EasyELEarning Academy · PECB Authorized Partner
Certified Digital Forensics Examiner (CDFE) – Digital Forensics Training
What really happened during a security incident? In this digital forensics course at EasyELEarning Academy, you learn to preserve and analyse digital evidence systematically and document your findings clearly. The CDFE course connects digital forensics principles with practical investigation methods.
Duration
5 days · 4 training days + examinationDelivery
Live online or in personCredential
PECB examination & certificationContent and learning objectives
- Digital forensics principles and legal considerations
- Digital evidence preservation, data integrity and chain of custody
- File-system, disk and memory forensics
- Network traffic and protocol analysis
- Malware analysis, reverse engineering and threat hunting
- Forensic reporting and interpreting findings for incident response
Practice example: file access or actual data leakage?
An illustrative, fictional example created by EasyELEarning Academy. It is not an official PECB exercise or a promise that this particular case will be covered in your booked course.
Scenario
A company notices unusual access to a project folder. Its logs show downloads outside normal working hours, while a company laptop is running automatic synchronisation. Initial timestamps from the cloud and endpoint do not align. Whether information was shared without authorisation remains unclear.
Task
A useful investigation plan starts with a precise question and an authorised scope. Which sources could distinguish a deliberate download from an automatic transfer? Possible records include access logs, synchronisation events and file metadata. Interpret timestamps and time zones, document where the data came from, and separate observable facts from assumptions. Also identify missing information and explain why it matters.
Possible result
The output could be an event timeline with source references and a short findings report. It would explain which transfers are documented, what alternative explanation also fits the traces, and which additional investigation could resolve the outstanding question. This connection between technical analysis and understandable reporting illustrates the forensic perspective of the CDFE course.
Limits
A recorded access does not by itself prove disclosure to another party. Gaps or conflicting timestamps must remain visible in the report. This example promises neither reliable identification of a perpetrator nor automatic acceptance of a future investigation report as evidence in court.
Who should attend?
Professionals working in information & cybersecurity, with responsibilities appropriate to the selected course level.
Prerequisites
Basic knowledge of cybersecurity and digital forensics is required. The requirements for subsequent PECB certification are separate.
Course structure and delivery
The full course comprises four training days and the PECB examination on day five. You work through exercises and practical cases live with a qualified trainer. Live-online and in-person delivery cover the same content.
Online sessions are delivered live using alfaview. The Odoo portal provides course information and materials. Dates, teaching language and classroom location are agreed before the course starts.
Materials, examination and certification
The full course includes official PECB training materials, tuition in the selected format and the first PECB examination attempt.
PECB certification requires a passed examination and fulfilment of the requirements for the credential applied for. Depending on the level, these include evidence of professional and practical experience and acceptance of the PECB Code of Ethics. PECB assesses the application. Course attendance and passing the examination alone do not guarantee the full CDFE title.
Option: 4 hours of exam preparation
An optional four-hour live exam preparation session is available for €650. It is intended for participants who are already studying independently and does not replace the complete PECB course. Materials and examination arrangements for this option are agreed separately in advance.
Teaching and examination language
Teaching languages: German, English or Hungarian. The selected teaching language is confirmed when scheduling the course. Hungarian is a teaching language for this PECB course only and is not a promised examination language. The examination language and the language of official PECB materials are agreed separately before booking.
Self-employed? Explore KOMPASS before booking.
KOMPASS may support suitable professional development for eligible solo self-employed people in Germany. Arrange a consultation with us to discuss course selection. Mandatory funding advice and eligibility checks are provided by an official KOMPASS advisory centre. Only make a binding booking after the qualification voucher has been issued. Training must include at least 20 hours; not every offer meets this condition. Funding eligibility is assessed individually.
PECB course profile and credential requirements
Explore more information and cybersecurity courses
Frequently asked questions about this course
Can I start without any forensic knowledge?
PECB expects basic cybersecurity and digital forensics knowledge. This is therefore not a complete introduction to IT.
Is digital forensics only relevant to police and courts?
No. Organisations also use it to reconstruct security incidents through files, system data and network evidence.
Why is simply copying suspicious files insufficient?
A traceable acquisition records origin, procedures and transfers. This makes the examination material and chain of custody verifiable.
Does a hash value prove who changed a file?
No. Comparing hashes checks data integrity. Attribution to a person needs additional evidence and a defensible analysis.
Why can memory and network data be decisive?
Volatile data can disappear when power is removed. Network evidence complements disk findings and helps establish event sequences.
Is an automatically generated forensic tool report sufficient?
Usually not. An examination report explains scope, methods, findings and conclusions; tool output can support it as an appendix.
Does passing the exam automatically make me fully CDFE-certified?
No. PECB also checks the requested credential’s requirements, particularly experience. A provisional credential may be appropriate without the required evidence.
Can I study CDFE in Hungarian and arrange the exam language separately?
Yes. We offer Hungarian as a teaching language. The examination language and official materials language are agreed separately before booking.
Selected courses compared
Which content fits your goals, which skills are practised, and what does the credential demonstrate? This selection compares our course with two specific alternatives.
On smaller screens, scroll the table sideways to see all columns.
| Course offer | Content | Skills development | What the credential demonstrates |
|---|---|---|---|
| EasyELEarning Academy This course offer | Evidence preservation, integrity and chain of custody are combined with disk, memory and network forensics, malware analysis and clear reporting for incident investigation. | You learn to preserve digital traces methodically, structure investigations and document findings clearly. The course assumes basic knowledge of cybersecurity and digital forensics. | PECB evaluates the exam, application and requirements of the requested credential, including relevant experience. Attendance and examination success alone do not guarantee the full CDFE title. |
| SANS Institute / GIAC FOR500: Windows Forensic Analysis / GCFE Related forensics qualification with a stronger Windows focus; a different certification system. Provider’s courseAdditional source | FOR500 focuses on digital artefacts within Windows systems, including the Registry, browsers, email, logs and user activity, supported by practical laboratory exercises. | You deepen your ability to collect and interpret Windows artefacts, reconstruct activity and investigate cases, with a technical, operating-system-specific emphasis. | GIAC awards GCFE through a proctored certification examination. FOR500 is the associated preparation course; attending it does not itself confer the GIAC credential. |
| EC-Council Computer Hacking Forensic Investigator (CHFI) Related cross-platform forensics training leading towards a separate EC-Council credential. Provider’s courseAdditional source | CHFI covers investigation procedures, evidence acquisition and analysis across Windows, Linux, macOS, networks, cloud and mobile devices, including malware and anti-forensics techniques. | You practise a methodical investigation process from locating digital traces through analysis and reporting, working across different systems and evidence sources. | EC-Council awards CHFI following the certification examination. Eligibility without official training additionally requires documented experience and assessment of an eligibility application. |
Checked: 31 October 2026. Based on the linked provider information. This selection is not a complete market overview. Related courses are identified; scope, entry requirements, teaching languages and examination languages may differ. The table describes learning objectives and credential types, without guaranteeing learning outcomes or general equivalence. Current offer and certification conditions apply. Official course names retain their original wording.