The Certified Forensic Computer Examiner (CFCE) credential was the first certification demonstrating competency in computer forensics in relation to Windows based computers. The CFCE training and certification is conducted by the International Association of Computer Investigative Specialists (IACIS), a non-profit, all volunteer organization of current and former law enforcement members.
Contents
History
IACIS was formed and commenced training in 1990. The predecessor to the CFCE was the DOS Processing Certificate (DPC). The CFCE was introduced in 1998 when the training was expanded to include examination of Windows-based computers. The course materials also cover other operating systems and such as Linux and Mac OS and their associated file systems, however the certificate only states proficiency in Windows.
Eligibility
In order to become a member of IACIS and undertake the CFCE or Certified Electronic Evidence Collection Specialist courses, a person must generally be a full-time member - sworn or unsworn - of a law enforcement agency. In some cases, a contract employee of a law enforcement agency or retired law enforcement officer may be eligible. All IACIS members must sign agreement with the IACIS Code of Ethics.
Certification process
The certification process may be taken internally or externally and is conducted in two phases: Peer Review and Certification.
An internal certification candidate attends a 2-week training course given by IACIS. Two courses are conducted annually. The US based course is conducted in the first half of the calendar year whilst the European-based course is conducted in the second half of the year. Upon successful completion of the course, the member is assigned a (volunteer) coach. The coach guides the student through the Peer Review phase, often by suggesting reading materials or experiments for the student, which is intended to assist the student in fully understanding issues with which the student may be having difficulty. Upon successful completion of the Peer Review phase the candidate is eligible to enter the Certification phase which consists of a practical exam based on a hard drive examination and a final exam.
An external certification candidate does not attend the training, however they have to have the equivalent 72 hours of training that is comparable to the IACIS training.
Recertification
In order for certification to remain current, a member must undertake a proficiency test once per 3-year period after certification as well as complete 60 hours of continuing training in computer forensics or a related field. Additionally, the member must conduct as a minimum an average of 1 forensic examination per year, for a minimum of 3 examinations over the 3-year period. The member must also pay dues ($75 per year) and remain a member in good standing of IACIS.
Recognition
CFCE is one of the most widely recognized non-tool certifications in computer forensics for current and former law enforcement personnel. Some organizations such as the Computer Forensics Laboratory at Miami-Dade Police require their members to complete and maintain this certification.