Hi All,
I was just wondering if any one has taken the encase waiver exams ? Im looking to do the course, but my company can ony afford to send me to one, we were hoping to skip Computer Forensics 1 but we were asked to take a waiver exam, has anyone ever taken this ? Im pretty familiar with the material covered in this course, FAT, NTFS etc, but any tips on the types of questions would be great.
Thanks
jm25
I can tell you from experience that EnCase training while good is also very EnCase centric, very similar to any Microsoft training you do.
So if you know the names EnCase use for everything and their methodology you will be fine.
Hi jm25,
I have taken the waiver exam to skip Computer Forensics 1, from what I recall the questions were heavily weighted towards the internal workings of EnCase (specifically EnCase 7) rather than knowledge that could be gained from using EnCase for analysis day to day. For example my exam asked questions regarding where EnCase saved particular items and configurations by default, and I got very few questions regarding FAT, NTFS and actual forensic processes.
I would exercise caution.
@Adam10541, @forensicG Thanks for the replies, that very helpful. At least have an idea of where to focus my efforts now. Thanks a lot.
70% - Doh!!
They make the exams extremely difficult purely to try and force you to take the training, that's how they make their money after all )
Does anyone know where I can register to write the EnCase 1 waiver exam? I'm having problems even finding mention of it on Guidance's web site.
I've been in forensics for a while, and there's an EnCase 2 course coming up that I'd like to take. I just haven't taken 1 and can't really justify the cost.
Hi,
It depends on how familiar you are with EnCase. I wouldn't think of the courses as being easy/medium/hard or 1/2/3 but as demonstrating different features. I did EnCase Basic as it was in 2004 and we did lots of work around file systems and imaging. It wasn't easier than Intermediate as such it just covered getting started with EnCase and capturing, loading and reviewing data. Intermediate covered searching and reporting in detail.
If you are familiar enough with EnCase then I would pick the course that offers more of what you want, i.e. internet artefacts, NTFS, network intrusions.
If you are looking to get started in EnCase then it's important to get some familiarity with it before you go on the course. It's even more important you have work you can get on with when you get back.
Steve
10 years of using EnCase and I've worked my way through the EnCase7 book by Widup.
The level I course would be a waste of time and $$$ for me and my boss.