  3. 9.3Managing and realizing seized assets8 min
  4. 9.4Victim recovery and civil routes8 min
  5. 9.5Case study: from theft to recovery8 min

Exam blueprint

The official exam domains and the weights used to draw questions. The modules column shows where the course prepares you for each one.

DomainCourse modulesWeight
01Investigation methodology & legal process13%
02Tracing across chains & bridges21%
03Mixers, privacy coins & obfuscation13%
04Attribution & OSINT13%
05Evidence handling & chain of custody19%
06Expert reports & testimony11%
07Seizure, freezing & recovery10%
Total100%

Who it is for

Law enforcement, forensic examiners, court-appointed experts and incident responders.

Questions

Is the course really free?

Yes. Every lesson is free to read, with or without an account. You only pay if you decide to take the certification exam.

Do I need the course to take the exam?

No. The exam is independent and open to anyone. The course covers every exam domain, with the weights shown under Course content.

Do I get a certificate for finishing the course?

No. Finishing marks the course as complete in your account. The IDFE-CF credential comes only from passing the exam.

Which languages is it in?

English, Spanish and Portuguese. Switch at any time with EN · ES · PT at the top of the page.