Here is what another member said about the CHFI on a different forum that I am on that has a CF section
"Passed CHFI with a 93.3% in 28 minutes.
Thoughts
They have over 4,000 pages of material and they choose to ask questions like which TCP ports some <ahem> "well known" email services run over? The exam was loaded with tons of these types of questions and I was sorta dissapointed by how easy it was. Some looked like they pulled them straight out of a 1998 CEH exam…..very easy. I'm not sure that I even needed to sit through the class, but was glad I did as the instructor was very good and added a law enforcement aspect to the class. As mentioned earlier, some of the questions specifically pertaining to legal issues (particularly laws in foreign countries) really seemed out of place here.
I believe that the test would benefit from a practical exam like ACE, EnCE, CCE, etc. and it would certainly help it's acceptance in the forensics industry. Probably not a bad test if you're new to IT, but not really a good one if you've already established yourself in it"
Also there are other comments along this same line where the CHFI is outdated, the study material is rampant with spelling errors and poorly designed. People have called EC and asked where the study materials were put together and they responded "in India". So maybe it's not a good test to begin with.
So, does the CCE say you can handle an investigation from end to end, or does it say that the person or few people who looked at your test results of the supplied sample image/media say that you can handle THAT particular investigation which THEY sent to you.
Obviously not. As you said, you can come up with a million different scenarios that the CCE, or any practical examination process doesn't cover. I mean, even someone who is a veteran in the field with many years experience can not say they are prepared for ANY investigation scenario. I was speaking generally.
My main point, however, was that the practical examination process shows that I, or others who pass the process, can handle an investigation from end to end. Where as a multiple choice test does not. Much like passing the road test shows that you can drive a car, but passing the written test does not.
I tried the CHFI exam, and pass it with very high score. At least 50% of the questions where related to laws and methodology, so it was easy for me as an active lawyer and forensic analyst. I spent a lot of time studying deep technical knowledge, like data structures in file systems, and recovering corrupted data, but they were not many questions related . Nevertheless, I don't think the exam would be easy for professionals not working in the field.
As I read in this forum, the next step would be the CCE… right?
cheers
As an active lawyer, please help me understand the need/want to enter CF.
All the lawyers I know are successful lawyers, most of the CF people I know are successful CF people. IMHO and the opinion of others I have spoken with who are attorneys, what advantage is it to hold both jobs?
I tried the CHFI exam, and pass it with very high score. At least 50% of the questions where related to laws and methodology, so it was easy for me as an active lawyer and forensic analyst. I spent a lot of time studying deep technical knowledge, like data structures in file systems, and recovering corrupted data, but they were not many questions related . Nevertheless, I don't think the exam would be easy for professionals not working in the field.
As I read in this forum, the next step would be the CCE… right?
cheers
As an active lawyer, please help me understand the need/want to enter CF.
All the lawyers I know are successful lawyers, most of the CF people I know are successful CF people. IMHO and the opinion of others I have spoken with who are attorneys, what advantage is it to hold both jobs?
That's a really good question for Craig Ball, but I'd say that one benefit is because it really helps you be an eDiscovery Special Master.
For context though, I was studying a double degree in IT and Law, and about a year out from graduating both when I decided to only graduate my IT degree after I decided on a career in CF. That was over 10 years ago, so I hope no-one takes this as advice in how to get into CF. I would say that legal training can be useful in CF, not as much as the IT training, but you don't need to actually be a lawyer to gain the benefits that I got from my training.
Dear Armresl, of course both areas are different, but complementary. I was commenting my CHFI experience, just that.
Well, I studied law and learned computer science. Then I took the area of law & informatics as speciality. That brought me into Computer Forensics, and all the previous law training help me a lot to understand this fascinating area.
Most forensic analysts come from Informatics background, but that is not a rule. Also I think is good to have different perspectives about the same.
I disagree that they are complimentary.
Was talking with one of the best criminal defense attorneys in the Midwest, maybe the country and posed that question to them. The response was how much money were they making as an attorney? How good were they considered by their peers. Where they flush with business so much to the point that they had to refer out many cases?
You can't serve two masters and IMHO and most every atty that I have dealt with have said it gets in the way, they are the legal mind and their team is who was hired to spearhead the case from a legal standpoint. Is an JD/CF going to add some odd piece of caselaw which will win the case for the client, probably not, maybe they can help, maybe not.
I consider myself very well read as far as law, recent decisions, cites, at the COA, SCOTUS, and local level, but I would not want my bar card, to me it would muddy up the water and I'd question why I was doing it. I'm a really good investigator, and in order to get a bar card I would have to be = or > at Law than at my chosen field of investigations.
Back to your answer to my question. How did your previous law training help you to understand this fascinating area?
What do you get with your JD now that you didn't have before?
How many cases have you worked on where your JD was a significant factor in you winning the case as opposed to the CF knowledge you possessed?
quote="lucpel"]Dear Armresl, of course both areas are different, but complementary. I was commenting my CHFI experience, just that.
Well, I studied law and learned computer science. Then I took the area of law & informatics as speciality. That brought me into Computer Forensics, and all the previous law training help me a lot to understand this fascinating area.
Most forensic analysts come from Informatics background, but that is not a rule. Also I think is good to have different perspectives about the same.
Yeah, but let's not think about this in terms of good or bad. In the professional arena you cannot be the defendant lawyer and the investigator in the same case, and certainly could not be a good choice to try both jobs at the same jurisdiction. But you just said
"I consider myself very well read as far as law, recent decisions, cites, at the COA, SCOTUS, and local level…."
Then at the Knowledge level LAW is very important for you and your CF work development.
Winning cases??? CF knowledge can help you to understand deeply the case you are working on, but winning cases is something else….. that is a topic to consider for a new post in the legal section.
cheers,
I said that in an effort to show that while I have knowledge I would not pursue it beyond that knowledge, as I see it would get in the way of conflicting job titles and blur lines.
Yeah, but let's not think about this in terms of good or bad. In the professional arena you cannot be the defendant lawyer and the investigator in the same case, and certainly could not be a good choice to try both jobs at the same jurisdiction. But you just said
"I consider myself very well read as far as law, recent decisions, cites, at the COA, SCOTUS, and local level…."
Then at the Knowledge level LAW is very important for you and your CF work development.
Winning cases??? CF knowledge can help you to understand deeply the case you are working on, but winning cases is something else….. that is a topic to consider for a new post in the legal section.cheers,
I have an academic qualification in law, but didn't undertake the professional training. I've found the grounding in law to be helpful in my role as an investigator, but I rather agree that you can't excel in both fields.