Notifications
Clear all

EnCase & FTK Training Needs?

7 Posts
7 Users
0 Likes
283 Views
(@bigsey)
Posts: 3
New Member
Topic starter
 

Hi,

What are the views of they guys at Forensic Focus regarding the training needs for the toolkits EnCase and FTK.

Can any of the experienced users of both/either tools comment on whether it is possible to self-teach, to a depth and standard required by the 'Digital Forensic Industry' or if specialised training is a MUST to acheive the required level of competence?

My own inexperienced thoughts are that both toolkits are too vast to self-teach and that the nature of the investigations the tools are required to perform requires the investigator to be FULLY in touch with all that EnCase and FTK are capable of doing…..

Comments please…..

 
Posted : 03/12/2007 4:41 pm
(@pbeardmore)
Posts: 289
Reputable Member
 

With enough time and the support of colleagues (either directly or via forums like this one) self teaching is a possibilty. And it is always valuable to really experiment with the software to see what it can do and feel relaxed when using it.

But it is such an obvious route for the defence to go down when asking an expert about their qualifications that some form of formal training has got to be prety important, if not essential. But how far you go down that route is debatable. There are many more specific software tools out there and I am not sure how realistic it is to expect formal training in all of these.

Just my 2 pence worth

 
Posted : 03/12/2007 6:28 pm
(@armresl)
Posts: 1011
Noble Member
 

Self teach can help you get through the programs just fine, how do you articulate that on a CV though?

How do you tell a Judge that you know the material, trust me?

The FTK classes are well put together and I haven't found one that I didn't like or learn something from.

Taking the classes just helps your stance overall to a position of power as opposed to a position of weakness.

 
Posted : 03/12/2007 10:36 pm
 Earn
(@earn)
Posts: 146
Estimable Member
 

To get the EnCE you are required a certain number of hours of forensic training through Guidance or through other means which must be proven before qualifying to sit for the test. I have taken several Encase classes through Guidance and I highly recommend them to anyone that will be using Encase or plans on getting the EnCE.

Like stated in the above post, simply stating that you taught your self how to use the tool doesn't hold the same value as showing you attended the classes. If you are ever called to testify you will need to be able to explain exactly how your processes work. Saying that you ran an enscript or pushed a button isn't acceptable.

 
Posted : 03/12/2007 10:46 pm
(@ci2019)
Posts: 53
Trusted Member
 

I would ditto the sentiment in regard to credibility. I personally wouldn't want someone defending me that didn't have formal training. On the flip side, if I did something bad, I would hope the prosecuting counsel had someone with no credentials.

I can't really speak for FTK but have had several Guidance classes as well. I wouldn't trade them for the world. I think either of them would offer industry standard guidance on how to dig into the bits. It's better to develop good habits out of the gate. Also, you get shortcuts and tips from the people that use it daily that you won't find anywhere else. As most EnCase users already know, it's not the most intuitive tool to use.

Also, if you are looking to become an EnCE, this is the only way to go. I can't comment on the other as I have no experience with it.

just my initial 2 cents.

Jon Straughn, EnCE

 
Posted : 03/12/2007 11:59 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

I've been in several classes from each vendor. I like them both, but Guidance Software clearly conducts the best training I've attended. You may pick up the information over years of using the tools and asking questions, but why not just get it out of the way? You are coming from a position of "I don't know what I don't know"; you'll be suprised what you'll learn.

 
Posted : 04/12/2007 5:47 pm
cfprof
(@cfprof)
Posts: 80
Trusted Member
 

I'll add my recommendation of Guidance Software's training. I've been through five of them. They really do training very well.

I teach for a living, so I'm critical of bad teaching. The Guidance courses have always been very well taught and the course manuals they give you are worth their weight in gold.

The new training pass (one price, unlimited training) is really a great bargain. I didn't do it this way, but if I was just starting out I would take full advantage of this.

 
Posted : 05/12/2007 8:49 am
Share: