Digital Forensics Evidence Handler Exam

Are you ready for the challenge?

The exam is divided into two parts:

  • Part #1: requires you to answer general digital forensics evidence handling questions.
  • Part #2: requires you to apply the digital forensics evidence handling skills in a hands-on experience.

    • Required Skills

    what are the skills needed to pass the exam?

      The exam covers comprehensive digital forensic skills, including:
      • Data Acquisition and Preservation: Knowledge of Order of Volatility and Disk Imaging.

      • Hashing and Data Validation: Understand hashing algorithms (e.g., MD5, SHA1) for data validation. Using hashes to confirm the integrity of forensic images and evidence files.

      • Forensic Image Analysis: Skills in Accessing and Analyzing Images, and Understand the scope of logical images (e.g., single partitions) and physical images (e.g., entire disk, unpartitioned space).

      • Tool Proficiency:Understand Forensic tools like FTK, DD, and hardware/software Write blockers.

      • File Systems and Partitioning: Recognize common partitioning schemes, and Understand how logical drives and file systems are represented in forensic images.

      • Reporting and Communication: Record findings, ensure thorough reporting, including the explanation of methods and results, and know the differences between process documentation (e.g., Chain of Custody) and final analysis reports.

    🗣️ What Learners Are Saying

    ⭐ Real feedback from learners who’ve taken the C5W Digital Forensics Foundations Exam ⭐

    “I was disappointed for on eCDFP exam and thought it could be much challenging and more fun so I gave this exam a try and it was worth it! This exam has 2 main parts (theory and hands-on) just like eCDFP but solely focus on evidence acquisition (especially disks), and most of the theory are challenging as it test technical knowledge to acquire evidence and handle them. The hands-on part are a lot more fun than eCDFP as well! Thanks to Cyber 5W for providing such an enjoyable exam.”

    Information Technology Officer

    Warawut Manosong

    FAQ

    What you need to know about CCEH?

    • How much time do I have to complete the exam?

      One day to complete the exam.

    • What does the exam format looks like, is it a multiple choice question (MCQ), or what exactly?

      The exam is divided into two parts: Part 1: Answer multiple-choice questions on general digital forensics evidence handling concepts. Part 2: Apply digital forensics evidence handling skills in a hands-on practical exercise.

    • What tools do I need for the exam? Will you provide me with a lab environment?

      You will be provided with a virtual machine to complete the exam.

    • Is there any support to contact during my exam period?

      You are welcome to email our team info [at] cyber5w [dot] com, but please note that we will not be able to answer any question related to the exam itself. In other words, we won’t be giving any hints to the investigation given for your exam.

    Refund Policy:

    Refund requests for In-person and Online Virtual Training are accepted before the refund deadline and as long as the online course has not been accessed. To initiate a refund, please submit your request to [email protected]. The registration fee will be refunded, minus a $50 refund processing fee, to the original payment method. Please be advised that CYBER 5W OnDemand Courses are non-refundable and non-transferable once payment has been completed and course material has been accessed.