About Our Certifications

The DFCB offers three types of certification. The Digital Forensics Certified Practitioner (DFCP), Digital Forensics Certified Associate (DFCA) and Digital Forensics Certified Practitioner Fellow (DFCP-F). Each certification has a separate set of requirements which are noted below.

Digital Forensics Practitioner Certification Overview & Process (DFCP)

DFCP certification requires several progressive steps. It is the applicant’s responsibility to complete each of these steps in a timely manner. If the applicant’s application remains dormant for sixty days, DFCB will notify the applicant by email that action is necessary. If the necessary action is not taken after notifying the applicant, the DFCB may delete the applicant’s account. 

DFCB’s preferred form of communication is email. The applicant should provide an email that is checked regularly by the applicant on all forms where requested.

Application: The applicant completes and submits a completed Self-Assessment package online at: www.dfcb.org. Once the Self-Assessment is completed, scores more than 100 points on the Self-Assessment, the applicant will need to follow the instructions and complete the signature form and create a login. Once logged in, the applicant will complete the DFCB Application; package is reviewed and processed by the Certification Committee. The applicant then moves on to the Testing Process.

The applicant will receive an Invoice and Attestation forms from DFCB. Once applicant has submitted to edu@dfcb.org applicant is then required to make payment for, test, credential review and background check. Active law enforcement is not required to have background check.
Test Fee: $350.00

Background Check: Once payment is confirmed, DFCB will contact the candidate with instructions to complete their background check. Upon passing the background and credential investigation, the applicant moves to the testing process.

Testing: Candidate will receive login credentials from our exam host, Exam Builder to access the online non-proctored timed exam. Applicant has 45 days to complete the one hour (60 min) 50 question test.

Passing applications are moved to the Certification Committee for review of credentials and references. Should the applicant not pass the examination they will be contacted by the Testing Committee and given on additional chance to retake the examination at no additional cost.

Credential Review: Applications and references are reviewed. Applications that meet DFCP standards are approved and applicants are notified by email.  The applicant receives a letter from the Chairperson of the Digital Forensics Certifications Board and an official Certificate and letter of completion is mailed.

If you have any questions, contact edu@dfcb.org

 

Digital Forensics Associate Certification Overview & Process (DFCA)

The DFCA provides an entry-level certification with potential progression to the Digital Forensic Certified Practitioner certification after the candidate accumulates five years of experience. It also serves those who no longer perform the requisite hours of “hands-on” forensics to renew their DFCP. The goal of the DFCA certification is to enhance the professionalism and body of knowledge within the digital forensics industry and distinguish individuals who have a broad knowledge of digital forensics. As a DFCA, you become a member of the Digital Forensics Certification Board whose sole purpose is to provide certifications that focus on benefiting the profession and promoting professional collaboration. Your certification status connects you with other members whose mission is to help the maturation of digital forensics as a science and encourage the sharing of information, methods and processes among members of the profession. DFCB Associates are held accountable to a high standard of excellence which provides assurance to employers that certified associates meet objective and independent standards.

To start the DFCA Certification process, complete the Application Form and Attestation form and submit to edu@iafci.org The applicant will receive an invoice, for the test, credential review, and background check. A background investigation is required (There is no prerequisite).  Once payment is authorized, a paid confirmation will be sent by email along with instructions on how to complete your background check process. Please allow 5-10 business days to complete the process. Once the background check is complete, DFCB will notify you on how to start the DFCA test process. 

Test and background check fee $350.00

 

DFCA Exam is an Online Proctored Exam: The DFCA exam must be proctored, options for proctoring are to use a college testing center or our professional proctoring service.  Our exam host provider charges $25, this is paid by the examiner. The proctoring facility requires 72 hours’ notice; earlier appointments are available for additional fees.

The exam consists of 100 multiple choice questions; you have 2 hours to complete the exam. Upon successful completion of the exam, and final review by the certification committee, you will then be moved to the final certification phase where you will receive a letter from the Digital Forensics Certification Board and an official Certificate of completion.  

 

Open Book Policy: The DFCA exam policy is open book, open notes only. No tablets or electronic devices are to be used whatsoever while taking the online proctored test.  We recommend you print all study guide material and bring as hard paper copies. 

 

If you do not pass the test, you will be notified by the testing committee and given 45 days from the original exam date to retake the exam at no cost.  

Forms to start the testing process:

Application form Click Here

Attestation form Click Here
If you have any questions, please contact the admin at edu@dfcb.org Or 916-939-5000.

DFCA Study Guide

This study guide was developed to provide a DFCA candidate with an outline and reference material that may be covered on the DFCA examination. If reviewed and studied while preparing for the DFCA examination, one will increase their chances by focusing on a specific knowledge base useful to a DFCA candidate. Each section of this study guide includes domains that are testable on the DFCA exam, along with concepts, terminology, technical data, and references to material that may be testable. Download Here

 

Digital Forensic Certified Practitioner – Fellow Overview & Process (DFCP-F)

The primary goal of the Digital Forensic Certified Practitioner – Fellow (DFCP-F) certification is to enhance the professionalism and body of knowledge associated with the Digital Forensic Certification Board by providing a means for accomplished and distinguished individuals to participate in the DFCB even though no longer actively conducting fieldwork. The DFCP-F certification will be designated for individuals who have made significant and quantifiable contributions in the advancement of knowledge and expertise in the fields of digital forensics and or electronic discovery, but are no longer directly working in the respective field.

Individuals eligible for consideration and potential award of the DFCP-F certification will meet the
following conditions:

  1. Individuals whose membership is in good standing with the DFCB, who have held the DFCP certification for a minimum of five (5) years, but have retired from actively conducting fieldwork.

The process for awarding the DFCP-F certification to a candidate shall have three components:

  1. Nomination – the candidate must be nominated by at least two (2) members in good standing with the DFCB. Officers and /or Executive Board Members offering a nomination will be recused from the award voting process related to that candidate.
  2. Review of Qualifications– the Executive Board will review the qualifications of the candidate to determine eligibility. The Executive Board will make a decision, at its discretion, to conduct either an informal or formal review process.
    1. An informal review process does not require supporting documentation to be provided by the candidate.
    2. A formal review requires supporting documentation to be provided by the candidate, as set forth under “Documentation Requirement” guidelines.
    3. In the event of an informal review the Executive Board may make a determination to by-pass the formal review process based on the strength of the candidate’s qualifications. In the event of a formal review the candidate will be required to produce documentation of qualifications for review. Regardless of which review process is chosen by the Board, the officers shall have a minimum of thirty (30) days from the time of nomination to review the candidate’s qualifications prior to any determination of award being made.
  3. Vote of the Executive Board – a vote of the Executive Board will be the deciding factor in award of the DFCP-F certification.
    1. If the Executive Board has selected an informal review process, the informal review must take place during a scheduled meeting that meets the requirements of constituting an official DFCB Board meeting under the bylaws. A two-thirds (2/3) majority vote in favor of the candidate is required to award the certification. By default, if a candidate fails to be awarded under an informal review process, the candidate or a member of the Executive Board may request a formal review and request another vote for award under the formal review process.
    2. If the Executive Board or the candidate has selected a formal review process, the formal review must take place during a scheduled meeting that meets the requirements of constituting an official DFCB Board meeting under the bylaws. Upon reviewing the documentation provided by the candidate and after the minimum thirty (30) day review period has passed, and during a regularly scheduled Board meeting, a two-thirds (2/3) majority vote of the Executive Board in favor of the candidate is required to award the certification.
  4. Membership Dues: DFCP-F certification holders will be required to pay membership dues to the DFCB to maintain their certification.
  5. Documentation Requirement: the candidate will provide a copy of his or her Curriculum Vitae for a formal review process. The Executive Board may, at its discretion, request additional documentation from the candidate prior to making an award determination.
  6. Re-certification: There is no re-certification requirement associated with the DFCP-F.
  7. Revocation: The revocation process, if necessary, would activate under the same criteria as the existing process for the DFCP, and follow the same guidelines and processes.
Digital Forensics Certification Board Re-certification Policy
DFCB Board Policy:

Every holder of a certificate issued by the Digital Forensics Certification Board must renew their certification every 36 months.

DFCB Board Requirements For Re-certification:

Every holder of a Digital Forensics Certified Practitioner certificate must satisfy the following requirements every 36 months. These requirements encompass a linear three step process.

  1. The lapse can be no more than 1 year.
  2. Bring their membership fees, from the last point in time when their dues were current, to the current time period where reinstatement is being requested from the Executive Board.
  3. Document and attest to having currency in the field over the preceding 36 months as required under “Recertification Requirement #2” above.
  4. Document and attest to having completed at least 36 CPE requirements as required under “Recertification Requirement #3” above.

The specifics of each of these four areas are detailed in the pages below. Note that the individual certificate holder is responsible for maintaining the documentation that establishes their compliance with items (3) and (4) above. The certificate holder will not be required to produce this documentation for review by the Board unless specifically requested by the re-certification audit and compliance committee.

All certificate holders who are compliant with the above four requirements are granted the privilege of using the “DFCP” moniker and emblem as an indication of professional achievement in the field of digital forensics.

DFCB Board Oversight:

The Executive Board reserves the right to review at its discretion and on-demand the supporting documents maintained by certificate holders that substantiate their compliance with the re-certification
process described above.

Failure to comply with these requirements will result in the suspension of the certification until such time as the Executive Board is satisfied that the process of reinstatement has been completed to the specifications described above. The reinstatement process is discussed on the last page of this document.

The Executive Board also reserves the right to establish a renewal date by which all re-certifications must be submitted and current.

Policy Parameter Definitions:
  • CPE: One CPE credit is the equivalent of one hour of professional development. Fractional accumulations of CPE credit hours are permitted where necessary.
  • Membership Fees: Membership fees are set by the Executive Board. As of 2011 annual dues are $40 and due during the Month of January. The January payment covers membership fees for the remainder of that calendar year.
  • Recertification Fees: There are no re-certification fees
  • Personal Attestation:  It is the desire of the DFCB board to keep the paperwork associated with the re-certification process to a minimum. As a result, certificate holders will be asked to attest to their active participation in the field and compliance with the 36 CPE credits without direct oversight by the Executive Board. This approach is also designed to compensate for those situations where the re-certification requirements would require the disclosure of classified information and/or information covered by nondisclosure agreements.
Re-certification Requirement #1: Lapse Less Than a 1 Year:

If the holder of a DFCB Certification allows his/her certification currency to lapse, the lapse can be no more than 1 year.

Re-certification Requirement #2: Membership Fees Must Be Current:

There are no fees directly associated with the re-certification process. There are no charges or fees that the certificate holder must pay to become re-certified. Membership fees are required on an annual basis and must be paid during the month of January. Annual membership fees are $40. Dues are delinquent after March 31. All fees are non-refundable once paid.

Re-certification Requirement #3: Active Participation In The Field:

To standardize the re-certification process the Executive Board will provide a spreadsheet that certificate holders can download from the DFCB Web site that can be used to calculate if the hours of experience accumulated over the past 36 months to meet the requirements of this section.

The certificate holder must personally attest that their experience in the fields of Digital Forensics and/or eDiscovery (over the last 36 months) qualifies under one or more of the following three categories:

  1. Over the last 36 months the certificate holder has accumulated at least 48 hours performing digital acquisitions and 144 hours analyzing digital evidence. Analysis includes but is not limited to forensic assessments, research, report writing, case management, testimony and briefings conducted. 192 hours in total are required to satisfy this requirement at the 100% level.1
  2. Over the last 36 months the certificate holder has directly supervised at least 96 hours of digital acquisitions and 288 hours analyzing digital evidence. Hours accumulated in this category can be acquired concurrently during the supervision of multiple staff. Supervisory analysis includes but is not limited to creating action plans, monitoring project goals and deliverables, monitoring employee performance, supervising forensic assessments, research, report writing, case management, testimony and briefings conducted. . 384 hours in total are required to satisfy this requirement at the 100% level.2
  3. Over the last 36 months the certificate holder has spent at least 96 hours in a classroom environment instructing formal training classes on topics related to digital forensics or eDiscovery. 96 hours in total are required to satisfy this requirement at the 100% level. 3
  4. If certificate holders are aware that they will be unable to accumulate the “experience” hours required during the 36 month re-certification period they can substitute the time lacking with hours spend developing a “test” case image that other DCFB members can use for training purposes. The time spent developing these test case(s) should be approximately equal to the time they were not able to
    accumulate under the experience hours. Certificate holders will be required to submit their test case images to the re-certification committee, along with a description of the case and a list of items that should be discovered by the analyst during their examination. Once the test case is accepted by the re-certification committee and approved by the Executive Board the hours spent creating the test case images(s) will be applied as “experience” hours.
  5. The DFCB Executive Board recognizes that it cannot realistically anticipate all the different job responsibilities that a certificate holder may have in the area of digital evidence or eDiscovery. It further realizes that a certificate holder may be actively involved in the practice of digital evidence or eDiscovery that may not fall within the work “experience” parameters outlined above. If a certificate holder believes that their work “experiences” are unique and not a currently recognized category of “experiences” they may petition the re-certification committee for consideration and request that their unique work “experiences” be applied towards their re-certification requirements. Such petitions must be in writing and filed with the re-certification committee at least six months prior to the end of the certificate holder’s 36 month re-certification period. The re-certification committee will review all such petitions within 45 days of filing and issue a finding within 60 days of such filing. Findings approved by the Board will allow the petitioner to apply their unique “experiences” as qualifying hours for the current 36 month re-certification period, as well as all future re-certification periods.”

Satisfying the requirements of the above five categories can be completed by partially satisfying the hours required in each category as long as the total hours accumulated represent 100%. For example, a
certificate holder may accumulate the following: 9.6 hours of individual acquisitions, 28.8 hours of individual analysis, 19.2 hours of supervised acquisitions, 57.6 hours of supervised analysis and 19.2 hours of classroom training.

Breaking these hours into a percentage of required hours results in: (9.6 / 48 = 20%), (28.8 / 144 = 20%), (19.2 / 96 = 20%), (57.6 / 288 = 20%) and (19.2 /96 = 20%). Since the percentages add up to 100% the
certificate holder has demonstrated that he/she is an active participant in the digital forensics arena by partially satisfying each of the three experience categories.

Re-certification Requirement #4: Accumulation Of 36 CPE Credits:

To standardize the re-certification process the Executive Board will provide a spreadsheet that certificate holders can download from the DFCB Web site and use to track the CPE credits they have accumulated
over the past 36 months.

In addition to the above professional experience requirements the certificate holder must be able to demonstrate that they have earned at least 36 CPE credit hours over the last 36 months by any combination of the following:

  • One CPE credit for each hour of training attended in the Digital Forensics or eDiscovery field, subject to the review and approval of the Re-certification Committee and the Executive Board. Training may
    include;

    • Attendance at Digital Forensics or eDiscovery conferences or seminars regularly associated with the field such as but not limited to: HTCIA, ISSA, CEIC, LegalTech, DOJ CyberCrime and conferences hosted by forensic vendors.
    • Attendance at formal training classes in the Digital Forensics or eDiscovery field such as but not limited to: SEARCH, National White Collar Crime Center, Local, Federal or State sponsored training for Law Enforcement or Private Investigators.
    • Attendance at formal training classes in the Digital Forensics or eDiscovery field such as but not limited to: SEARCH, National White Collar Crime Center, Local, Federal or State sponsored training for Law Enforcement or Private Investigators.
    • Completion of on-line training courses or seminars relevant to the field.
  • 72 CPE credits for being the primary author of a new book published by a recognized publisher that furthers the literature in the field of digital forensics. The 36 credits which are not required for this period’s certification carry-over into to the next 36 month re-certification cycle.
  • 36 CPE credits for being the co-author of a new book published by a recognized publisher that furthers the literature in the field of digital forensics.
  • 36 CPE credits for participation in a DCFB research project involving 3-5 members and which produces a relevant research paper or technical article of at least 20 pages (12 pt) on a topic relevant to Digital Forensics or eDiscovery matters.
  • 36 CPE credits for successfully completing a formal college course related to digital forensic taught on a semester level basis.4 Certificate holder must be able to demonstrate that he/she received a “B” or better in the course.
  • 18 CPE credits for successfully completing a formal college course related to digital forensic taught at the quarter level basis.5 Certificate holder must be able to demonstrate that he/she received a “B” or better in the course.
  • 18 CPE credits for participation in a DCFB research paper or technical article involving 3-5 members and which produces a relevant research paper of at least 10 pages (12 pt) on a topic relevant to Digital Forensics or eDiscovery matters.
  • 8 CPE credits for being the sole author of an article published in a peer reviewed journal that furthers the literature in the field of digital forensics.
  • 4 CPE credits for being the co-author of an article published in a peer reviewed journal that furthers the literature in the field of digital forensics.
  • One CPE credits for each hour of instruction provided to practitioners in the field on topics relevant to Digital Forensics or eDiscovery.
  • One CPE credits for each hour of instruction development in the field on topics relevant to Digital Forensics or eDiscovery.
  • One CPE for every hour of testimony or deposition on Digital Forensic or eDiscovery matters.
  • One CPE credit for each hour of participation on a DFCB committee.
  • 0.25 CPE credits for every 15 minutes a certificate holder participates as a listener in a podcast event related to the field of digital forensics.
Reinstatement Policy

If the holder of a DFCB Certification allows his/her certification currency to lapse, he/she must satisfy the following requirements to reinstate it:

  1. The lapse can be no more than 1 year.
  2. Bring their membership fees, from the last point in time when their dues were current, to the current time period where reinstatement is being requested from the Executive Board.6
  3. Document and attest to having currency in the field over the preceding 36 months as required under “Re-certification Requirement #2” above.
  4. Document and attest to having completed at least 36 CPE requirements as required under “Re-certification Requirement #3” above.

Once the reinstatement requirements are met and the Board has no objections, the holder of a DFCB Certification is deemed re-certified and may again exercise the privileges and responsibilities of the DFCB certification.

If all of the requirements are not met the individual must pay the registration fee and begin the certification process over again.

____________________________________________________

1 Assume 8 cases every two years as an average for most practitioners. Further assume that an average case lasts three days, of which 25% of the time is spent performing digital acquisitions at some level and 75% is spent performing some form of forensic analysis or case management. The numbers provided are then based on: 8 cases x 3 days x 8 hours per day = 192 hours, 192 x 25% = 48 hours, 192 x 75% = 144 hours. 

2 Assumes that the supervisor is supervising at least two staff members. As a result, the hours required are two times greater than that of the individual practitioner.

3 Informal briefings do not qualify as formal training sessions. Assumes that the training class instructed lasted 3 days with 8 hours of scheduled training per day and the training is conducted once every 6 months. The numbers provided are based on: 4 courses over two years x 3 days each x 8 hours per day = 96 hours.

4 Assumes course meets 3 times a week for 16 weeks.

5 Assumes course meets 3 times a week for 16 weeks.

6 Example: If a member lets their membership dues lapse for two years and in Feb. of the third year requests reinstatement from the Board, that individual will be required to pay the fees for the last two years as well as the current year.

RE-CERTIFICATION  SUBMISSION FILE