Skip to Content

Certified Digital Forensics Professional (eCDFP)   


Request for price


Length: 5 day (40 hours)

 

The eCDFP course is a practical, lab-intensive program that covers the entire lifecycle of a digital forensic investigation. It focuses on the acquisition, preservation, and analysis of digital evidence. Unlike purely theoretical certifications, eCDFP requires you to use professional tools to recover deleted files, analyze network traffic, and correlate logs to build a "story" of an attack.

The course emphasizes manual analysis and understanding "under the hood" data structures (like Hex and file headers) rather than just pushing buttons in automated software.

While there are no strict "gatekeeper" certifications required to start, a strong technical foundation is essential:

  • Networking Foundations: Deep knowledge of the TCP/IP suite, protocol headers, and traffic patterns.
  • Operating System Internals: Understanding of how Windows and Linux manage files, registries, and system artifacts.
  • Hardware Basics: Knowledge of storage device characteristics (HDD vs. SSD) and file systems (NTFS, FAT32).
  • Suggested Experience: 1–2 years in a technical security role (SOC Analyst, Incident Responder, or System Admin). Completing the eJPT or eEDA provides a great stepping stone.

Digital Forensic Examiners: Professionals looking to validate their ability to handle evidence in legally sound ways.

Incident Responders: Blue teamers who need to perform deep-dive root cause analysis after a breach.

Computer Forensic Analysts: Individuals working in law enforcement or corporate internal investigations.

Cybersecurity Consultants: Who need to provide forensic services and expert testimony for clients.

Course objectivesCourse outlines

Course objectives

After completing this course, students will be able to:

      • Preserve Evidence: Execute a collection plan that maintains the Chain of Custody and evidence integrity.
      • Analyze Windows Artifacts: Identify evidence of execution, user activity, and system changes using the Registry, Prefetch, and ShellBags.
      • Perform Network Forensics: Reconstruct network attacks by analyzing PCAP files and identifying suspicious C2 traffic or data exfiltration.
      • Execute Data Acquisition: Master the "Order of Volatility" and create forensically sound images of physical and logical drives.
      • Correlate Logs & Timelines: Synthesize data from various sources into a coherent chronological narrative.
      • Utilize Industry Tools: Gain proficiency in tools like FTK Imager, Wireshark, Autopsy, HxD, and RegRipper.


Course outlines

    • Phase 1: Introduction & Acquisition
      • Digital Forensics Fundamentals: The scientific method and the 5 W's (Who, What, When, Where, Why).
      • Data Acquisition: Live vs. Dead acquisition, write blockers, and hashing for data validation.
      • Evidence Life Cycle: Acquisition $\rightarrow$ Analysis $\rightarrow$ Presentation.
    • Phase 2: File & Disk Analysis
      • Data Representation: Mastering Hexadecimal, Bits, Bytes, and ASCII.
      • Storage Fundamentals: MBR vs. GPT partitioning, Volumes, and Slack Space.
      • File Systems: In-depth analysis of FAT and NTFS structures.
    • Phase 3: System & Network Forensics
      • Windows Forensics: Investigation of the Registry, LNK files, Jump Lists, and browser history.
      • Network Analysis: Protocol analysis (HTTP, DNS, SMTP) and flow analysis to detect malicious patterns.
      • Email Forensics: Analyzing headers and metadata to trace phishing or spoofing.
    • Phase 4: Logs, Timelines & Reporting
      • Log Correlation: Using Linux tools to parse and filter massive log files.
      • Timeline Analysis: Identifying temporal proximity of events to prove intent or impact.
      • Forensic Reporting: Writing professional, clear, and legally defensible reports.


Button