IICTI Certified Digital Forensics Investigator

Holders demonstrate that they can apply and evaluate forensically sound acquisition and evidence integrity, file system and storage media forensics, windows artefact analysis and timeline reconstruction and memory forensics and volatile data analysis, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Digital Forensics Investigator.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Forensically sound acquisition and evidence integrity18% of the exam

   • Design acquisition strategies that preserve evidential integrity and admissibility under volatile, encrypted and remote conditions.
   • Scope: ISO/IEC 27037, NIST SP 800-86, write blocking, cryptographic hashing and verification, live vs dead-box acquisition, encrypted volumes (BitLocker, FileVault, LUKS), chain of custody documentation.
2. 02File system and storage media forensics6% of the exam

   • Analyse file system structures to recover, attribute and validate file activity, including evidence of anti-forensic manipulation.
   • Scope: NTFS ($MFT, $UsnJrnl, $LogFile), APFS snapshots, ext4 and ReFS, SSD TRIM and wear levelling effects, file carving, volume shadow copies, timestomping and anti-forensics detection.
3. 03Windows artefact analysis and timeline reconstruction10% of the exam

   • Reconstruct user and attacker activity by correlating Windows artefacts into defensible timelines.
   • Scope: Registry hives, Prefetch, Amcache, ShimCache, SRUM, event logs, LNK and Jump Lists, ShellBags, super timelines with Plaso, KAPE and Eric Zimmerman tools.
4. 04Memory forensics and volatile data analysis5% of the exam

   • Diagnose malicious and user activity from memory images and assess the reliability of volatile evidence.
   • Scope: Volatility 3 and MemProcFS, process and module analysis, code injection and rootkit indicators, credential artefacts, hibernation files and pagefiles, memory smearing.
5. 05MacOS, Linux and cloud workload forensics5% of the exam

   • Investigate incidents across non-Windows and cloud environments, addressing acquisition limits and log retention constraints.
   • Scope: macOS Unified Logs, FSEvents and KnowledgeC, Linux journald, auditd and bash history, container forensics, cloud snapshot acquisition, CloudTrail, Azure activity and Microsoft 365 Unified Audit Log.
6. 06Mobile device forensics7% of the exam

   • Evaluate mobile acquisition options and analyse device and application artefacts while documenting tool and method limitations.
   • Scope: iOS and Android acquisition types (logical, file system, full file system; BFU/AFU states), commercial tool governance, SQLite and WAL analysis, app artefacts, iLEAPP/ALEAPP, encryption and lock-state limitations.
7. 07Network forensics and log analytics5% of the exam

   • Analyse network and log evidence to reconstruct intrusion paths and data exfiltration with quantified confidence.
   • Scope: PCAP and NetFlow analysis, Zeek, TLS metadata and JA4 fingerprinting, DNS and proxy logs, SIEM query correlation, lateral movement and exfiltration reconstruction.
8. 08Malware triage and intrusion analysis for investigations4% of the exam

   • Evaluate malicious code and intrusion artefacts at investigation level to determine capability, impact and scope.
   • Scope: Static and behavioural triage, sandbox reporting, YARA, IOC extraction and pivoting, MITRE ATT&CK mapping, attribution caveats and intelligence handling (TLP).
9. 09Enterprise-scale incident and eDiscovery investigations7% of the exam

   • Lead large-scale investigations that balance speed, scope, legal hold obligations and privacy rights.
   • Scope: Remote triage at scale (Velociraptor), EDR telemetry, EDRM model, legal hold, insider threat and employee investigations, proportionality and privacy constraints (GDPR).
10. 10Multimedia authentication and deepfake analysis4% of the exam

    • Evaluate the authenticity and provenance of digital media and communicate the limits of detection methods.
    • Scope: Image and video metadata, error level and noise analysis, PRNU camera identification, C2PA content credentials, synthetic media and deepfake detection limits.
11. 11Tool validation, quality assurance and lab accreditation11% of the exam

    • Design a forensic quality management system that validates tools and methods and withstands accreditation and court scrutiny.
    • Scope: ISO/IEC 17025, ISO/IEC 27041, 27042 and 27043, NIST CFTT, SWGDE best practices, error rates, peer review, case management and audit trails.
12. 12Expert reporting, testimony and cross-border legal frameworks18% of the exam

    • Evaluate legal admissibility requirements and produce expert reports and testimony that are objective, reproducible and defensible.
    • Scope: Daubert and Frye standards, expert witness duties, Budapest Convention and Second Additional Protocol, EU e-Evidence Regulation, CLOUD Act, defensible reporting and opinion language.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner