I would like some opinions from the existing EnCEs out there.
What are your thoughts on preparing for the EnCE cert?
Use the new book - EnCase Computer Forensics–The Official EnCE EnCase Certified Examiner Study Guide by Steve Bunting and William Wei (Paperback - Feb 20, 2006)
Save my pennies to attend the boot camp / classroom training.
I already have a CCE. 2000+ hours of investigative experience with fortune 500 corps and some law enforcement cases under my belt. Overall 11 years of various IT experience.
I already have all the necessary hardware (ide/sata/scsi) write blockers and a purchased / pricey copy of EnCase ver 5.
I kinda have my mind half made up to give the book a try first but would welcome any opinions or thoughts from the existing EnCEs already in the field.
From what I have read from your posts, I would save the money and just get the book. I didn't have the option of the book at the time and just used my knowledge of Encase and their free study pamphlet they had. The EnCE is a good cert but technically not that difficult if you have past experience (except the practical takes some time)
Good luck and let me know if you have any other questions!
Thx for the reply. After buying Encase, I really did not have the funds left over for for cost of class + travel + lodging.
The 3 CCE practicals I had to pass took a while so I was expecting EnCase to be lengthy and involved as well.
I'll let you know how I make out and ping you offline if I have any other questions. Thanks again.
Yes, get the book. I can't say from firsthand experience, but I've heard good things about it. Of course there is no substitute for training, so I'd get down to Sterling first chance you get. The practical portion of the EnCE will take some time. Plan ahead for that.
For what itâ€™s worth, I'm 3/4 of the way through the book and finding it well put together.
From the perspective of someone like myself who has only had access to the demo software it has cleared up some of my questions. The first few chapters on hardware and A+ type stuff, as well as the file system data structures will be a review for some but the rest is a good readâ€¦up to now.
The different interface views or panes are covered in detail, as are the options available to each. The book includes a thorough explanation of how Encase stores the case and its use of CRC checks (on data blocks) as well as its MD5 hashing of the "image" as a whole. If you are/were slightly confused by the book marking functionality and how to use it properly, it is covered well and leads nicely into how they are a fundamental part in creating a structured and professional report.
Included is a DVD which I haven't really used up to now but has some evidence file samples to play with as well as a couple of PDF's and standard "flash cards and quizzes" for these types of books. This is what springs to mind but there is obviously much moreâ€¦
Hope it helps.
WOW! That book looks very good. We are learning EnCase now and that would have made a great text book. I just might have to order it.
Thanks for the tip and the review.
Thanks to everyone for their input. I ordered it . Can't wait to read it and attempt the cert.
Anyone taken the prometrics? I'm wondering how broad the test is. The study guide from Guidance is nothing compared to the book that just came out…
I agree. The study guide from Guidance should be labeled as pocket guide ;~)
I am reading the new study guide that just came out. So far I am very impressed with the content.
I plan to test in July. I'll follow up.
I hope to test in the next couple weeks. I let you know how it goes.
If you know everything mentioned in the encase booklet then you should be able to pass the prometric part of the test quite easily, however the book looks to be very useful for the second part (which I'm still doing!).
Good luck folks! D
Thanks for the tip!