Professional Certification • Vendor-Neutral • Online Examination

Certified eDiscovery & Forensic Investigation Practitioner (CEFIP)

Validate technically sound and legally defensible digital-evidence investigation knowledge.

Purchase Exam Voucher – $295 View Certification Outline

Certification Exam Details

The certification examination is delivered online. The exam-voucher fee shown below is the certification fee only; training is not included.

Number of Questions	50
Pass Score	70%
Time Allotted	90 minutes
Exam Language	English
Exam Format	Online
Exam Expiration	1 Year from Purchase
Study Guide	eCourseware / Self-paced online

Detailed Certification Outline

The examination validates knowledge across the subject areas below, based on the detailed programme coverage published for this certification.

Module 1 – Introduction to Digital Forensics and eDiscovery

Definition and scope of digital forensics
Digital forensics, computer forensics and eDiscovery distinctions
Digital evidence in investigations and legal proceedings
Cybercrime and digital risk
Introduction to ESI

Module 2 – Legal and Ethical Frameworks

Admissibility and chain of custody
Relevant evidence, privacy and data-protection laws
ACPO principles and NIST guidance
Ethical conduct
Privacy, jurisdiction and international cooperation

Module 3 – Digital Forensics Investigation Process

Investigation models including NIST, ACPO and EDRM
Preparation, identification, preservation, collection, examination, analysis and reporting
Incident-response integration
Forensic readiness
Documentation and audit trails

Module 4 – Data Acquisition and Preservation

Live/dead and static/volatile acquisition
Write blocking and imaging
Hashing and verification
Chain of custody
Original evidence and working copies

Module 5 – File Systems and Storage Media

FAT, NTFS, ext2/3/4, APFS and exFAT
Metadata, slack space and unallocated clusters
Data carving and deleted-file recovery
Disk structures
HDD, SSD, RAID and USB evidence

Module 6 – Forensic Analysis Techniques

Timeline analysis and event reconstruction
Artifact examination
Keyword, pattern and hash searching
Data-hiding detection
Hex and signature analysis

Module 7 – Operating System Forensics

Windows, Linux/Unix and macOS artifacts
Boot and startup artifacts
Memory-forensics basics

Module 8 – Network and Email Forensics

PCAP and network traffic analysis
C2 and exfiltration indicators
Email headers and tracing
SMTP/IMAP/POP forensics
Browser and proxy artifacts

Module 9 – Mobile and IoT Forensics

Logical, physical, file-system and chip-off acquisition
Android and iOS artifacts
Locked devices and encryption challenges
IoT evidence sources
Preservation challenges

Module 10 – Malware and Advanced Threat Forensics

Malware types and infection vectors
Static and dynamic analysis
Reverse-engineering basics
Memory analysis
IOCs and threat hunting

Module 11 – eDiscovery Processes and Tools

EDRM stages
Custodian interviews and legal holds
Culling, deduplication and filtering
TAR/review workflows
Production formats and defensibility

Module 12 – Forensic Tools and Technologies

EnCase, FTK, Autopsy and X-Ways
Sleuth Kit, Volatility and Wireshark
Mobile forensic tools
Write blockers and duplicators
Tool validation

Module 13 – Database and Specialized Forensics

Database forensics
Query and transaction logs
Cloud forensics
Virtual machines, containers and volatile data

Module 14 – Reporting, Presentation and Courtroom Skills

Forensic reports
Technical writing
Expert-witness preparation
Visual presentation of findings
Cross-examination and evidence challenges

Ready to take the CEFIP certification exam?

Exam voucher: $295 • Online • 50 questions • 90 minutes • 70% pass score

Purchase CEFIP Exam Voucher