Jerry, you have good points about the need for deeper knowledge. If you were to "set the standard" for certifications, what would you like to see in the certification process to ensure people have the greater depth of knowledge?
Now that's a difficult question. From my perspective, along with knowing how to use forensic software and hardware, I'd want to see a depth in not only core computer science, but also include operating systems (and associated administration), exposure to various OO and legacy programming techniques/languages, experience with a wide variety of end-user applications, legal requirements, investigative methodology and at least some knowledge of hacking techniques. And that base of practical and intellectual know-how should be regularly updated with current information and techniques.
I think the CCE and CHFI are both a good aspect. Granted some may view the CCE as higher ranked than the CHFI, its all in the eye of the beholder. What it all boils down to, is can you do the job effectively?
I personally like the way IACIS does their CFCE certification. Not only do you have to manually recover files using Diskedit for the first 4 problems, but they also throw CD's and HD's at you before the 100 question essay test. They really want to make sure you everything down.
Why would the order in which you take the test be important?
How many problems are there total for the CFCE?
Why would the order in which you take the test be important?
How many problems are there total for the CFCE?
I personally like the test at the end. Plus, it's not as easy as a multiple choice. You can actually fail it by not putting enough detail into your answers.
There are 6 problem media's and the test.
That sounds good. CCE has 3 media and the test isn't hard enough, although I suppse one could fail it. They give the test at the beginning, which I tend to prefer because it tells someone if the even have a chance.
That sounds good. CCE has 3 media and the test isn't hard enough, although I suppse one could fail it. They give the test at the beginning, which I tend to prefer because it tells someone if the even have a chance.
I have my CCE and I found that the questions on the test were pretty straight forward and very simple. Although Im hoping at some point they tell you what you could have done better instead of just giving you a score.
I understand why that don't give feedback however. The more information that gets leaked, the less validity there is to the test.
You join the CCE as ,I have recently passed, you become part of a professional network and get offered jobs, you can ask help on cases or simply get to know some names in this small industry! It is well worth it!
Again, that wasn't my intention, so I do apologize. Allow me to eat my foot and say that I think I misrepresented myself with my initial statements.
I don't think you did. I understand what you are saying, and I agree.
The point is that taking a multiple choice test *usually* only proves knowledge, and for those tests that are poorly written, they don't even prove that. However, the CCE's practical portion proves that you can actually do the work.
Think of when you got your drivers license. You passed the written test, that proved you knew the rules of the road, but it did not prove you knew how to drive. For that, you had to pass an actual, practical, driving test.
That is why I prefer the CCE to the other certifications I have gotten. The ACE says that I've passed AccessData's test, but the CCE shows that I can handle an investigation from end to end, from chain of custody to submitting the report.
I don't know the CHFI certification, but I guess which you go for would be Dependant on what you want to do with your career. Do you want to do analysis of disk images, or do you want to defend against hackers? If both sound good to you, do both. It isn't like there is a limit to the number of certifications you can hold.
I have a question Twjolson, you said
"The ACE says that I've passed AccessData's test, but the CCE shows that I can handle an investigation from end to end, from chain of custody to submitting the report."
So, does the CCE say you can handle an investigation from end to end, or does it say that the person or few people who looked at your test results of the supplied sample image/media say that you can handle THAT particular investigation which THEY sent to you.
Let me elaborate. You completed your CCE test and now in your words you can handle an investigation from end to end, from chain of custody to submitting a report. I've got some Lotus/Domino files I need examined off a live server. One drive in the server is SSD (and has some encryption) the other drive is SCSI RAID 6, but there are some errors in obtaining an image. Did the CCE test your ability to work on RAID's as well as encryption or complex email systems?
In reality I can insert lots of different scenarios here and they could easily show how you a few practical exams would not qualify you to be able to handle complex litigation or cases.
I'm interested in your comments please.
Again, that wasn't my intention, so I do apologize. Allow me to eat my foot and say that I think I misrepresented myself with my initial statements.
I don't think you did. I understand what you are saying, and I agree.
The point is that taking a multiple choice test *usually* only proves knowledge, and for those tests that are poorly written, they don't even prove that. However, the CCE's practical portion proves that you can actually do the work.
Think of when you got your drivers license. You passed the written test, that proved you knew the rules of the road, but it did not prove you knew how to drive. For that, you had to pass an actual, practical, driving test.
That is why I prefer the CCE to the other certifications I have gotten. The ACE says that I've passed AccessData's test, but the CCE shows that I can handle an investigation from end to end, from chain of custody to submitting the report.
I don't know the CHFI certification, but I guess which you go for would be Dependant on what you want to do with your career. Do you want to do analysis of disk images, or do you want to defend against hackers? If both sound good to you, do both. It isn't like there is a limit to the number of certifications you can hold.