100+ Free CFCE Practice Questions

Prepare for the IACIS Certified Forensic Computer Examiner (CFCE) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

Not published Pass Rate

100+ Questions

100% Free

Loading practice questions...

2026 Statistics

Key Facts: CFCE Exam

80%

Minimum Pass Score

IACIS

100

Knowledge Test Questions

IACIS

30 days

Hard Drive Practical Window

IACIS

$800

External Candidate Fee

IACIS

3 years

Recertification Cycle

IACIS

Core Competency Domains

IACIS BCFE/CFCE

The CFCE is the gold-standard law-enforcement digital forensics credential, accredited by the FSAB and issued by IACIS. It requires 72 hours of qualifying training, four peer-review practical problems, a 30-day hard drive practical exam, and a 100-question knowledge test — all at an 80% passing threshold. IACIS's tool-neutral philosophy means the exam tests forensic principles deeply: FAT/NTFS structures, Windows registry forensics, evidence law, and expert reporting. The BCFE course ($0 exam fee included) is the primary pathway.

Sample CFCE Practice Questions

Try these sample questions to test your CFCE exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which legal standard governs the admissibility of scientific expert testimony in U.S. federal courts and requires that methods be tested, peer-reviewed, have known error rates, and be generally accepted?

A.Daubert standard

B.Kumho standard

C.Federal Rules of Evidence 901

D.Frye standard

Explanation: The Daubert standard, established by the Supreme Court in Daubert v. Merrell Dow Pharmaceuticals (1993), governs expert testimony in federal courts. Under Daubert, the trial judge acts as a gatekeeper and must ensure that the expert's methods are scientifically reliable: tested, peer-reviewed, have a known error rate, and are generally accepted. Many states have adopted Daubert, replacing the older Frye 'general acceptance' standard.

2A forensic examiner receives a hard drive seized under a search warrant. Before imaging, the examiner attaches the drive to a forensic workstation. What device should be used to prevent any write operations to the evidence drive?

A.A write blocker

B.A forensic bridge with read-only firmware

C.A software-based disk cloner

D.A hardware hash validator

Explanation: A write blocker (hardware or software) intercepts all write commands directed to the evidence drive and blocks them, ensuring the original media is not altered during acquisition. Hardware write blockers such as Tableau or WiebeTech devices are preferred in court-admissible forensics because they operate at the hardware layer and function independently of the host operating system.

3Which document records every person who has had custody of a piece of digital evidence from the moment of seizure through trial?

A.Evidence seizure log

B.Forensic examination report

C.Chain of custody form

D.Digital evidence bag label

Explanation: The chain of custody form records each person who possessed the evidence, the date and time of transfer, the reason for transfer, and the condition of the evidence at each handoff. A properly maintained chain of custody is essential to demonstrating that evidence has not been tampered with and that it is the same item collected at the scene.

4Under the Fourth Amendment, a warrantless search of a private citizen's computer is generally unconstitutional UNLESS which of the following applies?

A.The suspect is on parole or probation with a search condition

B.The investigator believes evidence will be destroyed within 24 hours

C.The computer is connected to the internet

D.The employer has a written acceptable use policy

Explanation: Parolees and probationers who have search conditions attached to their supervision can have their computers searched without a warrant because they have reduced Fourth Amendment expectations as a condition of release. Other recognized exceptions include consent, exigent circumstances (imminent destruction of evidence), plain view, and border search — but mere belief that evidence will be destroyed is not automatic authority without meeting the full exigent circumstances test.

5What is the primary purpose of hashing a forensic image immediately after acquisition?

A.To compress the image for storage efficiency

B.To encrypt the image to prevent unauthorized access

C.To verify that the image is a bit-for-bit copy of the original

D.To index the contents for faster searching

Explanation: Hashing (typically MD5 and/or SHA-256) immediately after acquisition creates a cryptographic fingerprint of the forensic image. If the hash of the image matches the hash of the source drive, the examiner can testify that the image is an exact, bit-for-bit duplicate. If the hash later matches after processing, it proves the image has not been altered. This integrity verification is fundamental to court-admissible digital forensics.

6Which of the following best describes a 'forensically sterile' acquisition medium?

A.A drive that has been wiped with a DOD-approved overwrite pattern and verified to contain no user data

B.A drive that is brand new and has never been used

C.A drive formatted with NTFS using full format

D.A drive that has been physically cleaned and inspected for hardware defects

Explanation: A forensically sterile medium is one that has been wiped (zeroed or overwritten with a known pattern) and verified to contain no data from prior use. Simply being 'new' is not sufficient because drives can contain manufacturing test data. Full NTFS formatting does not overwrite all sectors. The sterility must be validated by hashing or sector-level inspection before use.

7When seizing a running computer at a crime scene, the first responder should:

A.Photograph the screen, document running processes, and then capture volatile RAM before powering down

B.Log into the system to copy important files to an external drive

C.Insert a bootable USB to run a forensic live image of the running system

D.Immediately unplug the power cord to preserve the state of the hard drive

Explanation: Volatile data — RAM contents, running processes, network connections, and logged-in users — is lost the moment power is cut. Best practice is to photograph the screen, document visible information, capture a RAM dump if tools and authority are available, and only then power down. This preserves the maximum evidence while acknowledging that the drive state will be preserved on shutdown.

8What does the hexadecimal value 0x55AA at the end of the Master Boot Record (MBR) indicate?

A.The MBR signature, indicating the sector is a valid bootable record

B.The start of the first partition

C.The end-of-file marker for the boot sector

D.The MBR is encrypted

Explanation: The two-byte signature 0x55AA (stored at byte offsets 510–511 of the sector) is the MBR boot signature or magic number. The BIOS checks for this value to confirm that the sector is a valid bootable MBR. Without this signature, the BIOS will not attempt to execute the boot code in that sector.

9How many bytes are in a single sector on a traditional hard drive?

A.512 bytes

B.1024 bytes

C.4096 bytes

D.256 bytes

Explanation: Traditional hard drives use 512-byte sectors, which has been the standard for decades. Modern drives increasingly use 4096-byte (4K) Advanced Format sectors, but legacy drives and most forensic tool references default to 512 bytes per sector unless otherwise specified. The distinction is important when calculating offsets and partition boundaries.

10In binary, the value 10110110 equals which decimal number?

A.182

B.178

C.186

D.166

Explanation: Converting 10110110 binary to decimal: 1×128 + 0×64 + 1×32 + 1×16 + 0×8 + 1×4 + 1×2 + 0×1 = 128 + 32 + 16 + 4 + 2 = 182. Digital forensics examiners must be fluent in binary, hexadecimal, and decimal conversions to interpret raw disk data and file headers.

About the CFCE Exam

The CFCE (Certified Forensic Computer Examiner) is the only digital forensics certification accredited by the Forensic Specialties Accreditation Board (FSAB). Issued by IACIS, it validates deep competency in computer forensic examination methodology: legal procedures, FAT and NTFS file system analysis, Windows artifact recovery, data recovery, and professional testimony. The certification includes a two-phase process: peer review practicals followed by a hands-on hard drive examination and a 100-question knowledge test.

Assessment

Performance-based assessment

Time Limit

14 days (knowledge test); 30 days (practical)

Passing Score

80% on each component

Exam Fee

$800 (external); $0 for BCFE graduates (IACIS (International Association of Computer Investigative Specialists))

CFCE Exam Content Outline

15%

Pre-Examination Procedures & Legal Issues

Search and seizure law, Fourth Amendment, Daubert standard, chain of custody, FRE Best Evidence Rule, order of volatility, forensic sterility

10%

Computer Fundamentals & Hardware

BIOS/UEFI, Secure Boot, numbering systems (binary/hex/decimal), disk sectors, storage fundamentals, hardware interfaces

10%

Partitioning Schemes

MBR layout (partition table, 4-entry limit, 2 TB cap), GPT (64-bit LBA, backup table, Protective MBR, 128 partitions), partition gaps

25%

Windows File Systems (FAT & NTFS)

FAT directory entries (0xE5 deletion, 0x00 end-of-directory), cluster chains, slack space; NTFS MFT attributes, resident/non-resident data, $LogFile, $UsnJrnl, ADS, timestamps (MACB, $SI vs $FN), $Bitmap, $Secure, $MFTMirr

20%

Windows Artifacts

Registry hives (NTUSER.DAT, SYSTEM, SOFTWARE, SAM), shellbags, UserAssist (ROT-13), Prefetch (.pf), event logs (4624/4625/1102), Recycle Bin ($I/$R), LNK files, Jump Lists, thumbcache, USB artifacts (USBSTOR, setupapi.log), wireless history, pagefile.sys, hiberfil.sys, Zone.Identifier ADS

12%

Data Recovery & Encryption

Forensic imaging (E01, RAW), write blockers, MD5/SHA-256 hashing, file carving (magic bytes), file carving signatures (JPEG/PNG/PDF/ZIP), BitLocker recovery key, EFS certificate forensics, VeraCrypt key recovery from RAM, NSRL hash filtering, RAM acquisition tools

Presentation of Findings & Expert Reporting

Forensic examination report structure, reproducibility, objectivity, Daubert methodology validation, expert witness testimony, cross-examination response, jury communication strategies

How to Pass the CFCE Exam

What You Need to Know

Passing score: 80% on each component
Assessment: Performance-based assessment
Time limit: 14 days (knowledge test); 30 days (practical)
Exam fee: $800 (external); $0 for BCFE graduates

Keys to Passing

Work through all 100 available questions
Review every answer and explanation
Track weak areas and revisit them
Use our AI tutor for tough concepts

CFCE Study Tips from Top Performers

1Master hexadecimal arithmetic — you must convert between hex, binary, and decimal fluently to interpret disk structures manually

2Learn the FAT directory entry structure byte-by-byte: 32 bytes total, first byte deletion markers (0xE5 deleted, 0x00 end), attribute bytes, timestamps, starting cluster, and file size

3Memorize the seven NTFS metadata files ($MFT, $MFTMirr, $LogFile, $Volume, $AttrDef, ., $Bitmap) and their forensic roles

4Understand the difference between $STANDARD_INFORMATION and $FILE_NAME timestamps — discrepancies indicate timestomping

5Know your Windows registry hives by filename: NTUSER.DAT, SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT, and the critical forensic artifacts in each

6Study shellbags, UserAssist (ROT-13 encoding), Prefetch (.pf files), LNK files, and Jump Lists as multi-artifact program/file execution evidence

7Understand the Daubert standard's four factors and be able to apply them to forensic methodology challenges

8Practice calculating slack space: (cluster_size × number_of_clusters) − file_size = file slack

9Know the difference between pagefile.sys (virtual memory) and hiberfil.sys (hibernation RAM snapshot) and their forensic value

10Memorize common file magic bytes: JPEG (FF D8 FF), PNG (89 50 4E 47), PDF (25 50 44 46), ZIP/DOCX (50 4B 03 04)

Frequently Asked Questions

What is the CFCE certification and who issues it?

The CFCE (Certified Forensic Computer Examiner) is a digital forensics certification issued by IACIS (International Association of Computer Investigative Specialists). It is the only digital forensics certification accredited by the Forensic Specialties Accreditation Board (FSAB). It is widely respected in law enforcement, military, and private-sector digital forensics.

What is the CFCE exam format?

The CFCE is a two-phase certification. Phase 1 (Peer Review) involves solving four scenario-based practical forensic problems under a coach's guidance over approximately 30 days each. Phase 2 (Certification) includes a 30-day hands-on hard drive practical examination and a 14-day 100-question knowledge test. Both components require an 80% minimum score.

What topics does the CFCE knowledge test cover?

The 100-question knowledge test covers all seven CFCE core competencies: pre-examination procedures and legal issues (search/seizure, evidence rules, chain of custody), computer fundamentals and hardware, partitioning schemes (MBR and GPT), Windows file systems (FAT and NTFS), Windows artifacts (registry, shellbags, event logs, Prefetch, USB artifacts), data recovery and encryption, and presentation of findings and expert reporting.

How do I qualify for the CFCE?

External candidates must have 72 hours of digital forensics training aligned with CFCE core competencies and pay $800. Graduates of the IACIS BCFE (Basic Computer Forensic Examiner) course qualify automatically with no additional fee. All candidates must pass a background check. Registration opens June 1 (September cycle) and December 1 (March cycle).

What is IACIS's 'tool neutrality' philosophy?

IACIS teaches forensic examiners to understand the underlying principles of digital forensics (file system structures, binary encoding, hash algorithms) deeply enough to validate findings with multiple tools or manually. This means an examiner can explain findings in court without relying on 'the tool said so' — they can demonstrate WHY the evidence is what it is from first principles.

Does this practice test prepare me for the actual CFCE knowledge test?

Yes — these 100 questions cover all seven CFCE core competency domains at the depth tested by the CFCE knowledge test. The real exam includes multiple-choice, true/false, matching, and short-answer formats; this practice bank focuses on the multiple-choice component. You should also practice with a hard drive practical to prepare for Phase 2's hands-on component.