DF310 EnCase Certified Examiner Prep

Duration: 3 Days
The EnCE application must be completed and approved before enrollment in this course is confirmed.

This hands-on course is designed for EnCase users who are preparing for the EnCE (EnCase™ Certified Examiner) certification process. The EnCE certification is a highly sought-after accreditation that requires significant knowledge of computer forensics, the OpenText™ EnCase™ forensic methodology, and the EnCase Forensic software to achieve successfully. The two-phase testing process is based on a written exam and the completion of a full practical scenario exam, including the preparation of an investigation report. The certification is based on the practical digital forensic skills and knowledge presented in the OpenText courses Foundations in Digital Forensics with EnCase and Building an Investigation with EnCase. The EnCE Prep course is not intended to be a replacement for these two classes. Rather, it is a thorough and accelerated review of the topics covered in those courses that are applicable to the EnCE certification process. Students cannot waive or substitute the prerequisite of attending the Building an Investigation with EnCase course when applying to attend the EnCE Prep course.

Delivery method: Group-Live.

NASBA-defined level: intermediate.

CPE Credits – 24

During this course, students actively use the EnCase Forensic software to review the set of skills needed to address the EnCE practical exam, which includes:

Digital Forensic concepts and methodology and EnCase Forensic
Navigating the EnCase forensic environment
Proper handling and acquisition of digital evidence using EnCase
Basic computer functionality, as well as that of various computer file systems
Using EnCase functionality to examine digital evidence
Searching for evidence with EnCase Forensic and bookmarking and tagging items of interest
Examining various artifacts using EnCase Forensic, including the Windows Registry, Windows artifacts, email, and Internet history
Creating and exporting an examination report with EnCase Forensic

Students will review the knowledge set needed to perform computer forensic examinations. This knowledge set, in the areas of computing, computer forensics terminology, relevant laws, and familiarity with the EnCase Forensic software, is the core of the first phase (written exam) of the certification process.

The written exam is administered through an Internet-based testing service at the end of instruction on the last day of the EnCE Prep class. The testing fee does not apply to qualified students taking the test for the first time. The exam is administered to students in a supervised and timed environment. Written exam results will be provided immediately upon completion of the exam, at which point those who achieved a passing score of 80% or higher are eligible to proceed to the practical exam. As part of the practical exam, students receive an EnCase Forensic exam version and the evidence to be examined. The practical exam is scenario-based, requiring the student to demonstrate competence in applying the concepts and techniques taught in the Foundations in Digital Forensic Analysis with EnCase and Building an Investigation with EnCase courses, and to present those findings in an examination report

Audience
EnCase users who have attended the EnCase training courses, Foundations in Digital Forensic Analysis with EnCase (optional) or Building an Investigation with EnCase, and are preparing for the EnCE (EnCase Certified Examiner) certification process.

Prerequisites
DF210 – Building an Investigation with EnCase

The 5-day FLETC EnCase training or the previous version of EnCase Computer Forensics II will also be accepted. No other training or experience may be substituted. Attendees planning to take the EnCE exam must complete the EnCE application before the start of the class. Students without approved applications at the start of the class will not be eligible to take the exam at the end of the course.

Students attending the EnCE Prep class must also attend and complete the three days of the class to qualify to take the exam at the end of the course. Eligible students will take EnCE Phase I of the written exam on the final afternoon at the end of the course.