CCFE Core Competencies
- Procedures and Legal Issues
- Computer Fundamentals
- Partitioning Schemes
- Data Recovery
- Windows File Systems
- Windows Artifacts
- Report writing (Presentation of Finding)
- Procedures and Legal issues
- Knowledge of search and subjection and rules for evidence as applicable to computer forensics.
- Ability to explain the on-scene action taken for evidence preservation.
- Ability to maintain and document an environment consolidating the computer forensics.
- Computer Fundamentals
- Understand BIOS
- Computer hardware
- Understanding of numbering system (Binary, hexadecimal, bits, bytes).
- Knowledge of sectors, clusters, files.
- Understanding of logical and physical files.
- Understanding of logical and physical drives.
- Partitioning schemes
- Identification of current partitioning schemes.
- Understanding of primary and extended partition.
- Knowledge of partitioning schemes and structures and system used by it.
- Knowledge of GUID and its application.
- Windows file system
- Understanding of concepts of files.
- Understanding of FAT tables, root directory, subdirectory along with how they store data.
- Identification, examination, analyzation of NTFS master file table.
- Understanding of $MFT structure and how they store data.
- Understanding of Standard information, Filename, and data attributes.
- Data Recovery
- Ability to validate forensic hardware, software, examination procedures.
- Email headers understanding.
- Ability to generate and validate forensically sterile media.
- Ability to generate and validate a forensic image of media.
- Understand hashing and hash sets.
- Understand file headers.
- Ability to extract file metadata from common file types.
- Understanding of file fragmentation.
- Ability to extract component files from compound files.
- Knowledge of encrypted files and strategies for recovery.
- Knowledge of Internet browser artifacts.
- Knowledge of search strategies for examining electronic
- Windows Artifacts
- Understanding the purpose and structure of component files that create the windows registry.
- Identify and capability to extract the relevant data from the dead registry.
- Understand the importance of restore points and volume shadow copy services.
- Knowledge of the locations of common Windows artifacts.
- Ability to analyze recycle bin.
- Ability to analyze link files.
- Analyzing of logs
- Extract and view windows logs
- Ability to locate, mount and examine VHD files.
- Understand the Windows swap and hibernation files.
- Report Writing (Presentation of findings)
- Ability to conclude things strongly based on examination observations.
- Able to report findings using industry standard technically accurate terminologies.
- Ability to explain the complex things in simple and easy terms so that non-technical people can understand clearly.
- Be able to consider legal boundaries when undertaking a forensic examination