CCE Exam Domains 2026: Complete Guide to All 10 Content Areas

How the CCE Exam Is Actually Structured

Before breaking down the ten content areas, it helps to understand what the Certified Computer Examiner (CCE) credential actually tests. The CCE is administered by the International Society of Forensic Computer Examiners (ISFCE), and its current Exam Process policy describes two distinct pieces: a proctored online component and a set of hands-on practical investigations.

The online component consists of at least 100 randomly generated multiple-choice questions delivered in a 60-minute sitting. ISFCE's Evaluation Standards policy requires this portion to be completed without books, notes, outside assistance, internet sites, or other reference materials - it's a closed-book assessment of foundational knowledge. The policy also permits up to ten experimental questions that are excluded from scoring, which means the exact scored-versus-unscored split delivered to any individual candidate isn't publicly documented.

After the knowledge component, candidates move into three consecutive forensic practical investigations, each requiring a written report. This practical phase is where the ten domains below get applied directly to simulated case evidence rather than tested as abstract trivia.

The 10 CCE Preparation Domains, Explained

ISFCE's current training page organizes CCE preparation into ten modules. These are the content areas most candidates refer to informally as "exam domains," and they're the backbone of this guide. It's worth being precise here: the module count reflects the structure of the issuer's training course, not a confirmed, officially weighted examination blueprint. No dated public exam version or per-topic percentage breakdown has been verified. Treat the list below as the most reliable public map of what you need to know - not as a guarantee of how many points each area is worth on test day.

If you want a condensed, single-page version of these ten areas for last-minute review, the CCE Cheat Sheet 2026: One-Page Review of Must-Know Facts consolidates the highest-value points from each module.

How the Domains Map to MCQ vs. Practical Work

Not every domain shows up the same way in both halves of the exam. The 60-minute online component draws broadly across conceptual knowledge - definitions, process steps, legal context, and file-system theory are well suited to multiple-choice format. The three practical investigations, by contrast, are where imaging, file-system analysis, OS-specific artifact recovery, and report writing get tested through actual simulated evidence.

Scoring, Weighting, and the 80% Average

ISFCE's Exam Process policy specifies equal weighting across four components and requires an overall average of at least 80% to pass. Public policy language also references 75% as a component and retake threshold, alongside a separate rule removing candidates from the practical process below 70% - but the published wording is inconsistent about whether the 75% boundary is inclusive or exclusive. Because of that conflict, candidates should confirm the exact passing boundary and retake treatment directly with ISFCE rather than relying on secondhand interpretations. For a full breakdown of what's confirmed versus what needs verification, see CCE Passing Score 2026: Exactly What You Need to Pass.

Timing also matters beyond the 60-minute sitting itself. The online score carries a 90-day validity window, and candidates who tested after completing training must register to begin certification within 90 days as well. Confirm these windows match your own testing timeline - they are policy-driven deadlines, not flexible suggestions.

Registration, Fees, and Eligibility Routes

ISFCE's indexed store lists a $495 initial exam fee, a $150 retake fee, a $250 two-year recertification fee, and a $250 reinstatement fee. The public materials don't specify a member/non-member price split, so budget around the listed figures rather than assuming a discount tier exists. A full cost breakdown, including how these fees compare across the certification lifecycle, is covered in CCE Certification Cost 2026: Complete Pricing Breakdown.

Eligibility is where candidates most often get tripped up, because ISFCE's own pages describe it two different ways. The certification page lists alternative entry routes through issuer or authorized training, 18 months of verifiable experience, or a board-accepted digital-forensics credential - with full Member status requiring 18 months of experience while Associate status is available without it. The separately linked Exam Process policy instead describes training or a digital-forensics degree combined with 18 months of experience and 40 hours of documented self-study. These two descriptions aren't fully reconcilable from the public text alone, so confirm your specific path with ISFCE before assuming you qualify. Certification also requires a background check, an ethics agreement, a notarized independent-work statement, and board approval. The full eligibility picture, including these inconsistencies, is laid out in CCE Requirements 2026: Eligibility, Prerequisites & How to Qualify.

Who Hires Around These Domains

The ten domains above aren't academic - they map directly to the work digital forensics examiners do in law enforcement, corporate incident response, e-discovery, and litigation support roles. Employers scanning resumes for forensic imaging competence, NTFS and mobile-device analysis skills, or report-writing experience are effectively screening for the same content areas this credential covers. If you're evaluating whether the CCE translates into employer recognition in your target sector, CCE Jobs breaks down the types of roles and hiring contexts where the certification tends to come up, and Is the CCE Certification Worth It? Complete ROI Analysis 2026 weighs the credential against the cost and time investment.

Scheduling Your Domain Review

Because the ten modules build on each other - file-type and file-system knowledge underpins both the Windows and macOS modules, and imaging fundamentals underpin all three practicals - a sequential review schedule tends to work better than jumping around. The timeline below sequences review by dependency rather than by arbitrary difficulty.

Run timed practice sessions that mirror the real 60-minute, no-notes constraint rather than open-book review once you've covered the material once. Pairing content review with full practice exams is the fastest way to find weak domains before test day - our practice test platform lets you drill questions by topic area so you can spend extra reps on whichever module felt shakiest during Week 1 through 4. For a broader first-attempt strategy that goes beyond domain sequencing, see CCE Study Guide 2026: How to Pass on Your First Attempt.

Frequently Asked Questions