About This Course
The PECB Certified Digital Forensics Examiner (CDFE) programme is a deeply technical, hands-on course for professionals who analyse digital evidence. Delivered fully self-paced and online, it moves from the foundations of digital forensics through file-system analysis, reverse engineering, malware analysis and threat hunting, to advanced forensic analysis and incident response.
Where the Lead Forensics Examiner programme centres on preparing and leading investigations, CDFE goes deep on the technical craft — memory and network forensics, examining artefacts across systems, and reconstructing what happened during an incident. It suits analysts who want advanced, practical forensic skills.
Course Information
What You Will Learn
Course Curriculum
- Digital forensics principles
- Evidence collection and preservation
- The forensic toolkit
- Legal and ethical considerations
- File-system structures and artefacts
- Recovering and examining data
- Introduction to reverse engineering
- Interpreting findings
- Static and dynamic malware analysis
- Indicators of compromise
- Threat-hunting techniques
- Correlating evidence
- Memory acquisition and analysis
- Network traffic analysis
- Advanced artefact analysis
- Forensics within incident response
- The five exam domains
- Revision and exam technique
- Booking and sitting the PECB exam
Get the Full Syllabus as a PDF
Curriculum, exam format & everything included — sent straight to your inbox.
All You Need to Know
This programme suits professionals who analyse digital evidence, including:
- Digital forensics analysts
- IT security professionals and incident responders
- Corporate security officers
- Legal professionals involved in cybercrime cases
A basic understanding of cybersecurity principles and foundational knowledge of digital forensics are recommended before enrolling.
The PECB Certified Digital Forensics Examiner exam covers five domains: network traffic analysis, memory acquisition, file-system forensics, malware analysis and threat hunting. Completing the training earns 31 CPD credits.
Frequently Asked Questions
Yes — it is delivered online and self-paced, covering the same competency domains as PECB’s instructor-led programme so you can study around your schedule.
Lead Forensics Examiner focuses on preparing and leading an investigation end to end; CDFE is a deeper, more technical programme covering file-system, memory, malware and network analysis. Many professionals value both.
A basic grasp of cybersecurity and some foundational digital forensics knowledge are recommended, as this is a technical programme.
After passing the exam and meeting PECB’s requirements you can apply for the PECB Certified Digital Forensics Examiner credential.
Yes — the self-paced kit includes one certification exam and one free exam retake.