Skip to Main Content
A National Cyber Center
Defense Cyber Crime Center - Air Force Office of Special Investigations

DC3

Defense Cyber Crime Center

Air Force Office of Special Investigations

Centers of Digital Forensics Academic Excellence (CDFAE)

Led by the DC3 Academic Cyber Curriculum Alliance (DACCA) Board, the National Centers of Digital Forensics Academic Excellence (CDFAE) program develops a partnership between academia and the government to establish standards and best practices for digital forensics practitioners, educators, and researchers to advance the discipline of digital forensics and increase the number of qualified professionals in the law enforcement, counterintelligence, national defense, and legal communities.

DACCA encourages collaboration between colleges, universities, and institutions of higher learning in an effort to establish and promote a consistent national digital forensics core curriculum.

Contact CDFAE

CDFAE@dc3.mil

CDFAE Designated Schools

For information on how to become a CDFAE Designated School, send an email to CDFAE@dc3.mil.

Students participating in the CDFAE program will graduate with the ability to:

  • Resolve digital forensic problems.
  • Use current techniques, skills, and tools necessary for digital forensic examinations of digital media, files, operating systems, devices, networks, and applications.
  • Design, implement, and evaluate a system, process, component, or program to meet digital forensic needs.
  • Appreciate professional, ethical, legal, security, social, and continuing education and development responsibilities.

How is CDFAE Designed?

CDFAE focuses upon building core knowledge domains at multiple skill and ability levels across the education spectrum. CDFAE designates DoD and federal education organizations, and academia to a digital forensic education standard based upon knowledge, skills, and abilities (KSA) used in the field. It is an objective driven program, which progresses to topic-based research and problem solving. 

The eight knowledge domains represent well-rounded digital forensics education topics and the learning objective levels are indicative elements of those topics. The program must provide structured advanced academic, research, and development capabilities in any or all of the digital forensics knowledge domain areas under the Learning Objective Framework (LOF) at a level appropriate for the current curriculum of participating educational institutes while enhancing and providing supplemental support towards digital forensic objectives. This is accomplished by transitioning general knowledge areas to a specific topic application.

The CDFAE program maps digital forensic knowledge domains to specific learning objectives including practical exercises.

Frequently Asked Questions

Does my institution qualify for CDFAE designation?

The CDFAE program offers designations to accredited academic programs that confer a digital forensics-related degree. To receive CDFAE designation, an institution's accredited academic program must map courses against a common core curriculum.

Why should my institution pursue CDFAE designation?

The United States is in a cybersecurity workforce deficit. More than ever, organizations need to plan for the future as significant shifts in cyber operations accelerate globally. Digital forensics skill sets provide crosscutting application to multiple fields. In its strictest connotation, digital forensics is the application of computer science and investigative procedures involving the examination of digital evidence, including proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatability, reporting, and expert testimony. Beyond traditional legal purposes, the same techniques, scientific rigor, and procedural precision now support the range of military operations and course of action (examples: computer network operations and counterintelligence objectives).

CDFAE serves as a prime avenue for cultivating leaders to meet evolving objectives across the digital forensics and cyber communities, as it is vital to protect, investigate, and serve public, private, and national goals.

What are the benefits to the students?

Based on the individual institution's CDFAE mapping, students will have the opportunity to take two separate exams, including a written exam and a hands-on practical exam. Students who pass both parts of the exam will receive a certificate of completion. Currently, two certifications are available:

  • Cyber Incident Responder (levels 100 and 200)
  • Digital Forensics Examiner (levels 300 and 400)

These Certificates of Completion can be traded in for DCITA's corresponding certifications.

Students who complete the program will:

  • Have a DoD-recognized skill set and awareness of current issues facing digital forensics investigators and examiners.
  • Be valued for their highly desirable and unique skill sets.
  • Be capable of using current techniques, skills, and tools necessary for digital forensic examination of digital media, files, operating systems, devices, networks, and applications for discovery and recovery of evidence.
  • Have the aptitude to design, implement, and evaluate a system, process, component, or program to meet digital forensic needs.
  • Appreciate professional, ethical, legal, security, social, and continuing education and development responsibilities.

What are the benefits to my institution?

Education providers will:

  • Have access to advanced digital forensic resources.
  • Have educators that are recognized as being capable of effectively delivering theory and practicum.
  • Provide students with greater access to unique internship or employment opportunities.

How does CDFAE designation impact employers?

Employers will be able to:

  • Hire employees with a validated skill set capable of being on task on day one.
  • Understand the skills the employees can offer.
  • Diversify geographical hires without compromising quality.

As an employer who may be considering hiring an individual with one or two CDFAE Certificates of Completion, this individual can begin employment on day one with basic to intermediate level abilities. You will not have to send the individual through the required courses at DCITA for him/her to obtain the required certifications.

Your employees can trade in their CDFAE Certificates of Completion for DCITA's corresponding certifications.

What is a CDFAE Certificate of Completion?

After a college or university completes the rigorous application process and becomes a CDFAE Designated School, they are able to provide DC3 Academic Cyber Curriculum Alliance (DACCA) Board designed student testing at the 100-200 level (Cyber Incident Responder), 300-400 level (Digital Forensic Examiner), or both, depending on the designation.

  • The 100-200 level student test is comprised of three parts:
    1. 100 question multiple-choice test
    2. Rebuild a disassembled PC
    3. Successfully image a hard drive in a sound forensic manner
  • The 300-400 level student test is comprised of two parts:
    1. 60 question multiple-choice test
    2. 40 question fill-in-the-blank test pertaining to the forensic examination of a hard drive and thumb drive

If the student has successfully passed either test, or both tests, the student is awarded a Certificate of Completion for Cyber Incident Responder (100-200 level) and/or Digital Forensic Examiner (300-400 level).

 

 

CDFAE Designated School

A college or university completes the rigorous application process and becomes a CDFAE Designated School.

The school provides DCITA/CDFAE designed curriculum and testing on the 100–200 level and/or 300–400 level.

 

Student Testing

The student is offered tests at the corresponding level(s).

The tests are comprised of question and answer and hands-on examinations.

 

Certificate of Completion

If a student passes either the 100–200 level or 300–400 level tests, or both,the student is awarded a Certificate of Completion:

100–200 level = Cyber Incident Responder

300–400 level = Digital Forensic Examiner

 

Certificate Trade-in Program

If a person awarded either Certificate of Completion (or both) is hired as a contractor with a Federal Agency or as a Federal employee, the certificate of completion can be exchanged for DCITA's corresponding certifications.

*Certain time constraints may apply.

DCITA Certification

Certificate Trade-in Program

If a person awarded either certificate of completion is hired as a contractor with a federal agency or as a federal employee within six months of graduation, the certificate of completion can be exchanged for DCITA's corresponding certifications:

  • The CDFAE 100-200 level (Cyber Incident Responder) is equivalent to DCITA's Digital Media Collector (DMC) Certification.
  • The CDFAE 300-400 level (Digital Forensic Examiner) is equivalent to DCITA's Digital Forensic Examiner (DFE) Certification.

If more than six months have passed since graduation, certain other requirements must be met to participate in the Trade-in Program.

  • After six months, the person must provide verification of 40 hours of Continuing Professional Education (CPE) credit in the cyber field.
  • After 12 months, the person must provide verification of 40 hours of CPE credit in the cyber field, plus a proficiency exam.
  • After 24 months, an individual must attend the required training courses at DCITA to obtain the Cyber Incident Responder and/or Digital Forensic Examiner certifications.