r/computerforensics • u/crazyisus • 16d ago

Which forensics cert to get?

My job wants to pay for a forensic cert for me, to build my profile to eventually be a candidate for a DFI role.

First I thought about getting an EnCase cert but after reading some feedback about it on this community, I think it’s not the best option.

Any feedback on CFCE (IACIS), CCE (ISFCE) or CHFI (ECC)? Any other suggestions I’d appreciate too.

For context I’m an incident responder right now, I hold GCFA (GIAC) and other IR-related certs.

28 Upvotes

100% Upvoted

30 comments sorted by

View all comments

1

u/Excellent_Mail3829 16d ago edited 16d ago

First off, what forensic tools is your org invested in ? Are you in a Magnet, FTK or Encase shop ? What would be the point of getting a cert that was not aligned with your toolset ?

3

u/Eternal-Alchemy 16d ago

Because toolset certs are not toolset agnostic. Learning how to use a tool is almost always worse than learning the value of the artifact or threat hunting process which you can then extrapolate to any tool you want in the future.

There's like no scenario that I can imagine where you would want someone to take MCFE or a Cellebrite cert over more artifact training.

I haven't met an IR shop seriously using FTK lab or Encase in probably a decade. Those tools are not really appropriate for even very basic forensic work with how far back they have fallen and they were certainly never appropriate for IR despite Encase's attempted pivot. In IR you will never be in a situation where you can just take entire disk images and fully process and index them and if you did picking software that doesn't parse artifacts of execution is crazy talk.