±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 4
Overall: 27389
Visitors: 44

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

EnCE Cert Question

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

EnCE Cert Question

Post Posted: Mon Oct 31, 2011 11:04 am

Hi, I was wondering if anyone could give advice on how Guidance software likes their reports to be formatted. I recently failed the phase 2 of the exam which was a surprise to me because I felt like locating the evidence was really not that difficult.... so really I can not account for anything I did wrong there. The report itself was also proofread several times for any grammar mistakes, which leads me to believe it has to be the format and the amount of technical information I chose to include to give verification to my answers. So it is either i got deducted points for giving simplification to answers, or, and I do not in want to put down the "certification coordinators / Guidance Software" in anyway, but is it possible the people grading the test ONLY want a simplified version of findings. I only say this because the questions on the report really seemed a bit ... simplified....Of course with their 0 feedback rule I have no way to know this for sure.

OK rant over... So I guess my question is do they want simple or just the data dump that the encase software spits out.

Thank You for any responses.  

Java1988
Newbie
 
 
  

Re: EnCE Cert Question

Post Posted: Mon Oct 31, 2011 1:03 pm

As an EnCE, my thoughts are that they require you to create bookmarks and the like to produce your findings and notes bookmarks to wrap your discussions around your findings. Then use the reporting functionality within the software.  

Fab4
Senior Member
 
 
  

Re: EnCE Cert Question

Post Posted: Mon Oct 31, 2011 2:14 pm

Thank You for your thoughts, I do feel for the most part that is how I approached documenting my findings, but thank you, I will try to concentrate on learning more about encase reporting. Is it plausible to lose points for including other information that was not specifically asked for. For instance (without getting into any specifics about the test) if I am told to document a file and I see it relevant to also document dates or maybe a corresponding link file that ties into an explanation of findings. The reason I ask is the phase 2 test outline seemed a bit on the authoritarian side a bit over the top with the "my way or highway" routine as oppose to something like the CCE certification offers.  

Java1988
Newbie
 
 
  

Re: EnCE Cert Question

Post Posted: Mon Oct 31, 2011 3:34 pm

Commenting purely on the formatting, you can export all of your bookmarks and notes into (a very large) RTF file which you can then format in a word processor of your choice. If you create a bookmark folder per question (it may even tell you to do that ?) I don't think you can go far wrong. I think it makes sense to tackle it as a series of questions and not as producing a final report as you would for work.

I seem to remember some questions being very direct as to what was specifically required and others were more general. If the question is direct bookmarking or discussing lots of extra things may not demonstrate that you understand what is being in asked, and could foreseeabley lose you marks.

Good luck second time round  

96hz
Senior Member
 
 
  

Re: EnCE Cert Question

Post Posted: Mon Oct 31, 2011 5:52 pm

Thanks guys for the feedback it makes sense when put in context of what your saying. Not trying to bash the EnCE test process its a good cert in its own way, just a bit annoying when you look back at a test and think "what would I change" and the answer is not a *darn thing.. Confused ha  

Java1988
Newbie
 
 
  

Re: EnCE Cert Question

Post Posted: Mon Oct 31, 2011 7:04 pm

Some of questions in phase 2 wanted them answered in very specific ways as stated on the exam. If you deviated from that, you may have been dinged.
_________________
Some things you just can't "unsee". 

miket065
Senior Member
 
 
  

Re: EnCE Cert Question

Post Posted: Tue Nov 01, 2011 3:50 am

- 96hz
Commenting purely on the formatting, you can export all of your bookmarks and notes into (a very large) RTF file which you can then format in a word processor of your choice. If you create a bookmark folder per question (it may even tell you to do that ?) I don't think you can go far wrong. I think it makes sense to tackle it as a series of questions and not as producing a final report as you would for work.

I seem to remember some questions being very direct as to what was specifically required and others were more general. If the question is direct bookmarking or discussing lots of extra things may not demonstrate that you understand what is being in asked, and could foreseeabley lose you marks.


Spot on.  

Fab4
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next