CCFE Exam Overview: What To Expect

The Certified Computer Forensics Examiner (CCFE) is the most prestigious certification for computer forensics professionals. It will test your fundamental knowledge of the computer forensics evidence recovery and analysis process, including your knowledge of both hard and soft skills. Hard skills will be tested through a practical examination, but you must first pass the online multiple choice exam to take the practical exam. Your soft skills will be vetted by testing your background knowledge of complex legal issues in the realm of computer forensics. To achieve CCFE certification status, you must complete both the online multiple choice exam and the practical exam.

Get certified with an Exam Pass Guarantee

Looking to get certified? Many of our boot camps are backed by an Exam Pass Guarantee, ensuring you leave with the certification you want.

Book Meeting

CCFE Exam Objectives (Domains)

The CCFE exam includes 10 domains:

1. Law, Ethics and Legal Issues
2. The Investigation Process
3. Computer Forensics Tools
4. Hard Disk Evidence Recovery and Integrity
5. Digital Device Recovery and Integrity
6. File System Forensics
7. Evidence Analysis and Correlation
8. Evidence Recovery of Window-Based Systems
9. Network and Volatile Memory Forensics
10. Report Writing

Exam Format

The CCFE exam consists of two parts:

1. A traditional multiple choice, true/false and multiple answer examination (50 questions)
2. A take-home practical exam

You will have two hours to complete the multiple choice portion of the exam. Once you pass the multiple choice exam, you are given access to practical exam case files from a mock computer forensics case. The case files also contain a description of the scenario for the case in question. You will perform a computer forensics examination of the case files and then prepare a report for use as evidence in a courtroom. You must submit your report for grading within 60 days.

What Does the Exam Cost?

• Flat fee of $499 per exam
• On-site proctored exams are $399 per voucher

How to Register for the Exam

To register, contact a representative at the Infosec Institute Certification. Contact information is provided below.

• Email: exams@infosecinstitute.com
• Call: (708) 660-0721
• Submit an inquiry: https://www.infosecinstitute.com/about-us/contact-us/

How to Submit Your Practical Exam

Once you’ve completed your practical exam, submit a copy of the document through Infosec Institute website here. You must include an executive summary, either in the message textbox provided in the form or in the document. The purpose of adding the executive summary is to identify the relevant senior instructors that your practical should be directed to for review and certification qualification.

How to Schedule Your Exam

Candidates can schedule the exam either via phone at (708) 660-0721 or via email at exams@infosecinstitute.com.

Exam Feedback

You can provide feedback on questions while taking the exam to mark them for subsequent review. You will be able to go back and answer these questions again. When you complete the exam, you may comment on previously marked questions through the exam feedback form.

Currently, you can comment on the following areas:

• Typographical errors (formatting, spacing, etc.)
• If the question has more than one right answer
• Technically inaccurate
• Grammatical and spelling errors

If a question is proven incorrect, the Infosec Institute will credit you for that question. However, you will have to provide necessary information about the wrong question, such as:

1. Point out the deficiency(s) in the question
2. Provide written comments regarding the question under consideration
3. Show knowledge pertaining to the subject area and relevant concepts about the question

You must then email exams@infosecinstitute.com, supplying the certification attempted, your username, your full name, the question number and a brief, professional explanation of the problem with the question or answers. The exam proctor will review your feedback and respond via email within five working days with their findings.

How to Check Certification Status

You can check your certification status by emailing exams@infosecinstitute.com. Include your certification type (CCFE) and full name. A representative at the Infosec Institute will respond to your email, along with your certification status, within a few working days.

Computer Forensics Boot Camp

If you aspire to take the CCFE or CMFE examination, InfoSec Institute’s Computer Forensics Boot Camp Course will teach you the necessary skills to investigate computer crimes and computer threats.

Get certified with our Exam Pass Guarantee

Many of our boot camps come with an Exam Pass Guarantee: if you fail on your first attempt, we'll invite you to re-sit the course for free and cover the cost of your second exam.

Learn More

InfoSec Institute is one of the most awarded (42 industry awards) and trusted information security training vendors. They also offer thousands of articles on a variety of security topics.