100+ Free eCDFP Practice Questions

The eCDFP is a 24-hour practical exam delivered through INE Security's Hera Labs platform. Candidates connect via VPN to a browser-accessible forensic lab containing both a Windows and Linux forensic workstation pre-loaded with tools including FTK Imager, WinHex, RegRipper, Autopsy, and Wireshark. The exam consists of 30 questions: 15 theoretical questions testing conceptual knowledge, and 15 practical questions requiring hands-on analysis of provided forensic images and network captures. A score of 76.7% or above is required to pass.

The eCDFP covers four domains: Fundamentals of Digital Forensics (33%) — Windows artifacts like registry hives, prefetch files, LNK files, shellbags, jump lists, recycle bin forensics, and event logs; Digital Forensics Tools and Techniques (27%) — FTK Imager, WinHex, RegRipper, Autopsy, Wireshark, and tcpdump; Preservation of Evidence (20%) — chain of custody, write blockers, order of volatility, and acquisition methods; and Storage Device Fundamentals (20%) — FAT/NTFS file system internals, MBR/GPT analysis, MFT parsing, and deleted file recovery.

The eCDFP exam environment includes: FTK Imager (forensic disk imaging and evidence examination), WinHex (hex editor for raw disk and MFT analysis), RegRipper (offline Windows registry parsing), Autopsy (GUI forensic suite for artifact extraction), and Wireshark/tcpdump (network packet capture analysis). Note that not all tools introduced in the training course may be available in the exam environment, so practice manual analysis techniques as a fallback.

The eCDFP requires genuine hands-on forensic skill. Community reports indicate that some practical questions require techniques or knowledge that go beyond what is explicitly covered in the training course, demanding broader forensic knowledge. The first-attempt pass rate for some candidates requires a second attempt (free retake available within 14 days). The exam emphasizes manual analysis over automated tool outputs, so understanding the underlying forensic concepts — not just tool mechanics — is essential.

Complete the INE Digital Forensics Professional learning path thoroughly, performing all labs. Build a personal forensics lab with FTK Imager, Autopsy, and WinHex to practice imaging and analysis. Master Windows artifact locations (registry hive files, prefetch, LNK, shellbags, jump lists) and understand what each proves. Practice NTFS internals: read raw MFT records in WinHex, understand the $MFT, $UsnJrnl, $LogFile, and $Bitmap. Study network forensics with Wireshark and tcpdump, focusing on HTTP, DNS, and anomaly detection. Use the SANS Windows Forensics poster as a reference.

This is a knowledge-prep multiple-choice practice bank covering the eCDFP's body of knowledge. The real eCDFP is a hands-on practical exam where you must use forensic tools to analyze actual disk images and network captures. This practice bank trains you on the concepts, terminology, tool functions, and technical knowledge that are tested theoretically and underpin the practical scenarios. Hands-on lab practice with actual forensic tools is also essential.