Digital Forensics
Evidence Handling Exam

Are you ready for the challenge?

Digital Forensics Evidence Handling Exam The exam is divided into two parts:

  • Part #1: requires you to answer general digital forensics evidence handling questions.
  • Part #2: requires you to apply the digital forensics evidence handling skills in a hands-on experience.

    • Required Skills

    what are the skills needed to pass the exam?

      The exam covers comprehensive digital forensic skills, including:
      • Data Acquisition and Preservation: Knowledge of Order of Volatility and Disk Imaging.

      • Hashing and Data Validation: Understand hashing algorithms (e.g., MD5, SHA1) for data validation. Using hashes to confirm the integrity of forensic images and evidence files.

      • Forensic Image Analysis: Skills in Accessing and Analyzing Images, and Understand the scope of logical images (e.g., single partitions) and physical images (e.g., entire disk, unpartitioned space).

      • Tool Proficiency:Understand Forensic tools like FTK, DD, and hardware/software Write blockers.

      • File Systems and Partitioning: Recognize common partitioning schemes, and Understand how logical drives and file systems are represented in forensic images.

      • Reporting and Communication: Record findings, ensure thorough reporting, including the explanation of methods and results, and know the differences between process documentation (e.g., Chain of Custody) and final analysis reports.

    FAQ

    What you need to know about CDEH?

    • How much time do I have to complete the exam?

      One day to complete the exam.

    • What does the exam format looks like, is it a multiple choice question (MCQ), or what exactly?

      The exam is divided into two parts: Part 1: Answer multiple-choice questions on general digital forensics evidence handling concepts. Part 2: Apply digital forensics evidence handling skills in a hands-on practical exercise.

    • What tools do I need for the exam? Will you provide me with a lab environment?

      You will be provided with a virtual machine to complete the exam.

    • Is there any support to contact during my exam period?

      You are welcome to email our team info [at] cyber5w [dot] com, but please note that we will not be able to answer any question related to the exam itself. In other words, we won’t be giving any hints to the investigation given for your exam.