What would one prefer to do ideally, go in for a product based certification like the EnCE first and then move on to a slightly general one like the CCE or the other way around, and can we use Encase for examining the media given in the CCE practical assessment or we have the choice of using FTK etc. ??
Greetings,
You can use any tools you want for the CCE. I did my CCE first and am about to wrap up my EnCE. My next class is SANS508.
The CCE is a lot cheaper to get. The EnCE might help you a bit more with getting a job, though I did fine with just the CCE.
-David
Don't do what I did.
I in my wisdom decided to sit both exams at the same time, I passed both written and then realised how much work I had to do in the next few weeks.
Thankfully I passed both, but I am sure I didn't celebrate I just slept !!!!!!!
Mitch
Mitch & David
Would you mind sharing what materials you used to prepare for the CCE? I'm just starting to consider this cert and could some input on how to go about self-training.
Thanks.
My two cents worth… wink
The CCE is less expensive and–considering my observations of fellow examiners studying for months and monthsfor the EnCE–takes less time to obtain. If you are not familiar with EnCase and examinations, in general, I would recommend using FTK, initially, and picking up on EnCase, later.
Greetings,
I took a CCE "bootcamp" which probably wasn't necessary in retrospect but wasn't a waste of time, either. I'd also read Carrier's _File System Forensics_, Carvey's _Windows Forensic Analysis_, and some other books.
The CCE definitely takes less time to obtain. I'm about to start on my EnCE practical and to get to this point I took Guidance's CF I, II, and EnCE Prep. The courses didn't teach me anything new about forensics but I learned a lot about EnCase's fairly complicated GUI. I have the EnCE Study Guide and, while I've not read it, I suspect I could have used it instead of the classes.
I have a Guidance Passport which is a very good value if you plan on taking more than two Guidance classes. It allows you to take as many classes as you want over the course of a year. I've met people who live near a training facility and have taken some classes several times.
If you're trying to save money, and you're at all technically adept, I'd start with X-Ways rather than FTK or EnCase. It is only $800 (I think) and is quite powerful. FTK has a much better interface but the environment required to run FTK 2.x is more complex than what's required for EnCase. I also find FTK to still be more buggy than EnCase, but I may be overly sensitive after going through the whole FTK 2.0 fiasco.
-David
I've met people who live near a training facility and have taken some classes several times.
Heh, I would be one of those people (I lived at a training facility for a couple of months P ).
In regards to the EnCE, the Guidance classes would depend on your skill level. If you are new to forensics, then doing CF 1 and 2 along with the Prep class would be ideal as kovar said. However, if you've already passed the CCE, you could probably survive with the EnCE book and the Prep class and pass.
I can't really give an opinion on my experience with the EnCE, because by the time I took the prep class I had already taken 5 or 6 Guidance Classes, so I knew the software pretty well.
Tom
On a side note, if you decide on the EnCE, get the annual Passport. Although it might be a bit more than the price of two classes, it allows you to do an "all-you-can-eat" of any and all EnCase classes for 12 months. It is a no brainer to get extra training for a fraction of the price.
Just a note to say AccessData has an All Access Pass option. Which is basically the cost of 2 classes. I bought it and used it to take the bootcamp, Macintosh forensic, applied decryption, mobile phone examiner, Internet, Windows Registry, XP, Vista, etc this year. You can take classes live online or travel to class. I do not know if the AAP will allow you to take the upcoming product neutral training they are about to do. If it does that would be a very good deal, but you'll end up in class at least 1 week a month. http//
The latest FTK v2.2.1 runs very good especially when you compare it with v2, but EnCase had bug problems in the initial release of v6. I recently took the AD Mac forensic class and we were using the beta v3.
For my EnCE training I am using the online courses 1 & 2 and the study guide book. What I do like about the EnCase setup is that they give you a dongle for a full working version of EnCase while you are leaning so you can do billable work to hopefully pay the training fees while prepping. I spoke to my FTK rep last week about doing the same thing and he said they don't do that.
I am taking the CCE book camp and exam this fall (would take sooner but have to travel to a location - to bad New York City is not a big enough town to get a bootcamp).
Next winter start down the SANS path.
As good as all this training is and the benefit it can have when getting jobs or impressing clients - the important thing to do is independent research and testing to see what processes, tools and methods fits your personality. The examiner takes the stand; not his or her CV, software or tools.