Certified Digital Forensics Professional
eCDFP Certification
eCDFP is a professional-level digital forensics certification for practitioners responsible for conducting defensible investigations from evidence collection through analysis and reporting.
The Exam
INE Security’s eCDFP validates your ability to conduct end-to-end digital forensic investigations using defensible evidence handling, acquisition, analysis, correlation, timeline development, and reporting techniques.
About the Certification Exam
Designed for experienced cybersecurity practitioners, eCDFP validates the skills required to own a corporate DFIR investigation from initial scope and evidence acquisition through multi-source analysis, timeline development, reporting, and case handoff.
The eCDFP exam evaluates the complete DFIR investigation workflow, including defensible evidence handling, acquisition and validation, endpoint and storage analysis, memory and network forensics, telemetry correlation, timeline development, and investigation-grade reporting.
Domains + Objectives
eCDFP is a professional-level certification designed for practitioners familiar with common attack techniques. Candidates should be prepared to analyze evidence and make defensible investigative decisions across realistic DFIR scenarios.
eCDFP
Exam Domains
Evidence Handling, Scope, Standards & Defensibility (15%)
Acquisition, Triage & Data Validation (20%)
Endpoint Forensics: Windows Primary + Linux Essentials (25%)
Storage Media, File Systems, Recovery & Anti-Forensics (15%)
Network, Logs & Telemetry Forensics (15%)
Timeline Engineering, Reporting & Case Closure (10%)
Evidence Handling, Scope, Standards & Defensibility (15%)
- Collection planning
- Chain of custody and integrity
- Contamination mitigation
- Investigation standards
- Authorization/privacy boundaries
- Limitations and confidence
Acquisition, Triage & Data Validation (20%)
- Non-volatile acquisition
- Memory/live response
- Remote triage
- Safe image processing
- Timestamp normalization
- Acquisition validation
Endpoint Forensics: Windows Primary + Linux Essentials (25%)
- Execution artifacts
- Registry
- Windows event logs
- Persistence/lateral movement
- User activity
- Anti-forensics
- Linux IR artifacts
Storage Media, File Systems, Recovery & Anti-Forensics (15%)
- Physical/logical storage
- Partitions/unallocated space
- FAT/exFAT/NTFS
- File carving
- Anti-forensics
- Recovery limitations
Network, Logs & Telemetry Forensics (15%)
- PCAP analysis
- Scanning/exploitation/C2/exfiltration evidence
- Endpoint/network correlation
- EDR/SIEM and heterogeneous telemetry
- Safe DFIR practices
Timeline Engineering, Reporting & Case Closure (10%)
- Multi-source timelines
- Timestamp reconciliation
- Forensic reporting
- IOCs/affected hosts/chronology/recommendations
- Evidence and case handoff
Who It’s For
eCDFP is designed for cybersecurity practitioners who need to move beyond individual artifact analysis and conduct repeatable, defensible digital forensic investigations.
Get eCDFP Certified
The eCDFP exam can be purchased as a standalone certification. It’s highly recommended to purchase INE Premium to take advantage of the Certified Digital Forensics Professional Learning Path to prepare for the exam.
The Process
Whether you are attempting the Certified Digital Forensics Professional certification exam on your own or after having completed our approved learning path.
The eCDFP certification is valid for three years from the date it is awarded. Stay current with your skills and maintain your credential through flexible renewal options designed to fit your schedule.
The previous eCDFP is retiring on April 30, 2027. Review the objectives and domains here.
