CCE Study Guide 2026
Everything you need to pass the CCE exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 CCE Exam Format at a Glance
📚 CCE Topics to Study (21)
✍️ Sample CCE Questions & Answers
1. Which mobile device extraction method provides the most comprehensive forensic data, including deleted files and unallocated space?
Physical extraction creates a bit-by-bit copy of the entire device storage, including deleted data and unallocated space, making it the most comprehensive method.
2. What does JTAG stand for in the context of mobile device forensics?
JTAG stands for Joint Test Action Group, an industry standard hardware interface originally for circuit testing that forensic examiners use to access device memory directly through test ports.
3. Which layer of the OSI model do MAC addresses belong to, and why is this relevant to network forensics?
MAC addresses operate at Layer 2 (Data Link) and can help investigators identify specific network interface cards involved in an incident.
4. Which file system is commonly used by Windows operating systems?
NTFS (New Technology File System) is the default and most commonly used file system for Microsoft Windows operating systems. It offers advanced features compared to older file systems, including improved security, journaling for data integrity, support for large files and volumes, and robust data recovery capabilities.
5. What is the main purpose of journaling in a file system?
The main purpose of journaling in a file system is to maintain file system integrity, especially after unexpected system crashes or power failures. By logging changes to be made to the file system in a separate journal before committing them, the system can quickly recover to a consistent state, preventing data corruption and ensuring reliability.
6. What types of information can be recovered from a mobile device's GPS and location-related artifacts during a forensic examination?
Mobile devices accumulate rich historical location data across multiple artifact types including GPS logs, geotagged photo EXIF data, cached map tiles, and location-aware application databases.