EnCE Certification at Enfuse
At Enfuse 2016, attendees are allowed to apply for a free attempt of the EnCE Phase I test. The EnCase Certified Examiner (EnCE) certification exam is administered by Guidance Software, developer of the EnCase forensic software suite. Successful completion of the exam certifies that a practitioner can competently and effectively use all features of EnCase in a forensic environment. It also accounts for a comprehensive understanding of best industry practices and laws that affect how investigations are conducted.
The certification requires successful completion of a two-phase testing regimen of both a written exam and practicum. Phase I of the certification process is offered at Enfuse. This allows eligible participants to take the test while waiving the entry fee which ranges from $200 to $300 under normal circumstances. The EnCE exam is considered challenging even to seasoned members of the digital forensic community. However, the certification is universally recognized as an indicator of competence with the digital forensic process and is a great augment to any prospective investigator. Here’s what you need to know if you intend to take the EnCE at Enfuse:
Qualifying
In order to take the exam at the conference, you must submit a written application prior to your arrival. New deadlines are posted each year, so be sure to check the Enfuse website for a timeframe. To qualify as a participant, you must accrue either 64 classroom hours of instruction on digital forensic tools and practices or have 12 months of relevant experience.
Phase I
The exam will test your knowledge of EnCase, computer knowledge, good forensic practices, and laws applicable for the preservation and examination of digital evidence. One of your best resources is the EnCE Study Guide, a very comprehensive aid that will test your knowledge on navigating EnCase. All of the questions are multiple choice, so you are given the results of your test as soon as you complete it. 180 questions in two hours may seem overwhelming, however most of the questions are simple and straightforward. I finished with about a half hour left. The test is administered through a program called ExamBuilder. ExamBuilder allows you to go back to previous questions as well as mark questions you are unsure about for later review. You don’t get points off for incorrect answers, so even if you don’t know the answer you should still select something and go back to it later.
Enfuse offers several prep courses over the course of the conference. This will take the place of another educational session, but it is great to attend before the exam. Guidance makes it clear that the prep courses are intended to be a crunch review and will not replace thorough preparation, so you should absolutely study before you go to Enfuse. The prep course goes over the study guide you are given before you take the test. Guidance Software who oversee these sessions also create and grade the tests, so it is a great opportunity to be able to ask them questions. While its primarily focus is on Phase I of the test, asking the right questions and speaking to others who have taken the exam during the prep course will give you valuable advice on Phase II.
Phase II
If you successfully pass Phase I at Enfuse, you are given a copy of EnCase and a forensic image to conduct an investigation. Over a period of 60 days, you will be given a scenario and will have to answer questions based on your examination of the provided evidence. You are also able to get a 30 day extension; if you think it will help you should definitely ask for it. The test is designed to evaluate how complete your knowledge of EnCase is, so be prepared to use almost every feature the software suite has to offer. Some of the features I had never used in my classes, so I recommend consulting the study material to help prepare for this part of the test.
Phase II will take a lot of time to do, so try to start early so you have time to create a quality report.
The EnCE is no pushover, but it is one more fantastic opportunity to take advantage of at Enfuse. I absolutely encourage any new LCDI employees or ITS majors to apply for a spot on the Champlain delegation. It’s a great experience to touch up your networking skills and pick up some awesome new knowledge on the ins and outs of digital forensics. There’s a place for people of all skill levels and it’s without a doubt a great way to start the summer.
Got a question? Feel free to comment below or email us at lcdi@champlain.edu. You can also follow us on Facebook or Twitter for the most recent updates on projects and more!