Computer Forensic certs that don't expire?

010101

Are there any good computer forensic certs that don't expire and have to be renewed every 2-3 years?
I want something like the CISSP where once you have it, you have it. I don't mind getting some CPE, but having to study for a test every 2-3 years is too much.

Anyone know of some decent ones?


Thanks

NetworkNewb

Only thing I could think of that doesn't expire would be a Bachelors or Masters degree

cyberguypr

GCFx, CCFP, CHFI, CCE, CSFA, and most other forensics certs offer a CPE or equivalent path. Some are harder or more expensive to complete than others but most do not require retesting. Having said that, why do you want a forensics cert? Is it a work requirement or a personal thing?

010101

Thanks. It's a work thing. I've been doing forensics for 15 years for legal cases, but it makes up maybe 1% of my job.
98% of my job is internal networking, and 1% is pentesting. I do between 1-4 forensic cases a year on average.

The partner I report to for forensics wants me to have a forensics cert in case I have to go to trial and testify. I see his point, but I want to just get it done and put it behind me. It's not like this is my 40 hour a week gig, it's probably 40 hours a year. And I really don't think I would ever want to transition to doing forensics full time.

So really, I want the easiest cert with the least maintenance, that's not complete BS.

He wants the EnCE, but I think that's not the easiest cert...

cyberguypr

I see your point. Well, you said no BS so that disqualifies the CHFI. Forgot to ask, who is paying for this?

5ekurity

I think that the EnCase cert (EnCE) just teaches you how to use EnCase - kind of like how the ACE makes you an AccessData Certified Examiner (aka how to use our tools, mostly) but doesn't really teach forensic methodology. I think you are looking for something more along the lines of what cyberguypr said - GCFE/GCFA, CCFP, etc.

010101

cyberguypr wrote: »

I see your point. Well, you said no BS so that disqualifies the CHFI. Forgot to ask, who is paying for this?

lol, gotcha on the CHFI.
They're paying for it, so I really don't care about price.
I'll have to study for it on my own time, minus any forensic training classes which would be on their time.

5ekurity wrote: »

I think that the EnCase cert (EnCE) just teaches you how to use EnCase - kind of like how the ACE makes you an AccessData Certified Examiner (aka how to use our tools, mostly) but doesn't really teach forensic methodology. I think you are looking for something more along the lines of what cyberguypr said - GCFE/GCFA, CCFP, etc.

Thanks, I'll check our those.

Edit: It looks like with both the GCFA and GCFE, all you have to do is take (1) SANs forensics class every 4 years and pay $400 to renew? If so, that's what I want!

BlackBeret

The FTK ACE has to be redone every year, but it's free, simple, etc. As others mentioned it wont teach you forensics as much as it goes over using their tool set. If you just want A certification for the sake of having one, ACE was simple when I had access to FTK and only took me about 20 minutes to complete.

docrice

If cost is not much of a concern, I highly recommend SANS FOR408 and FOR508 (and the GCFE and GCFA respectively).

010101

BlackBeret wrote: »

The FTK ACE has to be redone every year, but it's free, simple, etc. As others mentioned it wont teach you forensics as much as it goes over using their tool set. If you just want A certification for the sake of having one, ACE was simple when I had access to FTK and only took me about 20 minutes to complete.

Win! I'll check it out, thanks!

docrice wrote: »

If cost is not much of a concern, I highly recommend SANS FOR408 and FOR508 (and the GCFE and GCFA respectively).

Good stuff. I'm kind of leaning towards the GCFE after reading your post and others here and looking into it a little more.
Seems like it's easy to maintain and won't burn a year of my life studying for it.

Thanks to everyone who responded. Much appreciated.

cyberguypr

Are you planning on taking the class or just challenging the test?

SaSkiller

Actually I think the CCFE might be your best bet here!

Certified Computer Forensics Examiner (CCFE)

AFAIK they do not require recertification. And it would provide you the opportunity to review it for us!