I see from the forum that other discussion (i.e. CCE v CHFI) have already taken place.
I work in the UK for a company supporting a large government department. While not my prime role, in the last 18 months I have been involved in a number of forensic investigations. All internal corporate stuff, with nothing looking like it might become a criminal case, although I have treated everything as though it could be.
I am definitely NOT a forensic expert, but do at least have a strong technical back ground, and have tried to read thoroughly on forensic processes etc.
I recently attended the CHFI course help by Firebrand (used to be Training Camp) here in the UK. It is a 5 days course and generally follows the EC Council Course material (which is appalling). The instructor was very knowledgeable, and we went through a number of low level practical exercises in data carving. These were ideal for providing an insight into how our higher end tools (Encase & FTK) perform their work.
In order to pass the exam, it’s necessary to memorise a number of U.S. Laws relating to computer misuse, and the involvement of the appropriate U.S.Government agencies. All of which is likely to be fairly useless to me in my role.
Having passed the exam, I ‘m interested to know the general view of the qualification in the industry.
Value of CHFI honestly (Not) here is my (Opinion) and reasons.
1. Who is ECCouncil? They are to new to the forensic industry
2. By passing their exam what does that prove?
a. As you stated you had to memorize some of the US laws concerning forensics in general.
So Industry recognized, not yet.
Now on the other hand, depending on the instructor this is a great entry level certification and course that would keep the average network administrator / managers out of trouble when it comes to forensic investigations. As it does at least cover the do’s and don’ts as far as investigations go.
Hdollar
Your thoughts pretty much echoed my own. I am glad I did the course, as I did learn from it. But as for calling myself a 'certified forensic investigator' just because I passed the exam - I don't think so.
My background is in penetration testing, so I consider myself to be reasonably technical. I'm happy that in my current corporate environment, I can follow standard procedures, find the appropriate data, and report. However, if I was required to stand up in court, I don't think a prosecuter could establish me as a credible expert. I'm sure any defence lawyer would tear me to shreds!