Main | April 2006 »

February 8, 2006

Certified Computer Examiner (CCE)

The instructor that I had for the SANS Forensics track, David Hoelzer, recommended this certification. The Certified Computer Examiner (CCE) certification is sponsored by The International Society of Forensic Computer Examiners. It's home page is

GCFA - GIAC Certified Forensic Analyst

I mention this first simply because I took the training (SANS SEC 508) that it tests you on. It is generally not considered to be THE forensics training to get, but I don't think it's totally ignored either. The cost is listed at $800 (as of today), but it's $300 if you sign up for it along with the SANS SEC 508 class.

I paid for the certification attempt when I went to training in November, but haven't studied yet, let alone taken the test. I'll update this when I know more.

GCFA Homepage

SANS Forensic Training (SANS SEC 508)

I attended SANS forensic training (SEC 508) in Baltimore in November, 2005. The instructor was David Hoelzer. The URL of this course is

Even though Rob Lee appears to be the principal author of the course, David did an excellent job teaching the material, and clearly is well qualified to teach the subject matter. The course covered appropriate material, and was well-suited for people with little to some forensic experience.

Note that the University of Missouri is trying to host this course at a very reduced price ($1,000 for .EDU employees or law enforcement personnel). The dates are June 12 - 17, 2006. The registration URL is Rob Lee is slated to teach the course, so I suspect it will be well worth your time and your employer's money to go. Unfortunately, they may not have enough registrations to hold the class, and they will have to make that determination soon, so if you want to go, you will need to register soon, and perhaps wait to book your flight and hotel room, or else make sure they can be cancelled without penalty (or that your work is willing to pay for the penalty if needed).

I would certainly recommend this course to folks who expect to perform forensic investigations, and who have little to no experience with using forensically-sound methodologies searching for evidence, and especially for working with deleted evidence. I believe even folks with a moderate amount of experience will find it worthwhile, but folks who have done this for years probably know enough of the material to look elsewhere.


The primary goal of this site is to help others who perform forensic duties in higher education. I hope to share information regarding helpful tools and methods.

Feedback is allowed from anyone, but comments not submitted from registered TypeKey accounts will remain in a moderation queue pending approval.