What is the PECB Certified Digital Forensics Examiner?
The PECB Certified Digital Forensics Examiner (CDFE) is a 5-day, hands-on digital forensics certification. It builds the expertise to conduct digital forensic investigations and prepare evidence for legal scrutiny — acquiring, analysing, and preserving evidence across Windows, macOS, Linux, and mobile devices to industry best practice. The course runs on hands-on labs across file-system forensics, memory forensics, network analysis, and advanced malware analysis, using the tools examiners actually use: Wireshark, Zeek, Ghidra, and YARA.
Unlike theory-first qualifications, CDFE is built to prove examiner capability. By the end you should be able to secure evidence from a range of devices and systems, recover deleted data, detect tampering and malicious activity, reverse engineer suspicious binaries, and explain the integrity and limitations of digital evidence — then write it all up in a forensic report that both technical and legal audiences can act on. You can view the full course details here.
Why digital forensics matters in Australia
Forensic capability can support incident investigation, legal processes and regulatory assessment. Its scope and required expertise depend on the matter:
- The Notifiable Data Breaches (NDB) scheme — entities covered by the scheme must assess suspected eligible data breaches and notify the OAIC and affected individuals when the notification criteria are met. Forensic evidence can support that assessment; not every incident is notifiable.
- The SOCI Act — responsible entities for assets subject to mandatory reporting must report a critical cyber incident within 12 hours of awareness, or another reportable incident within 72 hours. The statutory impact and applicability tests determine the category.
- Evidence that stands up in court — employment disputes, IP theft, fraud, and cybercrime prosecutions all turn on whether digital evidence was acquired and preserved on a proper chain of custody. Handling defects can affect reliability, weight or admissibility; exclusion is not automatic.
- Insurance and legal hold — policy terms, claims instructions and applicable preservation obligations determine the investigation and retention required. Confirm these for the matter rather than assuming one rule applies to every claim.
The knock-on effect is sustained demand for practitioners who can do more than respond — who can prove what happened. Forensics is the evidentiary backbone of the response work covered in our incident response certification guide, and the artefacts examiners recover feed the intelligence work in our cyber threat analyst certification guide.
Who should take this course
- Digital forensics analysts and investigators
- IT security professionals and incident responders
- Legal professionals involved in cybercrime cases
- Corporate security officers and compliance managers
- Information security team members and cyber intelligence analysts
- Professionals seeking to advance their knowledge in digital forensics
Before attending, have foundational knowledge of cybersecurity and digital forensics. Professional and forensic-project experience requirements apply separately to the credential application.
What you learn — the 5-day agenda
The course is four days of hands-on training plus the certification exam on day five:
Introduction to digital forensics, forensic tools and techniques, network analysis with Wireshark, and the basics of malware analysis.
File-system forensics, memory forensics, reverse engineering of Windows PE and Linux ELF binaries, and x86 architecture fundamentals.
Advanced malware analysis techniques, Zeek for network analysis, Ghidra for malware analysis, and YARA rule development for threat hunting.
Dark web forensics, interactive behaviour analysis, advanced memory and file-system techniques, scripting and automation with Zeek, and patch analysis with Ghidra.
The 3-hour PECB Certified Digital Forensics Examiner exam across five competency domains, remotely proctored so you can sit it from anywhere in Australia.
Current examination requirements
Open-book, technical exam. Duration: 3 hours. 20 technical questions in the current English PECB examination record. Passing requirements: Confirm the current technical-exam passing requirements with PECB. Check the current PECB examination record and assigned examination before booking.
- Network traffic and protocol analysis
- Memory acquisition and forensics
- File-system and disk forensics
- Malware analysis and reverse engineering
- Threat hunting, automation, and correlation
Credential requirements and how to enrol
Before attending, have foundational knowledge of cybersecurity and digital forensics. Professional and forensic-project experience requirements apply separately to the credential application.
On passing you can apply for the PECB Certified Digital Forensics Examiner credential — requires two years of professional experience (one year in computer forensics), 200 hours of digital-forensics experience, and signing the PECB Code of Ethics. Meets the PECB Examination and Certification Program (ECP) requirements. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
Cost, inclusions and access
Self-Study: A$ 857.00 excluding GST. Published inclusions (subject to the credential and retake clarification immediately below): 300+ pages of explanatory information, examples, and best practices; Hands-on forensics labs, exercises, and quizzes; 12 months access via myPECB; Official PECB CDFE exam voucher; 3-hour exam, remotely proctored; Two attempts (initial + one free resit within 12 months); PECB digital certificate on pass; 31 CPD credits on completion; Cross-platform evidence acquisition and analysis; Aegentra Academy support inbox. Clarification: references to a credential or certificate on pass do not mean automatic award. The eligible PECB credential requires an application and PECB approval, including applicable experience and ethics requirements. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. A retained inclusion referring to the initial examination date does not extend or restart this policy cycle. Australian GST follows the billing address. Check the course page for the full inclusions and current booking options.
This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
Credential requirements and how to enrol
Before attending, have foundational knowledge of cybersecurity and digital forensics. Professional and forensic-project experience requirements apply separately to the credential application.
On passing you can apply for the PECB Certified Digital Forensics Examiner credential — requires two years of professional experience (one year in computer forensics), 200 hours of digital-forensics experience, and signing the PECB Code of Ethics. Meets the PECB Examination and Certification Program (ECP) requirements. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
Primary references and applicability
These sources explain the requirements and scope distinctions discussed above. Check their applicability to the organisation or credential.
FAQs
What is the PECB Certified Digital Forensics Examiner (CDFE)?
CDFE is a 5-day, hands-on digital forensics certification from PECB. It builds a comprehensive command of forensic analysis across Windows, macOS, Linux, and mobile devices — acquiring, analysing, and preserving digital evidence to industry best practice. The course covers file-system forensics, memory forensics, network analysis, and advanced malware analysis, and the credential assesses relevant capabilities. Admissibility of particular evidence remains a legal decision, not a result guaranteed by training.
What does the CDFE exam involve?
Open-book, technical exam. Duration: 3 hours. 20 technical questions in the current English PECB examination record. Passing requirements: Confirm the current technical-exam passing requirements with PECB. Check the current PECB examination record and assigned examination before booking.
Do I need prior experience to take the course?
Before attending, have foundational knowledge of cybersecurity and digital forensics. Professional and forensic-project experience requirements apply separately to the credential application.
What tools does the course cover?
The course runs on the tools examiners actually use: Wireshark and Zeek for network traffic and protocol analysis, Ghidra for malware analysis and reverse engineering, and YARA for rule development and threat hunting. Reverse engineering spans Windows PE and Linux ELF binaries with x86 architecture fundamentals, and evidence acquisition and analysis covers Windows, macOS, Linux, mobile devices, and memory.
How much does the CDFE course cost in Australia?
Self-Study: A$ 857.00 excluding GST. Published inclusions (subject to the credential and retake clarification immediately below): 300+ pages of explanatory information, examples, and best practices; Hands-on forensics labs, exercises, and quizzes; 12 months access via myPECB; Official PECB CDFE exam voucher; 3-hour exam, remotely proctored; Two attempts (initial + one free resit within 12 months); PECB digital certificate on pass; 31 CPD credits on completion; Cross-platform evidence acquisition and analysis; Aegentra Academy support inbox. Clarification: references to a credential or certificate on pass do not mean automatic award. The eligible PECB credential requires an application and PECB approval, including applicable experience and ethics requirements. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. A retained inclusion referring to the initial examination date does not extend or restart this policy cycle. Australian GST follows the billing address. Check the course page for the full inclusions and current booking options.
Will the evidence-handling skills stand up in Australian courts?
CDFE teaches acquisition, preservation, analysis and chain-of-custody techniques. These can support an explanation of evidence integrity, but admissibility and weight depend on the matter and the applicable court rules. It also covers producing forensic reports that communicate findings clearly to both technical and legal audiences — critical for litigation, employment disputes, IP theft investigations, and regulatory matters in Australia.
How does CDFE differ from an incident-response certification?
They are complementary DFIR disciplines. An incident-response credential such as the PECB Certified Incident Responder focuses on managing a live incident — detection, containment, eradication, and recovery under time pressure. CDFE goes deeper on the evidence: forensically sound acquisition, file-system and memory analysis, malware reverse engineering, and producing findings that survive legal scrutiny. Many practitioners hold both.
Is the credential recognised in Australia and internationally?
Accreditation varies by credential. PECB publishes personnel-certification accreditation under applicable ISO/IEC 17024 scopes and ANAB certificate-program accreditation under ANSI/ASTM E2659-24 for specified programs. Verify the applicable published PECB scope.