The CSX Forensics Analysis Certificate Exam assesses a candidate’s ability to perform basic forensic analysis on a USB drive and recover files related to the given scenario.

This one-hour exam contains no multiple-choice questions or simulations and intentionally restricts access to the internet. Where applicable, man pages and help files are available.

To train for this exam, please see the CSX Forensics Analysis Course.

Continuing Professional Education (CPE) Credit Count: 2 (2 CPEs per examination hour) when a passing score is achieved.

Objectives

Candidates must complete tasks of varying durations with minimal instruction and are expected to:

• Carve files from a USB drive
• Investigate recovered files for incriminating evidence, according to the scenario
• Create a forensics report
• Properly document evidence, procedures, and tools used

Students must be comfortable leveraging the following tools:

• Foremost
• Basic Linux Terminal Commands