EnCase™ Certified Examiner Prep
...[Read More]
Description
| Course: | DF310 – EnCase™ Certified Examiner Prep |
| Format: | Instructor-Led (this course is also available in self-paced format) |
| Duration: | 3 Days |
| Role(s): | Analyst |
The EnCE application must be filled out and approved before registration to this course will be confirmed.
This hands-on course is designed for OpenText™ Forensic (EnCase) users who are preparing for the EnCE (EnCase Certified Examiner) certification process. The EnCE certification is a highly sought-after accreditation, which requires significant knowledge of computer forensics, the OpenText Forensic methodology, and the use of OpenText Forensic software. The two-phase testing process is based upon a written examination and the completion of a thorough practical scenario examination, including the preparation of an investigative report. The certification is based upon the practical digital forensic skills and knowledge presented in two of the OpenText courses, DF120-Foundations in Digital Forensics and DF210-Building an Investigation. The EnCE Prep course is not intended to be a replacement for these two classes. Instead it is a thorough, accelerated review of the subjects covered in those courses that are applicable to the EnCE certification process. Students cannot waive or substitute the prerequisite attendance of DF210-Building an Investigation course when applying to attend the EnCE Preparation course.
Delivery method: Group-Live. NASBA defined level: intermediate.
CPE Credits – 24
During this course, students actively use OpenText Forensic (EnCase) to review the skill set required to address the EnCE practical examination, including:
- Digital forensic and OpenText Forensic concepts and methodology
- Navigating the OpenText Forensic environment
- The proper handling and acquisition of digital evidence using OpenText Forensic
- Basic computer functionality as well as that of various computer file systems
- Using OpenText Forensic functionality to examine digital evidence
- Searching evidence with OpenText Forensic then bookmarking and tagging items of interest
- Examining various artifacts using OpenText Forensic, including the Windows registry, Windows artifacts, email, and internet history
- Creating and exporting an examination report using OpenText Forensic
Students will review the body of knowledge required to perform computer forensic examinations. This body of knowledge, in the areas of computer science, computer forensic terminology, relevant law, and familiarity with the EnCase Forensic software is the core of the first phase (written examination) of the certification process.
The written examination is administered via an Internet-based testing service at the end of instruction on the last day of the EnCE Prep class. The testing fee is waived for qualified students who are taking the test for the first time. The examination is administered to the students in a monitored, timed environment. The results of the written examination will be provided immediately following the completion of the examination, at which time those who achieved a passing score of 80% or more are eligible to proceed to the practical examination. As part of the practical examination, students are provided an examination version of EnCase Forensic and the evidence to be examined. The practical examination is scenario-based, requiring the student to show proficiency in applying the concepts and techniques taught in the Foundations in Digital Forensics with EnCase and Building an Investigation EnCase courses and presenting those findings in a written examination report that will be submitted for grading.
Prerequisites
DF210 – Building an Investigation with EnCase
EnCase 5-day FLETC Training or former version of EnCase Computer Forensics II will also be accepted. No other training or experience can be substituted. Attendees planning to take the EnCE exam must fill out the EnCE application prior to the start of class. Students who do not have approved applications at the start of class will not be eligible to take the test at the conclusion of the course.
Students who attend the EnCE Prep class must also attend and complete all three days of the class in order to qualify to take the test at the conclusion of the course. Eligible students will take Phase I of the EnCE written exam on the final afternoon at the conclusion of the course.
For more information about this course, click here