Certified forensic computer examiner

The Certified Forensic Computer Examiner (CFCE) credential was the first certification demonstrating competency in computer forensics in relation to Windows based computers. The CFCE training and certification is conducted by the International Association of Computer Investigative Specialists (IACIS), a non-profit, all-volunteer organization of digital forensic professionals.

History

IACIS was formed and commenced training in 1990. The predecessor to the CFCE was the DOS Processing Certificate (DPC). The CFCE was introduced in 1998, when the training was expanded to include examination of Windows-based computers. The course materials also cover the MAC OS operating system and its associated file systems, however, the certificate only states proficiency in Windows.

Eligibility

In order to undertake the CFCE certification process, a candidate has to be a member of IACIS. IACIS membership is normally included in the fee to enter the CFCE training or certification process. There are two levels of membership in the organization, Regular and Associate. To be eligible for Regular membership, applicants must be a current full-time or former full-time law enforcement or government employee, or a current full-time contractor for a government agency. Regular members have access to training, certification, an active listserv and forensic research. Associate membership is available to current or aspiring members of the computer/digital forensics community that are able to pass a background check. Associate members have the same access to the benefits as Regular members with the exception that Regular members can vote and hold organizational offices. Proof of status will be verified upon application for membership. https://www.iacis.com/membership/membership-overview/

Certification process

The certification process may be taken internally or externally and is conducted in two phases: Peer Review and Certification.

An internal certification candidate attends a 2-week training course given by IACIS which covers high-level material related to Windows forensics. Two courses are conducted annually. The US-based course is conducted in the first half of the calendar year whilst the European-based course is conducted in the second half of the year. Upon successful completion of the course, the member is assigned a (volunteer) Peer Review coach. The coach guides the student through the Peer Review phase, a four-month process consisting of four different computer images and complex questions that require extensive forensic analysis to complete. Upon successful completion of the Peer Review phase the candidate is eligible to enter the Certification phase which consists of a written exam and practical exam based on a hard drive examination.

An external certification candidate does not attend the training, however, they must have the equivalent training that is comparable to the IACIS training.

Recertification

In order for certification to remain current, a member must undertake a proficiency test once per 3-year period after certification as well as complete 40 hours of continuing training in computer forensics or a related field. Additionally, the member must conduct as a minimum an average of 1 forensic examination per year, for a minimum of 3 examinations over the 3-year period. The member must also pay dues ($75 per year) and remain a member in good standing of IACIS.

Recognition

CFCE is one of the most widely recognized non-tool certifications in computer forensics for current and former law enforcement personnel.^[1] Some organizations such as the Computer Forensics Laboratory at Miami-Dade Police require their members to complete and maintain this certification.^[2]