The ECFE is comprised of two phases.

Phase 1 is an online multiple choice exam that tests the theories and subjects of computer forensics as outlined in the ECFE CBK. The current version is 125 questions in length. The exam lasts 2 hours,
notes are not allowed. An 80% is required to pass the exam. ECFE
candidates must complete Phase 1 in order to proceed to Phase 2.

Phase 2 is a take home practical, where the person attemping certification must perform a practical exam. The practical exam is an examination of a forensics case. A report must be submitted
within 60 days to an ECFE Exam Administrator.

Answers to common questions:
Persons that fail to complete Phase 2 within 60 days fail the
certification attempt. Persons that fail Phase 2 may opt for a
single retake exam of Phase 2. If the retake of Phase 2 is failed,
the certification process must be restarted from Phase 1.

The ECFE Phase 1 can be taken at any Accredited Training Center (ATC), or at any Prometric exam location world wide.