Notifications
Clear all

EnCE certification  

  RSS
arashiryu
(@arashiryu)
Active Member

I would like some opinions from the existing EnCEs out there.

What are your thoughts on preparing for the EnCE cert?

Use the new book - EnCase Computer Forensics–The Official EnCE EnCase Certified Examiner Study Guide by Steve Bunting and William Wei (Paperback - Feb 20, 2006)

OR

Save my pennies to attend the boot camp / classroom training.

I already have a CCE. 2000+ hours of investigative experience with fortune 500 corps and some law enforcement cases under my belt. Overall 11 years of various IT experience.

I already have all the necessary hardware (ide/sata/scsi) write blockers and a purchased / pricey copy of EnCase ver 5.

I kinda have my mind half made up to give the book a try first but would welcome any opinions or thoughts from the existing EnCEs already in the field.

Quote
Posted : 16/03/2006 7:17 pm
m7esec
(@m7esec)
Junior Member

From what I have read from your posts, I would save the money and just get the book. I didn't have the option of the book at the time and just used my knowledge of Encase and their free study pamphlet they had. The EnCE is a good cert but technically not that difficult if you have past experience (except the practical takes some time)

Good luck and let me know if you have any other questions!

ReplyQuote
Posted : 17/03/2006 8:12 pm
arashiryu
(@arashiryu)
Active Member

m7esec,
Thx for the reply. After buying Encase, I really did not have the funds left over for for cost of class + travel + lodging.

The 3 CCE practicals I had to pass took a while so I was expecting EnCase to be lengthy and involved as well.

I'll let you know how I make out and ping you offline if I have any other questions. Thanks again.

ReplyQuote
Posted : 17/03/2006 9:23 pm
gmarshall139
(@gmarshall139)
Active Member

Yes, get the book. I can't say from firsthand experience, but I've heard good things about it. Of course there is no substitute for training, so I'd get down to Sterling first chance you get. The practical portion of the EnCE will take some time. Plan ahead for that.

ReplyQuote
Posted : 18/03/2006 6:24 am
andy1500mac
(@andy1500mac)
Member

For what it’s worth, I'm 3/4 of the way through the book and finding it well put together.
From the perspective of someone like myself who has only had access to the demo software it has cleared up some of my questions. The first few chapters on hardware and A+ type stuff, as well as the file system data structures will be a review for some but the rest is a good read…up to now.

The different interface views or panes are covered in detail, as are the options available to each. The book includes a thorough explanation of how Encase stores the case and its use of CRC checks (on data blocks) as well as its MD5 hashing of the "image" as a whole. If you are/were slightly confused by the book marking functionality and how to use it properly, it is covered well and leads nicely into how they are a fundamental part in creating a structured and professional report.

Included is a DVD which I haven't really used up to now but has some evidence file samples to play with as well as a couple of PDF's and standard "flash cards and quizzes" for these types of books. This is what springs to mind but there is obviously much more…

Hope it helps.

Andrew-

ReplyQuote
Posted : 19/03/2006 5:41 am
psu89
(@psu89)
Active Member

WOW! That book looks very good. We are learning EnCase now and that would have made a great text book. I just might have to order it.

Thanks for the tip and the review.

Brian

ReplyQuote
Posted : 19/03/2006 8:07 am
arashiryu
(@arashiryu)
Active Member

Thanks to everyone for their input. I ordered it . Can't wait to read it and attempt the cert.

ReplyQuote
Posted : 19/03/2006 10:49 am
Earn
 Earn
(@earn)
Active Member

Anyone taken the prometrics? I'm wondering how broad the test is. The study guide from Guidance is nothing compared to the book that just came out…

ReplyQuote
Posted : 24/04/2006 9:31 pm
arashiryu
(@arashiryu)
Active Member

I agree. The study guide from Guidance should be labeled as pocket guide ;~)

I am reading the new study guide that just came out. So far I am very impressed with the content.

I plan to test in July. I'll follow up.

ReplyQuote
Posted : 24/04/2006 11:38 pm
Earn
 Earn
(@earn)
Active Member

I hope to test in the next couple weeks. I let you know how it goes.

ReplyQuote
Posted : 24/04/2006 11:47 pm
DJPnP
(@djpnp)
New Member

If you know everything mentioned in the encase booklet then you should be able to pass the prometric part of the test quite easily, however the book looks to be very useful for the second part (which I'm still doing!).

Good luck folks! D

ReplyQuote
Posted : 25/04/2006 1:25 am
Earn
 Earn
(@earn)
Active Member

Thanks for the tip!

ReplyQuote
Posted : 25/04/2006 1:55 am
Share: