Question 1

I.  Pre-Examination Procedures

Accepted Answer

• Knowledge of rules of evidence and the IACIS Code of Ethics and Professional Conduct as applicable to computer forensics.
 • Knowledge of proper computer search and seizure methodologies to include photographic and documentation procedures.
 • Ability to explain on-scene actions taken for the preservation of physical and volatile digital evidence, including the proper handling of mobile phones.
 • Ability to establish, maintain and document a forensically sound examination environment.

Question 2

II. Computer Fundamentals

Accepted Answer

• Recognize and understand the evidential potential of various computer hardware and small-scale devices.
 • Understand the BIOS, UEFI and Boot sequence.
 • Understand binary, decimal and hexadecimal numbering systems include bits, bytes and nibbles.
 • Knowledge of sectors, clusters, volumes and file slack.
 • Understand the difference between logical and physical drives.
 • Understand the difference between logical and physical files.
 • Knowledge of what happens when media is formatted.

Question 3

III. Partition Schemes

Accepted Answer

• Ability to identify current partition schemes.
 • Knowledge of individual structures and system areas used by different partition schemes.
 • Understand that partition schemes can be used with different file systems and operating systems.
 • Understand the difference between a primary and extended partition.
 • Define Globally Unique Identifier (GUID) and explain its application.

Question 4

IV. File Systems

Accepted Answer

• Understand file system concepts and system files.
 • Understand the structure of FAT directory entries.
 • Understand the structure of exFAT directory entries.
 • Ability to distinguish, examine, analyse, and parse the contents of the NTFS master file table, including the Standard Information, File Name and Data attributes.
 • Knowledge of deleted/orphaned files including how they are identified in their respective file entries.
 • Be able to identify file systems used by Apple and Linux.

Question 5

V. Data Recovery

Accepted Answer

• Understand hashing and hash sets.
 • Ability to generate and validate forensically sterile media.
 • Ability to generate and validate a forensic image of media.
 • Ability to capture data from Random Access Memory.
 • Understand file headers.
 • Understand file fragmentation.
 • Ability to extract file metadata from common file types.
 • Ability to extract data from compound files.
 • Knowledge of encrypted files/media and strategies for recovery.
 • Knowledge of Internet and Browser artifacts.
 • Understand Cloud storage and how to obtain the data.

Question 6

VI. Windows Artifacts

Accepted Answer

• Knowledge of the locations of common Windows artifacts.
 • Understand the purpose and structure of the component files that create the Windows registry.
 • Be able to identify and extract specific data from the registry.
 • Be able to analyze the Recycle Bin.
 • Be able to analyze the Windows thumbcaches.
 • Be able to analyze Shell Link files and Jump lists.
 • Be able to extract and examine Event Logs.
 • Understand the importance of volume shadow copy services.
 • Ability to locate, mount and examine virtual drive files.
 • Understand the Swap and Hibernation files and the evidence they may contain.

Question 7

VII. Presentation of Findings

Accepted Answer

• Ability to draw sound conclusions based on examination findings.
 • Be able to report findings using industry standard/technically accurate terminology.
 • Ability to explain complex technical concepts or processes in terms easily understood by non-technical people.

Detailed Content of the BCFE Course
'Basic Computer Forensic Examiner'
Budapest (Hungary) 2026
12-23 October

List of Topics scheduled for the IACIS BCFE Class

Quick Links

Partnerships

GDPR

Contact Info

Detailed Content of the BCFE Course 'Basic Computer Forensic Examiner' Budapest (Hungary) 2026 12-23 October