PECB Certified Course: Certified Digital Forensics Examiner (CDFE)

Acquire, preserve, analyse and report digital evidence across diverse systems.

This technical course develops the ability to conduct structured digital-forensics investigations while protecting evidence integrity. It covers legal considerations, chain of custody, file systems, memory, network traffic, malware, reverse engineering, threat hunting, incident response and reporting for technical and legal audiences.

Course at a glance

• Provider and awarding body: PECB.
• Learning format: PECB Self-Study (official course materials).
• Language: English.
• Level: Technical Cybersecurity.
• Examination and certification-application cycle: 12 months from purchase for the first examination attempt, the included free retake if needed, and the certification application.

What this course includes

• More than 300 pages of official PECB instructional materials containing explanations, guidance and practical examples.
• The first examination attempt and one free retake.
• The certification-application fee and the first year of the Annual Maintenance Fee, where applicable.
• A course-completion attestation worth 31 CPD credits, separate from the PECB professional credential.

What you will learn

After completing the course, the learner should be able to:

• explain forensic principles, legal considerations and investigation procedures;
• collect, preserve and analyse evidence under chain-of-custody controls;
• use forensic methods to examine systems and recover or validate evidence;
• produce clear reports for technical and legal stakeholders.

Who this course is for

• Digital-forensics analysts and investigators.
• Security professionals and incident responders.
• Legal and compliance professionals involved in cybercrime matters.
• Cybersecurity and intelligence teams handling digital evidence.

Prerequisites: PECB expects a basic understanding of cybersecurity principles and foundational knowledge of digital forensics.

Course outline

• Foundations of digital forensics.
• File-system analysis and reverse engineering.
• Malware analysis and threat hunting.
• Advanced forensic analysis and incident response.
• Certification exam.

Exam and credential pathway

The exam covers network traffic, memory acquisition, file-system and disk forensics, malware and reverse engineering, threat hunting, automation and correlation.

Passing the exam enables an application to the PECB Certified Digital Forensics Examiner designation. The official pathway requires the specified professional and digital-forensics experience, together with application and ethics requirements.

Course completion, examination success, certification application and credential issuance are separate stages; the credential is not issued automatically.

For official course details, see the PECB Certified Digital Forensics Examiner (CDFE) page.

Access and activation

The 12-month period for the first examination, included free retake and certification application begins on the purchase date.

Each order covers one learner. Wadi Solutions begins processing the PECB registration within one business day, and activation details are sent to the learner's email. Required enrolment details are shared with PECB for activation.

Assignment safeguard: Wadi Solutions verifies the exact PECB assignment before activation. If it cannot be fulfilled, Wadi Solutions offers a suitable customer-accepted replacement or a full refund before activation.

Continue your learning path

• Certified Advanced Penetration Tester (CAPT)
• Certified Artificial Intelligence Manager (CAIM)
• Certified Cloud Security Analyst (CCSA)
• Certified Incident Responder (CIR)

Explore Digital Forensics courses to see the available options.

Before you buy

• If you do not have a myPECB account, create one here.
• If your myPECB email differs from the email used for your Wadi Solutions order, add your myPECB email to the order notes.