About This Course
The PECB Lead Forensics Examiner programme teaches you to conduct and lead digital forensic investigations — from the moment an incident is detected through to a defensible report. Delivered fully self-paced and online, it combines incident-response fundamentals with the forensic disciplines of acquiring, preserving and analysing digital evidence.
You’ll learn to prepare and run an investigation, protect the chain of custody, examine digital artefacts across systems, and present findings that hold up in disciplinary, legal or recovery contexts. It suits professionals who investigate incidents or support legal and compliance teams with digital evidence.
Course Information
What You Will Learn
Course Curriculum
- Incident response and forensics concepts
- Legal, ethical and regulatory considerations
- The forensic investigation lifecycle
- Roles and responsibilities
- Planning and scoping an investigation
- Building the forensic toolkit
- Managing the investigation team
- Chain of custody and evidence handling
- Sound acquisition of digital evidence
- Imaging and hashing
- Preserving volatile and non-volatile data
- Documentation and integrity
- File system and artefact analysis
- Reconstructing events from evidence
- Correlating findings
- Writing the forensic report
- The competency domains
- Revision and exam technique
- Booking and sitting the PECB exam
Get the Full Syllabus as a PDF
Curriculum, exam format & everything included — sent straight to your inbox.
All You Need to Know
This programme suits professionals who investigate incidents or handle digital evidence, including:
- Forensic examiners and incident responders
- Security professionals and SOC analysts
- IT professionals supporting investigations
- Legal, compliance and law-enforcement support roles
A fundamental understanding of computer forensics is recommended before enrolling.
The PECB Certified Lead Forensics Examiner exam assesses the competency domains for preparing, leading and reporting a digital forensic investigation. Completing the training earns 31 CPD credits.
Frequently Asked Questions
Yes — it is delivered online and self-paced, covering the same competency domains as PECB’s instructor-led programme so you can study around your schedule.
A fundamental understanding of computer forensics is recommended; the programme builds the investigative process up methodically.
Yes — sound evidence handling, chain of custody and defensible reporting are central to the programme.
After passing the exam and meeting PECB’s requirements you can apply for the PECB Certified Lead Forensics Examiner credential.
Yes — the self-paced kit includes one certification exam and one free exam retake.