eCDFP practice questions

Q: Is this eCDFP practice test free?

Yes. All 15 eCDFP practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real eCDFP exam cost?

The official price is $450. Cyber VK sells the same official eCDFP voucher for $234.99 — a saving of $215.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real eCDFP exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

Which of the following best describes the primary purpose of calculating a cryptographic hash of a hard drive before and after acquisition?

Accepted Answer

A matching hash value before and after acquisition proves bit-for-bit integrity, showing the image was not modified during the copy. Hashing provides neither compression, encryption, nor file recovery.

Question 2

During a live acquisition, which item should be collected FIRST according to the order of volatility?

Accepted Answer

RFC 3227's order of volatility places CPU registers, cache, and RAM at the top because that data disappears the moment power is lost. Disk logs, network shares, and archived media persist far longer.

Question 3

An examiner images a suspect drive and produces an E01 file rather than a raw dd image. Which capability does the E01 format provide that a raw image does NOT?

Accepted Answer

The EnCase Evidence File (E01) stores case metadata in its header and computes a CRC for each block of data plus a stored hash, enabling detection of localized corruption. Raw images capture all sectors and mount read-only just as well, but carry no internal metadata or integrity structures.

Question 4

In the NTFS file system, which metadata file contains a record for every file and directory on the volume?

Accepted Answer

The Master File Table ($MFT) holds at least one record per file and directory, including the file's attributes and data runs. $Bitmap tracks cluster allocation, $LogFile supports journaling, and $Secure stores security descriptors.

Question 5

An examiner recovers a small text file from an NTFS volume but finds no cluster allocation for its contents. What is the most likely explanation?

Accepted Answer

NTFS stores small files directly inside the 1024-byte MFT record as a resident $DATA attribute, so no external clusters are allocated. Wiping would leave the data runs intact but zeroed, and sparse files still have a defined run list.

Question 6

On an ext4 file system, an examiner needs to determine when a file's inode metadata was last modified as opposed to when its contents changed. Which timestamp should be examined?

Accepted Answer

ctime records the last change to the inode itself, such as permission, ownership, or link-count changes, and it also updates when content changes. mtime reflects only content modification, atime reflects access, and crtime is the ext4 creation time.

Question 7

Which Windows registry hive stores per-user configuration data for the currently logged-on account?

Accepted Answer

HKEY_CURRENT_USER is mapped from the active user's NTUSER.DAT and holds that account's settings. HKLM holds system-wide settings and HKCR is a merged view of file associations.

Question 8

An examiner wants to prove that a specific executable was run on a Windows 10 system, including its run count and last execution time. Which artifact provides this most directly?

Accepted Answer

Windows Prefetch (.pf) files are created on program execution and record the run count along with the last eight execution timestamps. RecentDocs and LNK files evidence document access rather than program execution, and $I30 only tracks directory entries.

Question 9

During analysis of a compromised Windows host, an examiner parses the SYSTEM hive and finds a ShimCache (AppCompatCache) entry for a binary that no longer exists on disk. What can be reliably concluded?

Accepted Answer

ShimCache records metadata when the application compatibility subsystem evaluates a file, which can happen from browsing a directory as well as from execution, so an entry indicates presence and evaluation rather than confirmed execution. The stored timestamp is the file's last-modified time, not the execution time.

Question 10

Which of the following is a primary reason to capture a memory image before shutting down a suspect system?

Accepted Answer

RAM holds volatile artifacts such as cryptographic keys, decrypted data, in-memory-only malware, and live socket state that disappear when the system loses power. Journals live on disk, and memory capture neither decrypts volumes on its own nor confers special admissibility.

Question 11

An analyst runs a Volatility plugin that walks the doubly linked list of EPROCESS structures and separately scans physical memory for process object signatures, then compares the two result sets. What is the analyst most likely attempting to detect?

Accepted Answer

A rootkit using DKOM unlinks the EPROCESS entry from the active process list, so the process appears only in the signature-based pool scan; the discrepancy between list-walking and scanning exposes it. Integrity levels, mapped files, and pool fragmentation are not revealed by this comparison.

Question 12

While examining a memory image, an analyst finds a process whose VAD region is marked PAGE_EXECUTE_READWRITE and is backed by no file on disk. What does this most strongly suggest?

Accepted Answer

Private, unbacked memory that is both writable and executable is the classic signature of code injection or a runtime-unpacked payload, since legitimate modules are image-backed and mapped from a file. Relocated DLLs remain file-backed, and the PEB is not executable.

Question 13

Which practice most directly preserves the chain of custody for seized digital evidence?

Accepted Answer

Chain of custody is established by an unbroken, signed record of who had the evidence, when, and why, which is what allows it to be authenticated in court. Encryption, redundant storage, and working copies are good practices but do not document custody transfers.

Question 14

An examiner's report states that a user "intended to steal company data" based on the presence of files copied to a USB device. What is the principal problem with this statement?

Accepted Answer

Forensic reports must confine conclusions to what the artifacts demonstrate, and file-copy artifacts show actions rather than the actor's state of mind. Attributing intent is an inference for the trier of fact, not the examiner.

Question 15

A defense expert challenges an examiner's findings because a custom Python script was used to parse a proprietary log format, and the script was never independently tested. Under the Daubert standard, which factor is most directly at issue?

Accepted Answer

Daubert evaluates the reliability of the methodology itself, including whether it can be and has been tested, its known error rate, and peer review or general acceptance. Certifications, warrant validity, and discovery timing are separate legal and procedural matters.

eCDFP — INE eCDFP Certified Digital Forensics Professional Exam Voucher | DFIR Certification Practice Test

Free Practice Test

eCDFP practice test — common questions