Certified Virtualization Forensics Examiner

Our classes are always live and instructor led from our Exton, PA or EPIC Partner locations. Springhouse AnywhereLive options require Internet Access. Select classes are Guaranteed to Run (GTR). View our complete schedule policies.






​This course takes two enormously challenging areas facing IT security professionals today: incidence response and virtualization and attempts to meld these together.  Forensics is at the heart of incidence response, and therefore this training will focus on how to gather evidence relating to an incident – the what, when, where, who and why of an incident – within today's common virtual environments.   Additionally, the course will take a deep dive into the virtual infrastructure, and contrast the various virtual entities against their physical counterparts.  This will allow a clear demonstration of the forensically-relevant differences between the virtual and physical environments.  The course uses a lab-centric, scenario-based approach to demonstrate how to forensically examine relevant components of a virtual infrastructure for specific use cases.

Intended Audience

  • Virtual infrastructure specialists
  • (Architects, engineers,
  • Administrators), Forensic investigators Forensic investigators

At Completion

Students will:

Have knowledge to perform virtualization forensic examinations.

Have knowledge to accurately report on their findings from examinations

Be ready to sit for the C)VFE Exam

  • Participants will be able to apply forensically-sound best practice techniques against virtual infrastructure entities in the following use case scenarios:
  • Identifying direct evidence of a crime
  • Attributing evidence to specific suspects
  • Confirming (or negating) suspect alibis
  • Confirming (or negating) suspect statements
  • Determining (or negating) suspect intent
  • Identifying sources
  • Authenticating documents


  • ​Must have a Digital or Computer Forensics
  • Certification or equivalent knowledge

Exams & Certifications

The Certified Virtualization Forensics Examiner exam is taken online through Mile2's Assessment and Certification System ("MACS"), which is accessible on your mile2.com account. The exam will take 2 hours and consist of 100 multiple choice questions. The cost is $400 USD and must be purchased from Mile2.com.

  • ​Certified Virtualization Forensics Examiner


  • Student Workbook
  • Student Lab Guide

Course Outline

​Module 1 – Digital Forensics – the what, where, when, how and why


Module 2 – Virtual Infrastructure


Module 3 – Forensic Investigation Process


Module 4 – VI Forensics Scenario 1: Identifying direct evidence of a



Module 5 – VI Forensics Scenario 2: Attributing Evidence to Specific



Module 6 – VI Forensics Scenario 3: Confirming (or negating) suspect alibis


Module 7 – VI Forensics Scenario 4: Confirming (or negating) suspect statements


Module 8 – VI Forensics Scenario 5: Determining (or negating) suspect intent


Module 9 -  VI Forensics Scenario 6: Identifying sources


Module 10 – VI Forensics Scenario 7: Authenticating documents


Module 11 – Putting it all together – Course Summary



Certified Virtualization Forensics Examinerhttp://springhouse.com/course-catalog/CVFECertified Virtualization Forensics Examiner

Get More Information




Help us prove you're not a robot:

 ‭(Hidden)‬ Catalog-Item Reuse

Microsoft Gold Partner


AXELOS Limited

The Microsoft Gold CPLS logo is a mark of Microsoft, Inc.

The PMI R.E.P. logo is a mark of the Project Management Institute, Inc.

ITIL® is a registered trade mark of AXELOS Limited.
IT Infrastructure Library® is a registered trade mark of AXELOS Limited
The Swirl logo™ is a registered trade mark of AXELOS Limited
Accredited course material is property of ITSM Academy.

Connect with us

Springhouse Education & Consulting Services

Corporate HQ:Eagleview Corporate Park
707 Eagleview Boulevard
Suite 207
Exton, PA 19341

610-321-3500 - info@springhouse.com