Scenario Overview

In the CFME Practical Phase, you will take on the role of a forensic examiner working on two items seized during the investigation of an intellectual property theft.
Please use the below link to download the Certification Files.  These files are similar to the ones used during the MFSC-101 and MFSC-201 courses but contain additional information that will help you in the scenario.  It is recommended that you download a new copy of these images for the Practical Examination. Download all of the class files and review them before proceeding to the examination questions.

Practical Examination Files

Responsive HTML Table

Two disk images will be used for the practical exam. Ensure the downloaded copy has a matching hash value before locking the image and proceeding to the exam.

File Name File Size MD5 Hash
Alex_Macbook.dmg.zip 3.01 GB 1a23d548947fc76c6a74bb0160448de2
Jordan_Blake_iMac.dmg 37.22 GB 6fed986a11064ca176e7fb286f102fa7
Scroll to Top