- Quick Overview: What This Cheat Sheet Covers
- Exam Format at a Glance
- Fees and Registration Mechanics
- Scoring Thresholds You Must Know
- The Ten Preparation Domains
- Eligibility Paths (and Where Sources Conflict)
- Who Hires CCE Holders
- Final-Week Review Plan Mapped to Domains
- Cheat Sheet Comparison Table
- FAQ
- The online component is 100+ randomly generated MCQs in 60 minutes, closed-book, no outside materials.
- Passing requires an overall average of at least 80% across four equally weighted components.
- Initial exam cost is $495; retake is $150; two-year recertification is $250.
- Three consecutive forensic practical investigations with written reports follow the online test.
Quick Overview: What This Cheat Sheet Covers
This page is a condensed, one-stop reference for candidates sitting the Certified Computer Examiner (CCE) credential administered by ISFCE. It is not a substitute for deep preparation - for that, see the full CCE Study Guide 2026: How to Pass on Your First Attempt - but it pulls together the exam mechanics, fees, scoring rules, and domain list you need to have memorized before exam day. Every fact below traces back to ISFCE's published policy pages; where those pages disagree with each other, that conflict is flagged rather than smoothed over.
If you want a deeper breakdown of any single area, cross-references throughout this page point to dedicated articles on each topic.
Exam Format at a Glance
The CCE certification process has two distinct phases, and confusing them is one of the most common mistakes candidates make.
- Online component: At least 100 randomly generated multiple-choice questions, delivered in a proctored online session, with a 60-minute time limit.
- Practical component: Three consecutive forensic practical investigations, each requiring a written report.
The exact total number of delivered questions isn't published in full detail - the Evaluation Standards policy allows up to ten experimental questions that are excluded from scoring, so the precise scored-versus-unscored split is unverified. Don't assume every question you see counts toward your final score, but also don't try to guess which ones don't.
Practical tool permissions, calculator availability, and whether the test adapts to performance are all currently unverified publicly - plan your practice environment conservatively and confirm specifics directly with ISFCE before test day. For a fuller discussion of how tough this combination of timed MCQs plus hands-on investigations actually is in practice, see How Hard Is the CCE Exam? Complete Difficulty Guide 2026.
Key Takeaway
Separate your prep time into two buckets: fast recall drills for the 60-minute MCQ sitting, and slower, methodical report-writing practice for the three practical investigations. They test different skills.
Fees and Registration Mechanics
Budgeting correctly avoids surprise costs mid-process. ISFCE's indexed store lists the following figures:
- Initial exam: $495
- Retake: $150
- Two-year recertification: $250
- Reinstatement: $250
A member-versus-non-member fee split is not stated in the source material, so don't assume a discount exists until you confirm with ISFCE directly. There's also a timing rule worth memorizing: the online score carries a maximum 90-day validity window, and candidates who test after training must register to begin certification within 90 days of that training. That 90-day figure is a registration and score-validity deadline - it is not the 60-minute online test limit, and it is not a confirmed total duration for completing the full practical process. Mixing those two 90-day-adjacent rules up is an easy way to miss a deadline. For the complete pricing picture including recertification cycles, see CCE Certification Cost 2026: Complete Pricing Breakdown.
Scoring Thresholds You Must Know
Scoring is where candidates most often misremember details, partly because ISFCE's own published policy pages contain an internal inconsistency. Here's what's confirmed:
- The exam has four components, each weighted equally.
- You need an overall average of at least 80% across those four components to pass.
- There is a separate rule removing candidates from the practical process if a score falls below 70% on that component.
Where the policy conflicts: the Exam Process documentation states both "no score 75% or lower" and, elsewhere, "none below 75%" as a component/retake threshold. Those are not the same boundary - one excludes exactly 75%, the other allows it. Because ISFCE's own pages disagree with themselves at this exact point, the safest move is to treat 75% as a line you should clear comfortably rather than skim, and to confirm the precise boundary and retake treatment directly with ISFCE before you rely on it. Full detail on this is covered in CCE Passing Score 2026: Exactly What You Need to Pass, and broader pass/fail context is in CCE Pass Rate 2026: What the Data Shows - note that ISFCE does not publicly disclose an actual pass rate number, so treat any pass-rate claim you see elsewhere with skepticism.
The Ten Preparation Domains
ISFCE's current training page publishes ten modules that structure CCE preparation. These are issuer-course preparation topics - their count of ten does not itself establish an official, exhaustive, or weighted examination blueprint, and no per-topic exam percentages have been verified. Treat the list below as "what to study," not "how points are distributed."
Domain 1: Introduction to Digital Forensics
Foundational terminology, chain of custody, and the overall investigative workflow candidates are expected to know before touching evidence.
- Evidence handling fundamentals
Domain 2: Forensic Imaging
Creating defensible forensic images, verifying hash values, and documenting the imaging process for later report writing.
- Write-blocking and verification practices
Domain 3: File Types and Structures
Recognizing file signatures, container formats, and structural artifacts that reveal more than a file extension alone.
- Signature analysis over trusting extensions
Domain 4: File Systems: FAT, exFAT, Linux, UDF
Understanding how non-NTFS file systems store, delete, and fragment data - common on removable media and mixed-OS cases.
- Deleted-file recovery differences across formats
Domain 5: NTFS File System
Deep knowledge of the Windows-native file system, including metadata structures examiners rely on for timeline reconstruction.
- MFT and metadata artifact interpretation
Domain 6: Windows Forensics
Registry artifacts, event logs, and user-activity traces across Windows versions.
- Registry and log correlation
Domain 7: macOS Forensics
Apple-specific file structures and system artifacts that differ meaningfully from Windows equivalents.
- macOS-specific artifact locations
Domain 8: Mobile Forensics
Extraction and interpretation challenges unique to smartphones and mobile operating systems.
- App data and backup artifact analysis
Domain 9: Email & Cloud Forensics
Tracing communications and cloud-stored evidence, including jurisdictional and access considerations.
- Header analysis and cloud evidence preservation
Domain 10: Legal, Reporting & Ethics
Writing defensible reports, understanding legal standards for evidence, and following ISFCE's ethics requirements.
- Report writing that survives cross-examination
For a far more detailed walkthrough of each area with study strategies specific to every domain, read CCE Exam Domains 2026: Complete Guide to All 10 Content Areas.
Eligibility Paths (and Where Sources Conflict)
ISFCE's certification page and its Exam Process policy describe eligibility slightly differently, so read both carefully rather than relying on a single summary.
- The certification page lists entry through ISFCE/authorized training, 18 months of verifiable experience, or a board-accepted digital-forensics credential. It notes full Member status requires 18 months of experience, while Associate status is available without that experience requirement.
- The linked Exam Process policy instead describes training or a digital-forensics degree, combined with 18 months of experience and 40 hours of documented self-study, together.
These two descriptions do not line up cleanly, and there is no universal "degree required" or fixed "hours required" claim that holds across both documents. Rather than guessing which version applies to your situation, confirm your specific path directly with ISFCE. All candidates must also pass a background check, sign an ethics agreement, submit a notarized independent-work statement, and receive board approval. A complete breakdown of these requirements, including how Associate and Member paths differ, is in CCE Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Key Takeaway
Don't assume a college degree is mandatory for CCE eligibility - the published sources disagree on this point. Verify your specific eligibility route with ISFCE before registering.
Who Hires CCE Holders
CCE-credentialed examiners typically work in digital forensics roles tied to law enforcement support, litigation support, corporate incident response, and independent forensic consulting. Employers generally value the credential because it signals hands-on competency across imaging, file-system analysis, and reporting - not just theoretical knowledge. If you're weighing whether the investment of time and the $495 exam fee (plus ongoing $250 recertification) makes sense for your career stage, the return-on-investment considerations are covered in Is the CCE Certification Worth It? Complete ROI Analysis 2026, and realistic compensation ranges are discussed in CCE Salary Guide 2026: Complete Earnings Analysis. For current openings and how the credential appears in job postings, see CCE Jobs.
Final-Week Review Plan Mapped to Domains
In the days before your 60-minute online sitting, resist the urge to re-read every module cover to cover. Instead, cycle through weak domains using short, timed recall blocks - this mirrors the actual exam's time pressure far better than passive review.
File-System Cluster
- Drill Domain 4 (FAT/exFAT/Linux/UDF) and Domain 5 (NTFS) back-to-back since questions often test contrasts between them
Platform Forensics
- Review Domain 6 (Windows), Domain 7 (macOS), and Domain 8 (Mobile) with timed flashcard-style recall, not re-reading
Imaging, Communications & Ethics
- Revisit Domain 2 (Forensic Imaging), Domain 9 (Email & Cloud), and Domain 10 (Legal, Reporting & Ethics) - these tie directly into the written-report expectations of the practical phase
Full Simulation
- Run a closed-book, timed 60-minute practice set with no notes or outside materials to mimic the real online component, then rest before test day
You can run full-length timed simulations at our CCE practice test platform to get comfortable with the pacing before the real 60-minute window, and a complete week-by-week version of this schedule is laid out in the CCE Study Guide 2026.
Cheat Sheet Comparison Table
| Item | Confirmed Detail |
|---|---|
| Online component | 100+ MCQs, 60 minutes, closed-book, proctored |
| Practical component | 3 consecutive investigations, written reports required |
| Passing average | 80% across four equally weighted components |
| Component/retake boundary | 75% threshold stated inconsistently - confirm with ISFCE |
| Practical removal rule | Below 70% on practical component |
| Initial exam fee | $495 |
| Retake fee | $150 |
| Recertification (2-year) | $250 |
| Reinstatement fee | $250 |
| Score validity window | 90 days (online score, and post-training registration deadline) |
Frequently Asked Questions
The Exam Process policy specifies at least 100 randomly generated multiple-choice questions delivered in a 60-minute proctored online session. An exact total delivered-question count isn't published, and up to ten questions may be experimental and excluded from scoring, so the precise scored/unscored split is unverified.
You need an overall average of at least 80% across four equally weighted components. ISFCE's own policy language is internally inconsistent about whether exactly 75% counts as passing or failing at the component/retake level, and there's a separate rule removing candidates from the practical process below 70%. Confirm the exact 75% boundary with ISFCE directly.
The initial exam fee is $495, a retake costs $150, two-year recertification is $250, and reinstatement is $250. A member-versus-non-member price split is not specified in the published sources.
No. The Evaluation Standards policy requires the timed online component to be completed without books, notes, outside assistance, internet sites, or other materials. Practical-phase tool permissions remain unverified publicly, so confirm those separately with ISFCE.
There are ten published preparation modules in ISFCE's current training course, listed throughout this page. However, that count does not establish an official, weighted, or exhaustive examination blueprint - no per-topic exam percentages have been verified publicly.