Successful completion of this exam will demonstrate a candidate's understanding of the process for performing digital forensics. They will demonstrate their knowledge on policies that contain clear statements addressing all major forensic considerations, such as contacting law enforcement, performing monitoring, and conducting regular reviews of forensic policies and procedures. The candidate will be able to demonstrate their ability in operational troubleshooting, log monitoring, data recovery, data acquisition, due diligence/regulatory compliance, collection, examination, analysis, and reporting.
Successful completion of this exam will demonstrate the candidate's ability to conduct the following:
- Policy and Procedure Development
- Digital Evidence Assessment
- Digital Evidence Acquisition
- Digital Evidence Examination
- Documenting and Reporting
If you would like to provide feedback for this course, please e-mail the NICCS SO at NICCS@hq.dhs.gov.