Skip to content
All courses
Digitale ForensikPECBCertificate program 5 days

PECB Certified Digital Forensics Examiner (CDFE)

5-day PECB course for the Digital Forensics Examiner: acquire and analyze digital evidence (file system, memory, malware) in a legally sound way. As eLearning or Self-Study.

In this 5-day course you learn to acquire, analyze and preserve digital evidence in a legally sound way, across Windows, macOS, Linux and mobile devices. The focus is on file system and memory forensics, network and malware analysis. Available as eLearning or Self-Study; once you pass, you can apply for the PECB Certified Digital Forensics Examiner credential.

When something has happened, only one thing counts: solid evidence. This course teaches the craft of digital forensics, from clean evidence acquisition with chain-of-custody to deep analysis of file systems, memory and malware. So your findings hold up, even in court.

from€821.10incl. VAT(€690 plus VAT)

Formats & prices

eLearning
Self-paced · start anytime
€1,059.10
incl. VAT
€890 plus VAT
Self-Study
Independent · start anytime
€821.10
incl. VAT
€690 plus VAT

Net price per participant. Companies are billed net; consumers see the gross price (incl. VAT).

Prices are shown in EUR. For businesses outside Germany the reverse-charge mechanism applies (net price, no German VAT); for EU consumers the gross price shown applies. Invoicing in USD is available on request (billed in EUR at the prevailing rate).

How enrolment works

  1. 01

    Request your place

    Choose a format above and send your enquiry, no instant checkout, a real human handles it.

  2. 02

    Order confirmation

    You receive a written order confirmation from us with all the details and the invoice.

  3. 03

    Pay by bank transfer

    Settle the invoice by transfer, exam and certification fees are already included.

  4. 04

    Get access via PECB

    We enrol you with PECB; you receive your course access and exam through the official PECB platform.

Why this price is worth it

  • An official PECB Certificate Program with an internationally recognised completion certificate, not a training provider's in-house certificate.
  • Exam and certification fees are included, plus one free retake, so you get two attempts.
  • Your trainer is a Senior Lead Auditor and Senior Lead Implementer with industry practice, not someone reading slides. He builds AI management systems and audits them. Senior is PECB's senior tier, awarded only after documented field experience (1,000+ audit hours, at least seven years).
  • Small groups and a personal enrolment with advice, instead of an anonymous checkout.
  • Transparency: PECB charges an annual maintenance fee (AMF) to keep the personnel certification active, billed directly to the certificate holder. We tell you upfront, not in the fine print.
  • Compare carefully: short courses with an in-house certificate are not a Lead Auditor under ISO/IEC 17024, and "free" courses often charge four-figure exam and certificate fees separately. Here, everything is included.

Your certificate

The certificate is the product. This is what you hold after passing, issued by PECB, internationally verifiable.

Certificate of Achievement
This certifies that
Your Name
has been certified as
PECB Certified Digital Forensics Examiner (CDFE), Certificate of Completion
Cert. No. ____-____· PECB
  • Issued by PECB, the accredited certification body
  • Official PECB completion certificate
  • Verifiable via your unique certificate number
  • 31 CPD credits for your professional development

Representative preview. The official certificate design and issuance are by PECB.

What you will learn

  • Understand forensic principles, legal considerations and investigative procedures for cybercrime and incident response
  • Collect, preserve and analyze digital evidence from various sources, adhering to chain-of-custody and evidentiary standards
  • Use industry-standard tools and methods to examine file systems, recover deleted data and detect tampering
  • Produce comprehensive forensic reports and communicate findings clearly to technical and legal audiences

Who it is for

  • Digital forensics analysts and investigators
  • IT security professionals and incident responders
  • Legal professionals involved in cybercrime cases
  • Corporate security and compliance officers
  • Security team members and cybersecurity and cyber intelligence analysts

Agenda

  1. Day 1, Foundations
    • Introduction to digital forensics
    • Forensic tools and techniques
    • Network analysis with Wireshark, basics of malware analysis
  2. Day 2, File system & reverse engineering
    • File system and memory forensics
    • Reverse engineering in Windows (PE) and Linux (ELF)
    • x86 architecture fundamentals
  3. Day 3, Malware analysis & threat hunting
    • Advanced malware analysis
    • Network analysis with Zeek
    • Ghidra for malware analysis, Yara rules for threat hunting
  4. Day 4, Advanced analysis & incident response
    • Dark web forensics, interactive behavior analysis
    • Memory and file system techniques
    • Automation with Zeek, patch analysis with Ghidra
  5. Day 5, Exam
    • PECB Digital Forensics Examiner certification exam

Prerequisites

A basic understanding of IT systems and IT security is helpful. The course is hands-on and tool-focused.

Exam

  • Meets the requirements of the PECB Examination and Certification Program (ECP)
  • Retake: one free retake within 12 months of the first attempt

Included in the price

  • Training material incl. examples, best practices, exercises and forensic labs
  • Examination and certification fees
  • Attestation of course completion with CPD credits issued by PECB
  • One free exam retake within 12 months
  • PECB Certified Digital Forensics Examiner credential after passing. Der KI-Auditor is an authorized PECB training partner, not a certification body.
About the certificate

This is a certificate program: you receive a PECB course completion certificate. It is not a personnel certification under ISO/IEC 17024, and a perfect basis for the Lead Auditor path.

PECB
PECB Authorized Partner & Certified Trainer
Official PECB courses, exam and personnel certification are issued by PECB.

Frequently asked questions

What does the course cover?
The full forensic process: evidence acquisition with chain-of-custody, file system and memory forensics, network and malware analysis with tools such as Wireshark, Ghidra, Yara and Zeek, through to the forensic report.
What prior knowledge do I need?
A basic understanding of IT systems and IT security helps. The course is hands-on and tool-focused with labs.
How is the course delivered?
As self-paced eLearning or Self-Study, start anytime. Examination and certification fees plus one free retake are included.
Is this a PECB certification?
Yes. After passing you apply for the PECB Certified Digital Forensics Examiner credential. The certification is issued by PECB; Der KI-Auditor is an authorized training partner, not a certification body.
Is the course funded? What about study leave?
Honestly: we are not an AZAV-accredited provider, so a German employment-agency training voucher (Bildungsgutschein) is not available. However: for companies the course fees are generally tax-deductible as a business expense; in several German states the course can be recognised as statutory educational leave (Bildungsurlaub, apply in good time); and depending on the state there are continuing-education vouchers for employees. We are happy to clarify what applies in your case in a short call, no empty promises.

More courses

PECB Certified Incident Responder (CIR)

5 days · Specialist

PECB Certified Cyber Threat Analyst (CCTA)

5 days · Specialist

PECB Certified Lead Ethical Hacker

5 days · Specialist

PECB Certified Artificial Intelligence Professional (CAIP)

5 days · Professional

PECB Certified Artificial Intelligence Manager (CAIM)

5 days · Manager

PECB Certified Lead AI Risk Manager

5 days · Manager

ISO/IEC 42001 Foundation

2 days · Foundation

ISO/IEC 42001 Lead Auditor

5 days · Lead Auditor

ISO/IEC 27001:2022 Foundation

2 days · Foundation

ISO/IEC 27001 Lead Auditor

5 days · Lead Auditor

Further reading

NIS2 und ISO 27001: Wie der Mittelstand die Pflicht beherrschbar macht

Cyber Resilience Act: what device and machine manufacturers must know now

Secure your place

eLearning & Self-Study: start anytime. In-person / in-house: dates on request.

Lars Zimmermann
Lars Zimmermann
PECB Partner & Certified Trainer · ISO/IEC 42001 Senior Lead Auditor & Lead Implementer, ISO/IEC 27001 Lead Auditor

You learn the standard from someone who audits to it and runs a precision-engineering company that uses AI every day. More about Lars