Skip to main content
Aegentra
All courses
PECB · CDFEPractitioner

PECB Certified Digital Forensics Examiner Course & Exam Australia

Gain the expertise to conduct digital forensic investigations and obtain legally admissible digital evidence. Certified Digital Forensics Examiner (CDFE) builds a comprehensive command of forensic analysis across Windows, macOS, Linux, and mobile devices — acquiring, analysing, and preserving evidence to industry best practice. Through hands-on labs you work across file-system forensics, memory forensics, network analysis, and advanced malware analysis with the tools examiners actually use — Wireshark, Zeek, Ghidra, and YARA — so you can handle complex investigations, secure evidence from a range of devices and systems, and defend the integrity of digital evidence in court.

Available Australia-wide, in New Zealand and across Asia Pacific — and, because self-study and eLearning are delivered online through the myPECB platform, from anywhere in the world. Live online classes run in Australian time zones; in-person classroom delivery in Melbourne and Sydney is available on request. Base prices are published in AUD, and every course page supports available local currencies including NZD. An Australian billing address adds 10% GST; a non-Australian billing address has no Australian GST.

The PECB Certified Digital Forensics Examiner training course costs $1,499 + GST through Aegentra Academy, an official PECB authorised training partner in Australia. That price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free exam resit within 12 months.

5.0 on Google
Download course brochurePDF
Official course provider
PECB
Professional pathway
Practitioner
Self-Study
12 months access
Initial attempt and one free retake
2 exam attempts included
/ Purchase order

Certified Digital Forensics Examiner course price and enrolment options

/ What you get

What's included in the Certified Digital Forensics Examiner course fee

The official PECB course and exam package starts at $1,499 + GST — with no separate exam fee after enrolment. Optional Aegentra Labs exam preparation is clearly priced separately.

Course materials
  • 300+ pages of explanatory information, examples, and best practices
  • Hands-on forensics labs, exercises, and quizzes
  • 12 months access via myPECB
Exam package
  • Official PECB CDFE exam voucher
  • 3-hour exam, remotely proctored
  • Two attempts (initial + one free resit within 12 months)
  • PECB digital certificate on pass
Practitioner extras
  • 31 CPD credits on completion
  • Cross-platform evidence acquisition and analysis
  • Aegentra Academy support inbox
/ Exam requirements & credential

Certified Digital Forensics Examiner exam format, duration and pass mark

The exam voucher is included in your enrolment, and so is one free resit if you don't pass first time. Both the exam and the credential are issued directly by PECB.

Format
Multiple-choice and scenario-based
Duration
3 hours
Questions
Five competency domains — network traffic and protocol analysis; memory acquisition and forensics; file-system and disk forensics; malware analysis and reverse engineering; and threat hunting, automation, and correlation
Pass mark
70%
Language
English (other PECB languages available on request)
Credential experience requirements

On passing you can apply for the PECB Certified Digital Forensics Examiner credential — requires two years of professional experience (one year in computer forensics), 200 hours of digital-forensics experience, and signing the PECB Code of Ethics. Meets the PECB Examination and Certification Program (ECP) requirements.

/ Before you enrol

Clear answers about price, tax, exams, and certification.

These answers use this course's current catalogue record and PECB's published exam, certification, and maintenance policies.

What is included in the Certified Digital Forensics Examiner course fee?

The published price is A$1,499 for Self-Study, before tax. It includes the official PECB course materials, 12 months of access, the first exam attempt, one free retake, and the certification application fee. PECB’s partner-course policy also includes the first year of the Annual Maintenance Fee where maintenance applies; Foundation and Provisional credentials are maintenance-exempt. There is no separate first-exam or certification-application charge after enrolment.

What will PECB charge to maintain the Certified Digital Forensics Examiner credential?

PECB’s current maintenance policy lists no maintenance fee for Foundation, Provisional, or Transition credentials. For all other PECB certifications, the published fee is $390 per three-year certification cycle, together with the applicable CPD requirements and continued adherence to the PECB Code of Ethics. PECB sets this fee and may change it, so check the linked policy before renewal.

Can I pay in NZD or another currency, and when is Australian GST added?

Yes. Every Academy course supports AUD and multiple local currencies, including NZD, USD, SGD, GBP, EUR, INR, AED, MYR, PHP, IDR, and VND when a live quote is available. Currency and tax are separate: an Australian billing address adds 10% GST, while a non-Australian billing address has no Australian GST. For example, an Australian working in New Zealand may pay in NZD and use an Australian billing address, but 10% GST will still be added because the billing address is Australian.

What is the difference between Self-Study and eLearning for Certified Digital Forensics Examiner?

The currently published self-paced option is Self-Study at A$1,499 before tax, using the official PECB slide-based materials. A separate recorded eLearning price is not currently published for this course. The official exam package is still included, and instructor-led delivery is available only when a confirmed cohort is shown or arranged with Aegentra Academy.

Can I sit the Certified Digital Forensics Examiner exam remotely from New Zealand or another time zone?

Yes. PECB publishes remote online exam sessions that candidates can take from home or another suitable location through the PECB Exams application. The published course record lists these exam facts: duration — 3 hours; format — Multiple-choice and scenario-based; assessment — Five competency domains — network traffic and protocol analysis; memory acquisition and forensics; file-system and disk forensics; malware analysis and reverse engineering; and threat hunting, automation, and correlation; pass mark — 70%; language — English (other PECB languages available on request). New Zealand candidates should choose a published session that suits their local time, meet PECB’s identity and technical requirements, and complete the system check before exam day. PECB’s general exam policy does not publish a New Zealand restriction.

Which credential tier will I receive after the Certified Digital Forensics Examiner exam, and who assesses it?

On passing you can apply for the PECB Certified Digital Forensics Examiner credential — requires two years of professional experience (one year in computer forensics), 200 hours of digital-forensics experience, and signing the PECB Code of Ethics. Meets the PECB Examination and Certification Program (ECP) requirements. Passing the exam does not by itself guarantee the highest experience-based credential tier. PECB requires an online certification application and reference contact details, and its Certification Department decides whether the education, professional experience, and field-related project activity requirements are met.

What evidence does PECB accept for the experience or project hours for Certified Digital Forensics Examiner?

PECB’s public certification-process page does not publish a closed list of documents that automatically proves project hours. It requires the online application and contact details for references who may be contacted to validate your experience. Keep a dated activity log showing the organisation or client, your role, the field-related project activity, dates, responsibilities, and hours; retain employer or client confirmations, statements of work, timesheets, or similar records in case PECB asks for support. The PECB Certification Department assesses the application and makes the final decision.

Policy sources:PECB exam rules and fee inclusionsPECB certification maintenance policyPECB certification application process
/ Training prerequisites

What you should know before starting Certified Digital Forensics Examiner

  • None to attend the training, though a background in IT security, incident response, or computer forensics is beneficial. The full PECB Certified Digital Forensics Examiner credential requires two years of professional experience (one year in computer forensics) and 200 hours of experience in digital forensics.
/ Who this course is for

Who should take the Certified Digital Forensics Examiner course

  • Digital forensics analysts and investigators
  • IT security professionals and incident responders
  • Legal professionals involved in cybercrime cases
  • Corporate security officers and compliance managers
  • Information security team members and cyber intelligence analysts
  • Professionals seeking to advance their knowledge in digital forensics
/ What you'll learn

By the end of this course you'll be able to:

  • Demonstrate an in-depth understanding of digital forensic principles, legal considerations, and investigative procedures for cybercrime and incident response.
  • Collect, preserve, and analyse digital evidence from various sources while adhering to chain-of-custody and evidentiary standards.
  • Use industry-standard forensic tools to examine file systems, recover deleted data, and detect tampering or malicious activity.
  • Produce comprehensive forensic reports and communicate findings clearly to both technical and legal audiences in investigations and potential litigation.
/ Curriculum

Certified Digital Forensics Examiner course curriculum

5 modules, fully on-demand. Click any module to see the topics inside.

01Day 1 — Foundations of digital forensics
  • Training course objectives and structure
  • Introduction to digital forensics
  • Digital forensics tools and techniques
  • Network analysis with Wireshark
  • Basics of malware analysis
02Day 2 — File system analysis and reverse engineering
  • File system forensics
  • Memory forensics
  • Reverse engineering in Windows (PE files)
  • Reverse engineering in Linux (ELF files)
  • x86 architecture fundamentals
03Day 3 — Malware analysis and threat hunting
  • Advanced malware analysis techniques
  • Introduction to Zeek for network analysis
  • Ghidra for malware analysis
  • YARA rule development for threat hunting
04Day 4 — Advanced forensic analysis and incident response
  • Dark web forensics
  • Interactive behaviour analysis
  • Memory and file-system techniques
  • Advanced scripting and automation with Zeek
  • Patch analysis and modifications with Ghidra
05Day 5 — Certification exam
  • PECB Certified Digital Forensics Examiner exam
  • 3 hours, five competency domains
  • Remotely proctored — sit from anywhere in Australia
/ Library
Certification guide

Digital Forensics Certification Australia

Step-by-step certification process, realistic AUD costs, audit timelines, and how this course fits into a wider readiness program — senior-engineer written, updated for 2026.

Read

Free learning resources

Put the course concepts into practice.

Use Aegentra’s existing templates, checklists, registers and mappings alongside your course. No account or email is required.

Browse all free Academy resources
/ Related reading

Related PECB CDFE resources

Free companion reading for anyone studying forensic investigation and legally admissible evidence — the discipline behind post-incident attribution:

Compare the family

See where this course fits

The Cybersecurity family page compares current levels, prices, delivery, audiences and exam facts before you choose a pathway.

Compare Cybersecurity pathways

Source and review status

How these course facts are governed

Price, delivery and course content are generated from Aegentra’s authoritative catalogue record. The official PECB course page and exam policy are linked directly below. Source-link checks and substantive human review are tracked separately so one is never presented as the other.

Official PECB sources

Course and certification details

Exam rules and policies

Links checked 11 August 2026.

Editorial accountability

Harry Sidhu owns publication of this record. A separate course-specific substantive reviewer has not yet been recorded.

Substantive review status

Official source links are checked separately. A course-specific substantive review date will be published when completed.

/ Accreditation

Is the Certified Digital Forensics Examiner certification recognised in Australia?

Yes. PECB certifications are internationally accredited and are accepted on Australian resumes, tender responses and procurement panels. Australia has no separate national licence for Certified Digital Forensics Examiner — the recognition comes from the accreditation behind the credential, which is international.

PECB’s professional certifications are accredited under ISO/IEC 17024 — the international standard for bodies certifying persons — by IAS, UKAS, KAB and COFRAC. Its Foundation certificate programs are separately accredited by ANAB (ANSI National Accreditation Board) under ANSI/ASTM E2659.

Aegentra Academy is an official PECB authorised training partner in Australia, which is what allows this course to include the official PECB examination voucher rather than billing it separately. You can confirm that directly with PECB through the official PECB partner directory.

This official PECB course is sold and supported by Aegentra Academy. PECB supplies the course material, examination and professional credential scheme. Aegentra's wider practice also runs governance, risk and compliance engagements and Microsoft 365 hardening for Australian organisations. Named eLearning trainers are credited separately on this page when the course record supplies them.

Courses run online and self-paced through the myPECB platform, so professionals across Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra and New Zealand enrol online. Instructor-led cohorts and in-person delivery in Melbourne and Sydney are available on request. Multi-seat team pricing is available for five or more seats — email Academy@aegentra.com.au for an enterprise quote. Tax invoices with GST and ABN are issued automatically at checkout.

/ Frequently asked

Certified Digital Forensics Examiner — frequently asked.

How long is the Certified Digital Forensics Examiner course?

Five days — four days of hands-on training across the foundations of digital forensics, file-system and memory forensics, malware analysis and threat hunting, and advanced forensic analysis, followed by the certification exam on day five.

What does the CDFE exam involve?

A 3-hour PECB exam across five competency domains — network and protocol analysis, memory forensics, file-system and disk forensics, malware analysis and reverse engineering, and threat hunting. The exam voucher and one free resit are included in the price.

What tools does the course cover?

Industry-standard forensic tooling including Wireshark, Zeek, Ghidra, and YARA, with reverse engineering across Windows (PE) and Linux (ELF) and analysis spanning macOS and mobile devices.

What experience do I need?

None to attend the training. The full PECB Certified Digital Forensics Examiner credential requires two years of professional experience (one year in computer forensics) and 200 hours of experience in digital forensics.

What CPD credits do I earn?

Participants who complete the training receive an attestation worth 31 CPD (Continuing Professional Development) credits.

When can I start the course?

Immediately after payment. The Academy team confirms your seat with PECB and you receive login details by email — usually within one business day.

How long do I have access to the course?

You have 12 months of access from enrolment. That window covers the course material, the official PECB exam, and one free resit if you need it.

What if I fail the exam?

One PECB-issued resit is included in your enrolment at no extra cost. Aegentra does not publish a pass-rate claim without an audited cohort dataset.

Questions about invoicing, GST, group bookings, refunds or instructor-led delivery? Read the Academy FAQ.

$1,499AUD · EXCL. TAX
Enrol now