PECB Certified Digital Forensics Examiner Course & Exam Australia
Hands-on digital forensics — acquire, analyse, and preserve legally admissible evidence across Windows, macOS, Linux, mobile, and memory. Published Self-Study enrolment starts from $1,499 + GST and includes the official exam access stated on this page. Training is delivered online. Available formats and booking arrangements are listed on this course page.
Available Australia-wide, in New Zealand and across Asia Pacific — and, because self-study and eLearning are delivered online through the myPECB platform, from anywhere in the world. Academy training is online only. Where a course offers live online teaching, dates and booking arrangements are confirmed before booking. Base prices are published in AUD, and every course page supports available local currencies including NZD. An Australian billing address adds 10% GST; a non-Australian billing address has no Australian GST.
The PECB Certified Digital Forensics Examiner Self-Study course costs A$1,499 excluding GST (A$1,648.90 including 10% GST for an Australian billing address) through Aegentra Academy, an official PECB authorised training partner in Australia. That price includes the official PECB examination voucher, the full course materials, 12 months of myPECB access, and one free exam resit within 12 months. Typical total learning effort is Not currently published. A separate eLearning option is not currently published. For non-Australian billing addresses, Australian GST is not charged and any applicable local taxes are determined at checkout.
Academy training is online only. Check the available formats and booking arrangements on this page. Any published live online option is arranged by enquiry; Self-Study is available without waiting for a cohort.
Brochures describe the published course material and may retain an earlier examination or credential version. Check the current PECB examination record and confirm your assigned edition before enrolment.
This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
/ Purchase order
Certified Digital Forensics Examiner course price and enrolment options
Australian totals above include 10% GST. For non-Australian billing addresses, Australian GST is not charged; any applicable local taxes are determined at checkout.
Live online class
Ask Aegentra Academy about the online formats currently available for this course and their booking arrangements. An enquiry does not confirm live-class availability.
What's included in the Certified Digital Forensics Examiner course fee
The official PECB course and exam package starts at A$1,499 + GST — with no separate exam fee after enrolment. Optional Aegentra Labs exam preparation is clearly priced separately.
Course materials
300+ pages of explanatory information, examples, and best practices
Hands-on forensics labs, exercises, and quizzes
12 months access via myPECB
Exam package
Official PECB CDFE exam voucher
3-hour exam, remotely proctored
Two attempts (initial + one free resit within 12 months)
PECB credential pathway after an exam pass and approved PECB application
Practitioner extras
31 CPD credits on completion
Cross-platform evidence acquisition and analysis
Aegentra Academy support inbox
/ Exam requirements & credential
Certified Digital Forensics Examiner exam format, duration and pass mark
The exam voucher is included in your enrolment, and so is one free resit if you don’t pass first time. Both the exam and the credential are issued directly by PECB.
Format
Open-book, technical exam
Duration
3 hours
Questions
20 technical questions in the current English PECB examination record
Pass mark
Confirm the current technical-exam passing requirements with PECB
Language
English; confirm other languages against the current PECB examination listing
Credential experience requirements
On passing you can apply for the PECB Certified Digital Forensics Examiner credential — requires two years of professional experience (one year in computer forensics), 200 hours of digital-forensics experience, and signing the PECB Code of Ethics. Meets the PECB Examination and Certification Program (ECP) requirements.
An exam pass is the first step. You must submit PECB's certification application and required declarations and references. PECB decides whether the requirements for the requested credential tier are met.
/ Before you enrol
Clear answers about price, tax, exams, and certification.
These answers use this course's current catalogue record and PECB's published exam, certification, and maintenance policies.
What is included in the Certified Digital Forensics Examiner course fee?
The published price is A$1,499 for Self-Study, before tax. It includes the official PECB course materials, the first exam attempt, one free retake, and the certification application fee. This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. PECB’s partner-course policy also includes the first year of the Annual Maintenance Fee where maintenance applies; Foundation and Provisional credentials are maintenance-exempt. There is no separate first-exam or certification-application charge after enrolment.
What will PECB charge to maintain the Certified Digital Forensics Examiner credential?
PECB’s maintenance policy exempts Foundation, Provisional and Transition credentials. Other credentials have tier-specific CPD requirements and maintenance fees. Confirm the applicable amount and currency directly with PECB before renewal; its public fee table uses an unqualified dollar symbol, which must not be read as an Australian-dollar quote. Course-completion CPD credits and ongoing credential maintenance are separate requirements.
Can I pay in NZD or another currency, and when is Australian GST added?
Yes. Every Academy course supports AUD and multiple local currencies, including NZD, USD, SGD, GBP, EUR, INR, AED, MYR, PHP, IDR, and VND when a live quote is available. Currency and tax are separate: an Australian billing address adds 10% GST, while a non-Australian billing address has no Australian GST. For example, an Australian working in New Zealand may pay in NZD and use an Australian billing address, but 10% GST will still be added because the billing address is Australian.
What is the difference between Self-Study and eLearning for Certified Digital Forensics Examiner?
The currently published self-paced option is Self-Study at A$1,499 before tax, using the official PECB slide-based materials. A separate recorded eLearning price is not currently published for this course. The official exam package is still included. Check this course page for any separately published private live online option; an enquiry does not confirm availability.
Can I sit the Certified Digital Forensics Examiner exam remotely from New Zealand or another time zone?
Yes. PECB publishes remote online exam sessions that candidates can take from home or another suitable location through the PECB Exams application. The published course record lists these exam facts: duration — 3 hours; format — Open-book, technical exam; assessment — 20 technical questions in the current English PECB examination record; pass mark — Confirm the current technical-exam passing requirements with PECB; language — English; confirm other languages against the current PECB examination listing. New Zealand candidates should choose a published session that suits their local time, meet PECB’s identity and technical requirements, and complete the system check before exam day. PECB’s general exam policy does not publish a New Zealand restriction.
Which credential tier will I receive after the Certified Digital Forensics Examiner exam, and who assesses it?
On passing you can apply for the PECB Certified Digital Forensics Examiner credential — requires two years of professional experience (one year in computer forensics), 200 hours of digital-forensics experience, and signing the PECB Code of Ethics. Meets the PECB Examination and Certification Program (ECP) requirements. Passing the exam does not by itself award a credential or guarantee the highest experience-based tier. PECB requires an online certification application and reference contact details, and its Certification Department decides whether the education, professional experience, and field-related project activity requirements are met.
What evidence does PECB accept for the experience or project hours for Certified Digital Forensics Examiner?
PECB’s public certification-process page does not publish a closed list of documents that automatically proves project hours. It requires the online application and contact details for references who may be contacted to validate your experience. Keep a dated activity log showing the organisation or client, your role, the field-related project activity, dates, responsibilities, and hours; retain employer or client confirmations, statements of work, timesheets, or similar records in case PECB asks for support. The PECB Certification Department assesses the application and makes the final decision.
What you should know before starting Certified Digital Forensics Examiner
Before attending, have foundational knowledge of cybersecurity and digital forensics.
Professional and forensic-project experience requirements apply separately to the credential application.
/ Who this course is for
Who should take the Certified Digital Forensics Examiner course
Digital forensics analysts and investigators
IT security professionals and incident responders
Legal professionals involved in cybercrime cases
Corporate security officers and compliance managers
Information security team members and cyber intelligence analysts
Professionals seeking to advance their knowledge in digital forensics
/ What you'll learn
By the end of this course you’ll be able to:
Demonstrate an in-depth understanding of digital forensic principles, legal considerations, and investigative procedures for cybercrime and incident response.
Collect, preserve, and analyse digital evidence from various sources while adhering to chain-of-custody and evidentiary standards.
Use industry-standard forensic tools to examine file systems, recover deleted data, and detect tampering or malicious activity.
Produce comprehensive forensic reports and communicate findings clearly to both technical and legal audiences in investigations and potential litigation.
/ Curriculum
Certified Digital Forensics Examiner course curriculum
5 modules, fully on-demand. Click any module to see the topics inside.
01Day 1 — Foundations of digital forensics
Training course objectives and structure
Introduction to digital forensics
Digital forensics tools and techniques
Network analysis with Wireshark
Basics of malware analysis
02Day 2 — File system analysis and reverse engineering
File system forensics
Memory forensics
Reverse engineering in Windows (PE files)
Reverse engineering in Linux (ELF files)
x86 architecture fundamentals
03Day 3 — Malware analysis and threat hunting
Advanced malware analysis techniques
Introduction to Zeek for network analysis
Ghidra for malware analysis
YARA rule development for threat hunting
04Day 4 — Advanced forensic analysis and incident response
Dark web forensics
Interactive behaviour analysis
Memory and file-system techniques
Advanced scripting and automation with Zeek
Patch analysis and modifications with Ghidra
05Day 5 — Certification exam
PECB Certified Digital Forensics Examiner exam
3 hours, five competency domains
Remotely proctored — sit from anywhere in Australia
Price, delivery and course content are generated from Aegentra’s authoritative catalogue record. The official PECB course page and exam policy are linked directly below. Source-link checks and substantive human review are tracked separately so one is never presented as the other.
Harry Sidhu owns publication of this record. A separate course-specific substantive reviewer has not yet been recorded.
Substantive review status
Official source links are checked separately. A course-specific substantive review date will be published when completed.
/ Accreditation
How can I verify the Certified Digital Forensics Examiner credential pathway?
Official PECB training through an authorised partner. PECB is accredited by IAS and UKAS as a personnel certification body under ISO/IEC 17024 and by ANAB as a certificate issuer under ANSI/ASTM E2659-24. Accreditation is program- and scope-specific—verify the applicable credential before enrolment.
Official PECB training and credential pathway. Check PECB’s current accreditation information and the applicable program scope before enrolment.
This official PECB course is sold and supported by Aegentra Academy. PECB supplies the course material, examination and professional credential scheme. Aegentra's wider practice also runs governance, risk and compliance engagements and Microsoft 365 hardening for Australian organisations. Named eLearning trainers are credited separately on this page when the course record supplies them.
Published Self-Study and eLearning courses run online through the myPECB platform, so professionals across Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra and New Zealand enrol online. Any live online option and its booking arrangements are stated on the relevant course page. Physical classroom and onsite Academy training are not offered. Multi-seat team pricing is available for five or more seats — email Academy@aegentra.com.au for an enterprise quote. Tax invoices with GST and ABN are issued automatically at checkout.
/ Frequently asked
Certified Digital Forensics Examiner — frequently asked.
How long is the Certified Digital Forensics Examiner course?
Five days — four days of hands-on training across the foundations of digital forensics, file-system and memory forensics, malware analysis and threat hunting, and advanced forensic analysis, followed by the certification exam on day five.
What does the CDFE exam involve?
A 3-hour PECB exam across five competency domains — network and protocol analysis, memory forensics, file-system and disk forensics, malware analysis and reverse engineering, and threat hunting. The exam voucher and one free resit are included in the price.
What tools does the course cover?
Industry-standard forensic tooling including Wireshark, Zeek, Ghidra, and YARA, with reverse engineering across Windows (PE) and Linux (ELF) and analysis spanning macOS and mobile devices.
What experience do I need?
Before attending, have foundational knowledge of cybersecurity and digital forensics. Professional and forensic-project experience requirements apply separately to the credential application. On passing you can apply for the PECB Certified Digital Forensics Examiner credential — requires two years of professional experience (one year in computer forensics), 200 hours of digital-forensics experience, and signing the PECB Code of Ethics. Meets the PECB Examination and Certification Program (ECP) requirements.
What CPD credits do I earn?
Participants who complete the training receive an attestation worth 31 CPD (Continuing Professional Development) credits.
How long does the Certified Digital Forensics Examiner course take?
Self-Study — Typical total learning effort: not currently published. Course-day equivalent: 5 training days. A separate eLearning option and workload are not currently published for this course. These are typical total-learning-effort estimates. They are separate from course-material access, exam duration, any live-class calendar span, and professional-experience requirements.
When can I start the course?
After payment, the Academy team confirms your enrolment with PECB and you receive login details by email — usually within one business day.
How long do I have access to the course?
This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination.
What if I fail the exam?
One PECB-issued resit is included under the applicable conditions. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. Aegentra does not publish a pass-rate claim without an audited cohort dataset.
Questions about invoicing, GST, group bookings, refunds or instructor-led delivery? Read the Academy FAQ.