EH-Net

Ethical Hacking Discussions and Related Certifications => EnCE - EnCase® Certified Examiner => Topic started by: Joshsevo on December 09, 2010, 01:05:00 PM



Title: EnCe Forensics Class
Post by: Joshsevo on December 09, 2010, 01:05:00 PM
So I am planning on taking the courses that EnCase offers on their website.  Forensics I & II.  Does anyone have any experience with and can you tell me how you thought they were.  Was it worth the money?

Did you feel you were ready to take the EnCase certif after that?
How were the instrucotrs?
Was lunch provided for the courses?
Was a hotel included in the price?



Title: Re: EnCe Forensics Class
Post by: sil on December 10, 2010, 09:37:15 AM
I suggest watching the following which WON'T help you on your question per-se, but may help guide your choice(s)

http://panopto.rwu.edu/Panopto/Pages/Viewer/Default.aspx?id=306ab43a-0839-4e6f-82ab-43c5a2c10acc

He discusses trends in forensics, tools used, liked, disliked, demographics, salaries, etc. Right now in spare time while I wait for my GREM, I'm doing ACE studies opting to pass on EnCE for now. Strangely, I saw on this guy's studies that more people prefer AD FTK over EnCase anyway. Neither here nor there, check out the video


Title: Re: EnCe Forensics Class
Post by: Joshsevo on December 10, 2010, 12:11:25 PM
Sil,

You always come through for me man.  Thanks again.


Title: Re: EnCe Forensics Class
Post by: sil on December 10, 2010, 12:48:55 PM
Not a problem. I'm actually debating this too from time to time - EnCE certification since I deal with EnCase from time to time. I also deal use FTK alongside EnCase but I actually prefer FTK. I use EnCase ONLY to validate the findings though. File carving, digging out info is done strictly through FTK. Pre 3.x versions of FTK rock, the newest is bloated thanks to Oracle. Anyway, I hope you found the video/talk useful


Title: Re: EnCe Forensics Class
Post by: Joshsevo on December 10, 2010, 01:20:37 PM
With my Internship that I have the guy really only deals with FTK and EnCase for most of the cases.  But according to him FTK and EnCase each have their own strengths and weaknesess.  EnCase is not so good with .PST files where as FTK excels at them.  So he said you should always use both in cases. 

I was using EnCase last night and spoke about these classes and he said he was a the very first one that EnCase offered when the first version of the software came out in 98'.