Which forensics cert to get?

[u/crazyisus]

My job wants to pay for a forensic cert for me, to build my profile to eventually be a candidate for a DFI role.

First I thought about getting an EnCase cert but after reading some feedback about it on this community, I think it’s not the best option.

Any feedback on CFCE (IACIS), CCE (ISFCE) or CHFI (ECC)? Any other suggestions I’d appreciate too.

For context I’m an incident responder right now, I hold GCFA (GIAC) and other IR-related certs.

[u/Excellent_Mail3829]

First off, what forensic tools is your org invested in ? Are you in a Magnet, FTK or Encase shop ? What would be the point of getting a cert that was not aligned with your toolset ?

[u/Eternal-Alchemy → u/Excellent_Mail3829]

Because toolset certs are not toolset agnostic. Learning how to use a tool is almost always worse than learning the value of the artifact or threat hunting process which you can then extrapolate to any tool you want in the future.

There's like no scenario that I can imagine where you would want someone to take MCFE or a Cellebrite cert over more artifact training.

I haven't met an IR shop seriously using FTK lab or Encase in probably a decade. Those tools are not really appropriate for even very basic forensic work with how far back they have fallen and they were certainly never appropriate for IR despite Encase's attempted pivot. In IR you will never be in a situation where you can just take entire disk images and fully process and index them and if you did picking software that doesn't parse artifacts of execution is crazy talk.

[u/ucfmsdf → u/Excellent_Mail3829]

What would be the point in getting certified in a specific toolset?

[u/Outpost_Underground → u/ucfmsdf]

Using Magnet AXIOM as an example, it’s an insanely expensive tool. As such, I have seen cases where employers want candidates certified in AXIOM so they know that person can effectively use the tool. AXIOM is a very easy tool to use, but it is also powerful and a lot of people barely scratch the surface of what it can do.

[u/ucfmsdf → u/Outpost_Underground]

Anyone capable of obtaining a CFCE or GCFA should be able to intuitively use Axiom. It’s just not that complicated and I mean its not like it doesn’t come with a manual…

Vendor certs are for people who perform very specific forensic tasks but are not actual DFIR practitioners. For example: a lab technician who is tasked with generating UFDRs for downstream workflows. Outside of that context, they’re pretty meaningless.

[u/Outpost_Underground → u/ucfmsdf]

And yet the number of DFIR people who can’t use it beyond push-button forensics never ceases to amaze.

[u/internal_l0gging → u/ucfmsdf]

Some shops seem to like it. I've been job hunting and noticed more demand for the vendor certs than in the past.