INE has launched a rebuilt Certified Digital Forensics Professional (eCDFP) certification and a revised seven-course learning path. Available from October 28, 2026, the update focuses on investigating cases from evidence collection through analysis, timeline reconstruction and reporting.
Six Areas of Forensic Investigation
The current eCDFP certification page sets out six domains. Endpoint investigation carries the largest weighting, with Windows as the main focus and Linux essentials included for enterprise incident response.
The table uses shortened topic labels; consult INE’s page for the full objectives.
| Topic area | Weight |
|---|---|
| Evidence scope and defensibility | 15% |
| Collection, triage and validation | 20% |
| Windows and Linux endpoint investigation | 25% |
| Storage, recovery and anti-forensics | 15% |
| Network and log analysis | 15% |
| Timelines, reporting and case closure | 10% |
A Rebuilt Seven-Course Learning Path
In its October 28 announcement, INE describes a vendor-neutral approach covering the full investigative workflow rather than proficiency with one forensic product.
The revised Digital Forensics Professional path covers acquisition, Windows endpoint and application artifacts, storage and file systems, memory analysis, network forensics, logs and Linux essentials. Timeline construction, reporting and capstone investigations bring those skills together.
INE emphasizes preserving evidence integrity, reconciling timestamps and corroborating findings across different sources. Its stated aim is to prepare practitioners to explain both their conclusions and the limits of the available evidence.
Who This Is For
INE positions eCDFP as a professional-level credential for experienced practitioners. Its intended audience includes:
- Incident Responders responsible for evidence collection and forensic investigations.
- SOC Analysts, particularly Tier 2/3 practitioners, moving deeper into forensic analysis.
The announcement also identifies forensic examiners, response leads, threat hunters, detection engineers and security consultants as relevant audiences. These are audience descriptions, rather than a stated requirement to hold a particular job title.
What Candidates Should Check
INE lists a standalone exam voucher and recommends INE Premium for the learning path. Candidates should review the current voucher and training options before purchasing.
If you already have eCDFP study materials, compare them with the six current domains and objectives before planning your preparation. Use the updated outline to identify which investigation skills need further practice.
