EnCE - Is It Worthwhile if I Already Have a GIAC Forensic Certification?

qwerty1980

Hi,

I currently have a SANS GIAC forensic certification (GCFA), and I am now considering studying for the EnCE EnCase certofocatopm. The exam is only $200, but I am not sure if it's worthwhile to me since I already have a forensic certification and I am already making quite a bit over $100,000 in my current security job here in the United States. I am not planning to do a ton of hands-on forensics in the future (I currently do), but would want to manage a team of forensic specialists.

What do you guys and gals think, will an EnCE bring much value to someone already forensic certified?

ptilsen

It's definitively the best forensic certofocatopm out there.

My limited understanding is that EnCE is preferred for forensics investigators working within the US legal system, but I would say JDMurray would be the best person to chime in on this.

veritas_libertas

I would recommend placing that question at: forensicfocus.com. It is certainly the most recognized certification in the computer forensic world.

JDMurray

The EnCE is probably the most widely-recognized DF cert (search the popular job boards for DF certs to compare). Having the EnCE will help you get a job at places that use EnCase. In having the EnCE, the assumption will be that you already know how to use EnCase and won't need any additional training, so hiring you can be a bit of a cost savings to an employer. Having either the EnCE or GCFA does not mean that you also have lab or field or management DF experience, but only some classroom training in DF procedures and software tools.

A problem is that only EnCEv7 is now available, but most forensics shops still use EnCase v6. EnCase v7 hasn't been received very well in the DF community, so those of us with EnCEv6 may be more in demand (IMHO). You might strongly consider getting the FTK v3 cert from AccessData instead. Either way, you will need to have hands-on experience with the forensics analysis software to pass either cert exam. Also, you will only get a management job by having prior team management experience, otherwise you'll be expected to work your way up into management from being a DF tech.

MattSC

JDMurray wrote: »

A problem is that only EnCEv7 is now available, but most forensics shops still use EnCase v6. EnCase v7 hasn't been received very well in the DF community, so those of us with EnCEv6 may be more in demand (IMHO).

JD, I was at Guidance last week for more training, and one of the instructors mentioned that EnCE v6 will be offered until they stop selling EnCase v6. Of course, this could change, so I'd advise any EnCE candidates to confirm directly with Guidance.

And based upon comments from this class, v6 is most certainly still being used in the community despite the availability of v7.

JDMurray

I'm glad that EnCEv6 is still being offered. I assume GSI had to keep their EnCase v6 training going because of the slow adoption of EnCase v7. It's likely v7 will be GSI's "Vista," and they will need to significantly retool their GUI to release EnCase v8 (and hopefully soon).

mjs1104

If Encase is your primary forensic tool, you'll definitely want to get certified in it. It's always a good idea to get a tool agnostic forensic certification (CCE, CFCE, GCFA, GCFE, etc) and then follow that up with a vendor specific tool, particularly the forensic software platform that you will be using the most.

When testifying in court (either civil or criminal), the prosecution or defense (depending on what side you are sitting on) will most likely ask you about both your training and experience in the digital forensic field and what certifications you currently have related to forensics.

If I am doing an examination with Encase, I most definitely want to be Encase certified. It adds a level of credibility to your testimony. When I first started doing forensic examinations about 8 years ago, this was not as big of a deal as it is now.