CFCE Cheat Sheet 2026: One-Page Review of Must-Know Facts

What This Cheat Sheet Covers (and What It Doesn't)

This page condenses the facts candidates most often need to have at their fingertips: the structure of the certification process, the fee and renewal mechanics, the seven core competency areas, and the rules that govern independent work. It is a reference, not a substitute for study. Think of it as the card you tape above your desk while you work through the real material.

For a deeper plan of attack, pair this sheet with our CFCE study guide, and for detail on each content area see the complete guide to all seven CFCE domains. If you want to test recall against realistic question styles, the CFCE practice test site is built for exactly that.

Identity Check: Certified Forensic Computer Examiner and IACIS

Several credentials in the wider certification world share the same four-letter acronym, which causes real confusion in search results and study forums. The credential covered on this site is the Certified Forensic Computer Examiner, a digital forensics certification administered directly by the International Association of Computer Investigative Specialists (IACIS). Fee schedules, dates, and requirements you find for any other certification using the same letters do not apply here.

If you are still orienting yourself, these background reads clarify terminology: what CFCE stands for and what CFCE certification is.

The Process at a Glance: Four Problems, Practical, Written

The most important thing to internalize is that this is not a single timed exam sitting. It is a staged process with completion windows, and it rewards sustained, methodical work rather than a one-afternoon performance.

1. Four coached, scenario-based peer-review problems. Each allows 30 days. These are examined, written up, and reviewed with coaching feedback.
2. A 30-day hard-drive practical. You analyze an evidence image independently and report your findings.
3. A 100-question written knowledge test. You have a 14-day completion window.

The two final components, the practical and the written test, each require at least 80%. Because these are completion windows rather than a seat-time exam, time management means pacing your examination work and documentation across days, not racing a clock in a testing center. For a frank look at how demanding this is, see how hard the CFCE exam really is.

The Numbers Table: Fees, Windows, Scores

For the fuller money picture, including how the pathways differ, see the CFCE certification cost breakdown. For score thresholds in detail, read exactly what you need to pass, and for scheduling specifics see CFCE testing windows and deadlines.

The Seven Core Competency Areas, Condensed

The seven areas below are IACIS's official core competency areas. They span the whole life of an examination, from handling evidence properly to presenting what you found. The notes under each are the kinds of concepts candidates should be able to explain from memory.

These seven areas are the backbone of everything in the process, from the coached problems to the written test. The full domain-by-domain treatment lives in our domains guide.

Written Test Question Styles

The 100-question written knowledge test mixes several formats, and each rewards a slightly different kind of preparation:

• True/false: Tests precision. A single qualifier can flip the answer, so read carefully.
• Multiple choice: Tests discrimination between plausible options, often distinguishing similar structures or behaviors.
• Matching: Tests whether you can pair terms, structures, or artifacts with their correct descriptions without prompts.
• Short essay and fill-in-the-blank: Tests recall and the ability to articulate a concept in your own words, which is much harder to bluff than recognition.

For how scoring thresholds interact with these formats, see the passing score explainer, and for the data question many candidates ask about, what the pass rate data shows.

Independence, Notarization, and Integrity Rules

This is the part of the process that surprises candidates most. The final certification work, meaning the hard-drive practical and the written test, must be completed independently. You submit a notarized declaration stating that you received no assistance.

That is a meaningful contrast with the earlier phase. The four peer-review problems are coached, so you receive feedback and guidance as you develop your examination and reporting skills. The finals are different: they test what you can do on your own. Treat the coached problems as the place to ask questions, make mistakes, and absorb corrections, because that safety net disappears for the finals.

Eligibility Snapshot for External Candidates

Candidates who come through the external route rather than through IACIS Basic Computer Forensic Examiner (BCFE) training have a few specific boxes to check:

• Document 72 hours of training aligned with the core competencies.
• IACIS membership is not an eligibility requirement.
• Background-check requirements apply, with exceptions for government-employment or clearance situations.
• External cycles begin in March and September.

Candidates who take BCFE training have the initial certification cycle included in course tuition. For a full walk-through of qualifying, read CFCE requirements and how to qualify, and for training options see our overview of CFCE training.

Failure and Retake Rules

The retake policy is compact but unforgiving, so memorize it:

• If you fail one final component, you may retake that component once, at no charge, in the next cycle.
• If you fail both final components, the certification process is failed.

The practical implication is to avoid walking into both finals underprepared and hoping one lands. Because the two components draw on the same seven competency areas but test them differently, a weak spot in something like file system structures can sink both the practical and the written test at once.

Renewal Sheet: The Three-Year Cycle

Earning the credential is not the end of the obligation. Certification must be renewed every three years, and the requirements keep you active in the field rather than simply paying a fee:

Start logging training hours and casework documentation from day one of the cycle, not in year three. A running record is far easier than reconstructing three years of activity under deadline pressure.

Who Hires CFCE Holders

The credential is rooted in the law-enforcement and investigative community, and that heritage shows in where it carries weight. Typical employers and engagements include:

• Law-enforcement agencies running digital forensics units at the local, state, and federal levels.
• Government and military investigative organizations that examine seized media.
• Corporate security and internal investigations teams handling policy violations, theft, and incident response.
• Private forensic consultancies and litigation-support firms serving attorneys in civil and criminal matters.

Because the process stresses defensible methodology, independent examination, and clear reporting, it signals readiness for work that may end up scrutinized in court. To weigh the career side, see CFCE jobs, the CFCE salary guide, and the broader is it worth it ROI analysis.

Sequencing Your Review by Domain

You do not need a generic study system here; you need an order that respects how the domains build on each other. Lower-level structures come first because everything above them depends on them.

The reasoning is simple: you cannot interpret a file system entry if you cannot read the hex beneath it, and you cannot carve files reliably if you do not understand how allocation worked before deletion. Presentation of Findings sits last in the study order but should not be neglected, since it is the thread running through the peer-review problems from the start. Our study guide expands on pacing across the full process.

Frequently Asked Questions

Keep this sheet handy, verify the current cycle details with IACIS before you register, and use targeted practice to turn these facts from things you recognize into things you can recall and apply. For a broader orientation, start with the main CFCE certification overview.