Certifications for forensics

Sudha,

This may help you...http//www.lmgtfy.com/?q=forensics+certifications

magicm wrote
This may help you… http//www.lmgtfy.com?q=forensics+certifications

Humm well thanks for the Google advise roll

Sudha wrote
What are all the certifications available for Forensics GCFA is one.Also plz let me know where do and how do i obtain the training material for the same.

But it would be grate full if u can help me with what i wrote previously!

I cant register for an examination just by looking at the contents of the exam…it would be helpful if i get some material even before i register for the exam.. if their is a way!!!

Sudha wrote
Can i take up the exam without the training (i mean just with self study)

Please suggest for this as well if there are any worth full certifications which i can take up online!!

Thanks in Advance
Sudha

Thanks in advance
wink

Since you are using FTK, you might start with the ACE.

sudha,

Knowing how to search for information, be it Google, log files or free space on a HDD, is a crucial element of forensics.

Additionally our industry changes so fast the only real way to keep up with it is combing not just others in the industry, but the whole web.

In my opinion, it is highly beneficial to learn how to search the web well.

magicm wrote
This may help you… http//www.lmgtfy.com?q=forensics+certifications

Humm well thanks for the Google advise roll

As for certification, I second the notion to get a vendor certification for the product you use, FTK in your case, for starters.

I think that Sudha's question is not so much what is out there, but more which certs are worthwhile.

You should ideally have a vendor neutral cert to show you have a solid grounding in CF. If you're law enforcement, the gold standard is CFCE from IACIS. If you are not in law enforcement, the next best thing imho is the CCE. CCE was created by John Mellon, an IACIS member who helped develop a lot of the core certification material a while back. From those I know who have both the CFCE and the CCE, they say that the standard of the CCE is good, albeit not as extensive and it's similar in style to CFCE.

Additionally, if you are starting out, it helps to have a cert for the tool you use, whether it's ACE for FTK users, or EnCE for EnCase users. The cert can make up for a lack of experience when you are asked to prove you know how to use the tool. Personally, I can point to years of experience using FTK, so I don't feel the need to get an ACE, but I probably will soon once I get into using FTK2 now that the certification process is free.

I can't speak for the quality of any of the other certs out there.

You might wanna consider CHFI (Computer Hacking Forensic Investigator) at some point. Its a vendor neutral cert provided by EC-Council. The course is pretty intense and walks you through a lot of different tools. You can find the course details here
http//www.eccouncil.org/Course-Outline/CHFI%20Course.htm

Enjoy!

> And also plz let me know the training locations and if it requires practical exams…

All of this is available by checking the SANS web site.

> Can i take up the exam without the training

I did.

> …if you are starting out, it helps to have a cert for the tool you use…

…just my opinion, but I don't agree. If you're "just starting out" and following a process or checklist used with a tool, your organization is doing a disservice to your customer. What I like about material such as what's available from SANS is that it's not based on a bloated commercial product; instead, it requires you to understand what you're doing and why. Once you have that understanding, selecting the proper tool for the job allows you to provide a better product to your customer.

I have my own issues with tool certs, esp in the absence of a vendor neutral cert, however having a tool cert is better than not having one for a new examiner. I'd figure it's always better to have some training on your tools than no training and no experience. Using an examiner with neither training nor experience is doing a disservice to your client. You have to bootstrap somewhere… examiners aren't birthed with the experience and skills needed for this job.

… examiners aren't birthed with the experience and skills needed for this job.

You're right, they're not. But that's why so many academic organizations are creating CF curricula, and why books like WFA 2/e are popular.

But to be honest, with a little effort, one could actually develop quite a bit of skills on their own. Since most folks don't do that, there's also internal training that organizations can employ to "roll their own" examiners.

IMHO, an examiner with no skills and no experience is a known quantity, whereas one with a tool cert presents management with the challenge of "what did you miss?"