Certified Digital Forensics Technician (CDFT) Industry-Standard Digital Forensics Certification

The Certified Digital Forensics Technician (CDFT) is a comprehensive, scenario-based certification designed to validate practical digital forensics and incident investigation skills required in modern cybersecurity environments.

CDFT focuses on real-world forensic decision-making, not tool memorization. The exam evaluates a candidate’s ability to properly handle digital evidence, analyze forensic artifacts, reconstruct incidents, and apply legally sound investigative methodologies across computer systems, networks, cloud platforms, and mobile devices.

This certification is suitable for professionals involved in incident response, SOC operations, digital investigations, and cybercrime analysis, as well as students seeking to demonstrate industry-ready DFIR capabilities.

The CDFT exam is a 6-hour individual assessment consisting of 900 scenario-based multiple-choice questions, designed to measure analytical thinking, investigative accuracy, and adherence to forensic best practices.

📘 CDFT Exam Syllabus (30 Modules)

Domain 1: Digital Forensics Foundations

1. Principles of Digital Forensics

2. Types of Digital Evidence

3. Volatile vs Non-Volatile Data

4. Forensic Readiness & Preparation

Domain 2: Legal & Evidence Handling

5. Chain of Custody

6. Evidence Integrity & Hashing

7. Legal Considerations & Compliance

8. Evidence Documentation & Preservation

Domain 3: Disk & File System Forensics

9. File Systems (FAT, NTFS, EXT, APFS)

10. Deleted File Recovery

11. File Slack & Unallocated Space

12. Timestamp & Metadata Analysis

Domain 4: Operating System Forensics

13. Windows Forensic Artifacts

14. Linux System Artifacts

15. macOS Forensic Artifacts

16. User Activity Reconstruction

Domain 5: Memory & Live Forensics

17. Memory Acquisition Techniques

18. Process & Service Analysis

19. Registry & Runtime Artifacts

20. Live System Investigation

Domain 6: Network & Cloud Forensics

21. Network Traffic Analysis

22. Log Analysis & Correlation

23. Email & Web Forensics

24. Cloud Forensic Challenges

Domain 7: Mobile & Emerging Technologies

25. Mobile Device Forensics

26. Application & App Artifacts

27. IoT & Embedded Device Forensics

Domain 8: Incident Response & Reporting

28. Incident Timeline Creation

29. Root Cause & Attribution Analysis

30. Forensic Reporting & Documentation