Title: PECB CDFE: Digital Forensics Examiner Course & Exam Bundle (UK) > Hands-on digital forensics — acquire, analyse, and preserve legally admissible evidence across Windows, macOS, Linux, mobile, and memory. Source: https://aegentra.co.uk/academy/certified-digital-forensics-examiner Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Updated: 2026-11-04 Licence: public web content; cite the source URL. PECB / Practitioner # Certified Digital Forensics Examiner — Course & exam bundle. Hands-on digital forensics — acquire, analyse, and preserve legally admissible evidence across Windows, macOS, Linux, mobile, and memory. [Compare learning formats](https://aegentra.co.uk/academy/certified-digital-forensics-examiner#purchase) [Explore the curriculum](https://aegentra.co.uk/academy/certified-digital-forensics-examiner#curriculum) Online · Self-paced · English [Verify PECB partner ID 232290](https://pecb.com/en/partners?companyName=aegentra&modal=232290) ## Slide-only bundle Base price£436.00 - Official PECB slides · 12-month myPECB access - Exam voucher: 2 attempts — initial exam + one free retake if needed - Certification application fee included; first-year maintenance included where applicable Course and exam, together ## Choose your learning format. Compare the course formats and their inclusions. Choose a bundle to pay securely on Stripe. Stripe asks for your email, which we use to assign your PECB course. ### Self-Study course and exam bundle Read and revisit the official slide-based materials at your own pace. No video lectures or live teaching. **What’s included** 12 months of myPECB course access Official PECB course slides Official PECB exam voucher: 2 attempts — initial exam + one free retake if needed Certification application fee included First-year certification maintenance fee included where applicable Base price (excl. VAT)£436.00 Total to pay (incl. 20% UK VAT)£523.20 Per learner · GBP [Buy](https://aegentra.co.uk/checkout?course=certified-digital-forensics-examiner&format=self-study) **Exam and purchase conditions** Complete the exam, included retake and application within 12 months of purchase. The first retake requires at least 15 days after an unsuccessful attempt. PECB reviews eligibility before awarding a credential; buying a bundle does not guarantee certification. An enquiry does not create an order. An order is confirmed after successful payment and acceptance. Choose your payment currency in the top navigation. Prices shown are for UK personal purchases; other locations and business purchases need a written quote. ## Your enrolment Certified Digital Forensics Examiner Is this your next step? ## Who this course suits best. - Digital forensics analysts and investigators - IT security professionals and incident responders - Legal professionals involved in cybercrime cases - Corporate security officers and compliance managers - Information security team members and cyber intelligence analysts - Professionals seeking to advance their knowledge in digital forensics Your learning format ## Independent study. Clear expectations. This course is listed as Self-Study only. Learn from the official course materials at your own pace; recorded presenter videos and live classes are not included. **Which learning support is included?** Self-Study is independent learning from the official materials. eLearning, where listed, adds recorded instruction; neither standard bundle promises live tuition or unlimited one-to-one support. For the listed ISO 27001 and ISO 42001 courses, the separately quoted consultancy option is explained above. PECB manages examination and certification decisions. Knowledge you can apply ## What you will work through. - Demonstrate an in-depth understanding of digital forensic principles, legal considerations, and investigative procedures for cybercrime and incident response. - Collect, preserve, and analyse digital evidence from various sources while adhering to chain-of-custody and evidentiary standards. - Use industry-standard forensic tools to examine file systems, recover deleted data, and detect tampering or malicious activity. - Produce comprehensive forensic reports and communicate findings clearly to both technical and legal audiences in investigations and potential litigation. Inside the course ## The curriculum. Modules describe the learning sequence. Day labels in the official curriculum do not mean scheduled live classes. **Day 1 — Foundations of digital forensics** Training course objectives and structure Introduction to digital forensics Digital forensics tools and techniques Network analysis with Wireshark Basics of malware analysis **Day 2 — File system analysis and reverse engineering** File system forensics Memory forensics Reverse engineering in Windows (PE files) Reverse engineering in Linux (ELF files) x86 architecture fundamentals **Day 3 — Malware analysis and threat hunting** Advanced malware analysis techniques Introduction to Zeek for network analysis Ghidra for malware analysis YARA rule development for threat hunting **Day 4 — Advanced forensic analysis and incident response** Dark web forensics Interactive behaviour analysis Memory and file-system techniques Advanced scripting and automation with Zeek Patch analysis and modifications with Ghidra **Day 5 — Certification exam** PECB Certified Digital Forensics Examiner exam 3 hours, five competency domains The exam and credential ## Know what you are preparing for. Credential eligibility and the certification decision are assessed by PECB. Training does not certify your organisation. - **Format:** Open-book, technical exam - **Duration:** 3 hours - **Questions:** 20 technical questions in the current English PECB examination record - **Pass mark:** Confirm the current technical-exam passing requirements with PECB On passing you can apply for the PECB Certified Digital Forensics Examiner credential — requires two years of professional experience (one year in computer forensics), 200 hours of digital-forensics experience, and signing the PECB Code of Ethics. Meets the PECB Examination and Certification Program (ECP) requirements. **Before you enrol: prerequisites** Before attending, have foundational knowledge of cybersecurity and digital forensics. Professional and forensic-project experience requirements apply separately to the credential application. From knowledge to a working decision ## A device may contain relevant evidence Describe authorisation, preservation, handling records and reporting limits. Work only with synthetic or expressly authorised data; do not claim a training exercise establishes admissibility. For an implementation or practitioner route, record a decision, owner, evidence requirement and review trigger. Explain your assumptions and what remains outside the exercise. Original optional study prompt, not an official PECB exam question, an additional included lab or evidence of professional experience. Use fictional information. [Check the official PECB course catalogue](https://help.pecb.com/list-of-pecb-courses/) Make time for the learning ## Your course. Your study plan. Turn the curriculum into a study plan: record your target dates, explain each topic in your own words and keep a list of questions to revisit. The downloadable sheet is pre-filled for this course and includes space for your notes. It is an optional Aegentra planning aid, not official PECB materials, an exam-question bank or evidence of professional experience. Use fictional examples, not confidential workplace information. [Download your study planner (CSV)](https://aegentra.co.uk/downloads/certified-digital-forensics-examiner-study-planner.csv) Certified Digital Forensics Examiner · Editable spreadsheet · No sign-up required ### Before you book the exam. **Check your exact exam** Confirm the course, exam language, duration and permitted materials against PECB’s current exam listing and rules. Similar titles from different training providers can lead to different qualifications. [PECB exam listing](https://help.pecb.com/list-of-pecb-exams/) **Prepare your exam environment** Before booking, check the latest online-exam manual for identification, equipment, connectivity and room requirements. Ask PECB about reasonable accommodations early if you need them. [PECB online-exam manual](https://pecb.com/en/online-exam-manual) **Plan the credential application** Passing the exam and being awarded a particular credential are separate steps. Check the applicable experience, references and application requirements; do not assume a Lead title is awarded automatically. [PECB certification requirements](https://pecb.com/en/certification-rules-and-policies) For permitted materials, exam conduct and accommodation requests, read [PECB’s exam rules](https://pecb.com/en/exam-rules-and-policies). Requirements can change; check the current rules for your exact exam. Your questions ## Before you choose. **Is the official PECB exam included?** Yes. Each listed bundle includes the official examination voucher: an initial attempt and one free retake if needed. Complete the exam, included retake and application within 12 months of purchase. The first retake requires at least 15 days after an unsuccessful attempt. PECB reviews eligibility before awarding a credential; buying a bundle does not guarantee certification. **What is the difference between Self-Study and eLearning?** Self-Study provides official slides for independent study. eLearning adds recorded PECB video lectures. Only the formats shown above are offered for this course. **Does this include a certification fee?** The bundle includes the application fee and first-year maintenance where applicable. Foundation certificates have no annual maintenance fee. Credential eligibility and ongoing requirements vary; PECB makes the award decision. **Can I purchase online?** Choose your course and learning format, review the total in your selected currency and pay securely through Stripe. PECB access is arranged within 24 hours after payment confirmation. Optional Labs access is activated for the matching course after confirmation. **How does this PECB bundle compare with other UK training offers?** Compare the exact awarding body and credential, curriculum, delivery format, exam inclusion, retake conditions, access period and eligibility. Similar course titles do not establish equivalence to another provider or scheme. These are PECB bundles; no CQI and IRCA, IAPP, EC-Council or Linux Foundation credential is implied. **Does 12-month access mean 12 months of teaching?** No. It is the material-access period, not a scheduled course duration or a promise of unlimited instructor support. The listed bundles are self-paced. Curriculum day labels describe a learning sequence; they are not booked live classroom dates. **Which standard edition or syllabus should I check?** Confirm the exact course edition and current PECB syllabus before enrolment, especially where a standard is being revised. Publication of a newer standard does not automatically update a training bundle or include a transition course. Confirm the course edition with the Academy before payment. ## Choose the right course for your role. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)