What steps did you take to become EnCase® Certified?

I have been doing their online training. It has been very good for me to be able to learn at times that I have available and work with the software. I will be taking my test shortly and feel that and the Sybex EnCE book are prepping me properly.

Have a look here

http//www.guidancesoftware.com/training/EnCE_certification.aspx

The book is also worth getting, even just as a reference book

Good luck with it

I'll add one caution on the Sybex book. It shouldn't apply to anyone who have a fully licensed copy. It does apply to someone who only has the demo versions of EnCase from the Sybex book available to them. Not all of the exercises work correctly with the version of EnCase the publisher included exactally as written. In fact, most will have to download updates to the book from Sybex to get the exercises to work.

You are required to attend the Computer Forensics I and II courses in order to sit for the written exam and you must get a passing grade on the written exam to take the practical.

Since the cost of the two courses and the exam are close to the cost of one year of a training passport, a smarter move might be to buy the passport, take I and II and the EnCE Prep Course (which includes the written exam), plus any other training that you want to cram into the year.

There won't be anything on the test that is not in CF I and II, and EnCE Prep contains no new information but is intended to emphasize the knowledge necessary for the EnCE written exam. I would say that the Sybex book is a viable alternative to the EnCE Prep course (without the free exam), but remember that the EnCE Exam is always based upon the most recent major release of EnCase so if the book is out of date, there may be questions on the exam which are not in the book or which are answered, differently, in the book.

As someone who has a passport and taken 9 of Guidance's classes, I can say that it's well worth the cost.

Although you are not required to take the CF I and II classes in order to take the EnCE. You need a years worth of Computer Forensic work or 64 hours of "authorized computer forensic training." That being said, what seanmcl suggested is probably the best course of action. Although from just taking the EnCE written exam about two months ago, there are some things on the test that were not covered in any of the classes or the Prep course (mainly items on Floppy Disks and MS DOS). But it was only a few questions.

Tom

Although you are not required to take the CF I and II classes in order to take the EnCE. You need a years worth of Computer Forensic work or 64 hours of "authorized computer forensic training."

That is true and I misspoke. As a practical issue, however, neither the 64 huors of authorized training nor the year's work of CF would be particularly helpful unless you were very familiar with EnCase, itself. Although the EnCE examination includes many vendor neutral questions there is still an obvious slant toward the use of EnCase (it is, after all, a product certification course).

When I sat for the exam I had used EnCase for more than five years, as well as TSK, FTK and X-Ways but I'd have to say that the courses provide the appropriate focus on and context in which to interpret the exam questions.

And while the practical allows you to use any tool that you wish, the reality is that you can't do it without EnCase and that would be bad time to have to learn it, in detail.

computerboy, the UK prices are on the guidance software website. I think the training passport they offer is very good value for money, but its not cheap at 6,250! While you could go off and pay that, I don't think it would be of great help without the experience to back it up. Better waiting to find a job and get someone to pay for it for you )

While you could go off and pay that, I don't think it would be of great help without the experience to back it up. Better waiting to find a job and get someone to pay for it for you )

Precisely my thoughts. D

Maybe another cert not related to forensics if you really wanted to do something else and get another edge on the CV.

Computerboy,

Check out www.encesecrets.com for information on the EnCase Certified Examiner certification.

Good luck,

John