About the Certified Digital Forensics Examiner
The PECB Certified Digital Forensics Examiner (CDFE) programme is a deeply technical, hands-on course for professionals who analyse digital evidence. Delivered fully self-paced and online, it moves from the foundations of digital forensics through file-system analysis, reverse engineering, malware analysis and threat hunting, to advanced forensic analysis and incident response.
Where the Lead Forensics Examiner programme centres on preparing and leading investigations, CDFE goes deep on the technical craft — memory and network forensics, examining artefacts across systems, and reconstructing what happened during an incident. It suits analysts who want advanced, practical forensic skills.
Course Information
What You Will Learn
Course Curriculum
- Digital forensics principles
- Evidence collection and preservation
- The forensic toolkit
- Legal and ethical considerations
- File-system structures and artefacts
- Recovering and examining data
- Introduction to reverse engineering
- Interpreting findings
- Static and dynamic malware analysis
- Indicators of compromise
- Threat-hunting techniques
- Correlating evidence
- Memory acquisition and analysis
- Network traffic analysis
- Advanced artefact analysis
- Forensics within incident response
- The five exam domains
- Revision and exam technique
- Booking and sitting the PECB exam
Get the Full Syllabus as a PDF
Curriculum, exam format & everything included — sent straight to your inbox.
All You Need to Know
This programme suits professionals who analyse digital evidence, including:
- Digital forensics analysts
- IT security professionals and incident responders
- Corporate security officers
- Legal professionals involved in cybercrime cases
A basic understanding of cybersecurity principles and foundational knowledge of digital forensics are recommended before enrolling.
The PECB Certified Digital Forensics Examiner exam covers five domains: network traffic analysis, memory acquisition, file-system forensics, malware analysis and threat hunting. Completing the training earns 31 CPD credits.
What Our Learners Say
Completing the Certified Digital Forensics Examiner course was a turning point for my career — it gave me the credibility and the technical grounding in PECB CDFE that my role really needed.
What stood out about this Certified Digital Forensics Examiner training was how practical it was — real case studies, not just theory. I walked away confident about PECB CDFE and ready to apply it immediately.
I compared a few providers before choosing Profice for my Certified Digital Forensics Examiner certification, and I'm glad I did. The materials on PECB CDFE were current and the support team answered every question quickly.
I'd been putting off Certified Digital Forensics Examiner certification for a while, but the self-paced format made it manageable alongside a full-time job. Learning to strengthen our information security posture felt achievable within a few weeks.
The pacing suited a busy schedule, and the focus on PECB CDFE meant I could start applying what I learned before I'd even finished the course.
Career Opportunities After This Training
Digital forensics analysts examine devices, logs and network traffic to reconstruct security incidents, using the evidence-handling standards covered in the Certified Digital Forensics Examiner course.
Hiring Companies
Average Salary
Forensic investigators support internal and external investigations into data breaches, fraud and misuse, presenting findings that stand up to legal scrutiny.
Hiring Companies
Average Salary
Incident response and forensics specialists combine rapid breach containment with rigorous evidence collection, a pairing at the core of the Digital Forensics Examiner certification.
Hiring Companies
Average Salary
Frequently Asked Questions
A PECB credential proving you can perform digital forensic examinations — recovering, analysing and documenting evidence from computers, mobile devices and networks.
Some foundational IT and security knowledge is recommended, but no formal forensics background is required to start the course.
The exam is an essay-type, open-book paper of roughly 3 hours. You need the passing score set by PECB (generally around 70%). After passing you receive a 'Certificate of Exam Success', and the full certification is issued once you also meet PECB's professional-experience requirements.
Evidence acquisition and preservation, file-system and artefact analysis, and the methodology for producing defensible forensic reports.
Yes — the exam voucher is included in the course package. Speak to a Profice advisor to confirm current pricing and what each package includes.