Notifications
Clear all

EnCE Cert Question

12 Posts
9 Users
0 Likes
977 Views
(@java1988)
Posts: 3
New Member
Topic starter
 

Hi, I was wondering if anyone could give advice on how Guidance software likes their reports to be formatted. I recently failed the phase 2 of the exam which was a surprise to me because I felt like locating the evidence was really not that difficult…. so really I can not account for anything I did wrong there. The report itself was also proofread several times for any grammar mistakes, which leads me to believe it has to be the format and the amount of technical information I chose to include to give verification to my answers. So it is either i got deducted points for giving simplification to answers, or, and I do not in want to put down the "certification coordinators / Guidance Software" in anyway, but is it possible the people grading the test ONLY want a simplified version of findings. I only say this because the questions on the report really seemed a bit … simplified….Of course with their 0 feedback rule I have no way to know this for sure.

OK rant over… So I guess my question is do they want simple or just the data dump that the encase software spits out.

Thank You for any responses.

 
Posted : 31/10/2011 9:04 pm
Fab4
 Fab4
(@fab4)
Posts: 173
Estimable Member
 

As an EnCE, my thoughts are that they require you to create bookmarks and the like to produce your findings and notes bookmarks to wrap your discussions around your findings. Then use the reporting functionality within the software.

 
Posted : 31/10/2011 11:03 pm
(@java1988)
Posts: 3
New Member
Topic starter
 

Thank You for your thoughts, I do feel for the most part that is how I approached documenting my findings, but thank you, I will try to concentrate on learning more about encase reporting. Is it plausible to lose points for including other information that was not specifically asked for. For instance (without getting into any specifics about the test) if I am told to document a file and I see it relevant to also document dates or maybe a corresponding link file that ties into an explanation of findings. The reason I ask is the phase 2 test outline seemed a bit on the authoritarian side a bit over the top with the "my way or highway" routine as oppose to something like the CCE certification offers.

 
Posted : 01/11/2011 12:14 am
 96hz
(@96hz)
Posts: 143
Estimable Member
 

Commenting purely on the formatting, you can export all of your bookmarks and notes into (a very large) RTF file which you can then format in a word processor of your choice. If you create a bookmark folder per question (it may even tell you to do that ?) I don't think you can go far wrong. I think it makes sense to tackle it as a series of questions and not as producing a final report as you would for work.

I seem to remember some questions being very direct as to what was specifically required and others were more general. If the question is direct bookmarking or discussing lots of extra things may not demonstrate that you understand what is being in asked, and could foreseeabley lose you marks.

Good luck second time round

 
Posted : 01/11/2011 1:34 am
(@java1988)
Posts: 3
New Member
Topic starter
 

Thanks guys for the feedback it makes sense when put in context of what your saying. Not trying to bash the EnCE test process its a good cert in its own way, just a bit annoying when you look back at a test and think "what would I change" and the answer is not a *darn thing.. ? ha

 
Posted : 01/11/2011 3:52 am
(@miket065)
Posts: 187
Estimable Member
 

Some of questions in phase 2 wanted them answered in very specific ways as stated on the exam. If you deviated from that, you may have been dinged.

 
Posted : 01/11/2011 5:04 am
Fab4
 Fab4
(@fab4)
Posts: 173
Estimable Member
 

Commenting purely on the formatting, you can export all of your bookmarks and notes into (a very large) RTF file which you can then format in a word processor of your choice. If you create a bookmark folder per question (it may even tell you to do that ?) I don't think you can go far wrong. I think it makes sense to tackle it as a series of questions and not as producing a final report as you would for work.

I seem to remember some questions being very direct as to what was specifically required and others were more general. If the question is direct bookmarking or discussing lots of extra things may not demonstrate that you understand what is being in asked, and could foreseeabley lose you marks.

Spot on.

 
Posted : 01/11/2011 1:50 pm
(@nbartosch)
Posts: 2
New Member
 

NOTE Removing to stay compliant with EnCE Guidelines.

 
Posted : 01/11/2012 7:04 am
(@armresl)
Posts: 1011
Noble Member
 

I don't think you'll hear from Java (I could be wrong, and if so sorry). But I believe he only joined to get in about the test because his 3 posts are all about the test and then he doesn't post anything.

Lots of people hit and run on posts about an issue they are having and are never heard from again.

Please if you find an answer, post it for others to see as maybe they have the same issues.

Thanks for posting.

Java - I recently (just got my results today, ironically a year from yours) and I also failed phase II. Did you ever pass the second time around? What did you end up doing differently or changing? I, like you, felt like I found and detailed my findings extremely well, so I'm a bit confused here.

Feel free to message me if you'd like. oops

 
Posted : 02/11/2012 1:23 am
(@mitch)
Posts: 135
Estimable Member
 

Hi all

As a EnCE holder, and all EnCE's will know we are unable to discuss the exam.

I believe that the EnCE is a qualification that if awarded to you, shows not only your expertise within digital forensics but also the use of the application.

It is not a easy exam to pass at all,and I have been asked personally on numerous of occasions for help, I politely refuse.

I feel that this should be the response from every holder of the certificate.

Sorry for being a ****** but companies / individuals spend a fortune upon the courses, time, learning and development.

 
Posted : 07/11/2012 6:35 am
Page 1 / 2
Share: