Let’s say you choose to take the CHFI first, the question you need to ask yourself is? Would you have the ability to truly think like a hacker in order to catch a hacker? If you spend more time learning about how and what techniques / tools the nefarious evil hacker will use? Your investigations will be far more successful because you have better knowledge to make a more precise technical guess-timate.
Sorry but I have to disagree with you here. Forensics and hacking are completely separate arenas and while it may help to understand hacking, hacking overall has less to do with forensics than you make out to be. Forensics from my perspective consist of determining what occurred on an machine/network/device and you don't necessarily have to know how to hack in order to determine what occurred and how it occurred.
After acquiring an image of your evidence the contents of image files are analyzed to identify evidence that either supports or contradicts a hypothesis or for signs of tampering (to hide data)
Either supports or contradicts?
No. Your role as a forensics investigator is to determine in an unbiased fashion what occurred period. You're not focused on "
supporting" or "
contradicting"
anyone. You're goal is to provide
solid evidentiary information which at some point may be used in a court of law. You're not a judge, you're not a lawyer's or DA's assistant. You're role is to provide your expertise on the events that occurred on the evidence in question.
I taught a lady that was certified as an FTK or Encase investigator having never learnt anything about hacking etc, and after her training she was so thankful that she could improve her investigations many times over. Cause she was able to grasp a much deeper and broader understanding of how the break-in happened so she knew more precisely where to look for the evidence.
Being a systems administrator or a network administrator would yield the same amount of experience. Should a RHCE shoot for the CHFI, EnCE, CCE? Forensics and hacking are two different arenas period. I understand where you're coming from but if you're going to focus on forensics, there is a
LOT MORE you will need to know that you should be focusing your time on. I know "uber" pentesters with enough certifications to fill a page who know little about file system formats. Yet their certified, they've read books, but haven't gotten a clue. I don't think at any point in time someone NEEDS to learn hacking in order to become a good forensics investigator.
I also know people who work at Fortune 10's (not 50's, not 100's, not 500's but the top 10) who do incident response, forensics, who've taught in Universities, learned under Eugene Spafford, etc., and they can't hack their way out of a wet paper bag with a chainsaw.
One of the biggest challenges when I teach ILT classes which is not very often anymore! Is HOW THE HELL AM I GOING TO GET THROUGH SO MUCH MATERIAL in 5 days? And end with a result that I am confident the learner will go-out and succeed. It’s for this reason that I created CEH, CHFI etc SWAT, Blended Learning style.
One my pet peeves is, "take this X day course!", "you'll be an expert!" I've read and had the opportunities over the years to correspond with people like Dan Farmer when he made Titan (as I was creating a BSD version), Wietse Venema and others who are legends in the forensics industry. Guess what, not one hacks. It takes a lot more than just "take this bootcamp...", "EC-Council" and other things you've mentioned in your post.
While I (again), understand why you would *
think* someone may benefit from learning C|EH content, the reality is *drum roll* studying C|EH material is mainly useless and the time and money could be well spent elsewhere. *posters note* I hold the C|EH and CHFI... Have had them for years now... Have been tinkering slash dealing with security before EC-Council was even an idea.
My suggestion would be to learn A+ content, understand filesystem structures, how memory works, how and where cache and virtualized memory work and where do they store data. Focus on networking and operating systems. You'll be better off at the end of the day than worrying about learning 50+ questions on NMAP. "Why can't you run an NMAP XMAS scan on Windows 98"... How is this (real world C|EH question) going to help someone understand forensics.