The Certified Computer Examiner Certification

Computer forensics experts know how to preserve, identify, recover, and document computer data. Do you have what it takes to become a Certified Computer Examiner (CCE)?

Published January 19, 2004
By Michael C. Gregg

Page 1 of 2 1 2

As the computer security field continues to grow, so do the employment opportunities. Computer forensics is one of these rapidly growing fields. If you are the kind of person that enjoys the "who, what, when, where, and how" of a problem, this career niche might be a good fit for you.

What is computer forensics? Computer forensics is a clear, well-defined methodology that is used to preserve, identify, recover, and document computer data. While the computer forensics field is relatively new to the corporate sector, law enforcement has been practicing this science since the mid 1980's. The growth in this field is directly related to the ever-growing popularity of the PC. Today, computers are used for everything from creating email, transferring funds, purchasing stocks, managing corporate databases, to providing the backbone of the Internet.

It's not just the good guys that use computers. Criminals use computers, too! Some statistics show that computers are used in the commission of a crime as much as 92% of the time. This doesn't mean the computer was just used to commit the crime, but it was used as a tool. This could be for research, email, planning, or as an aid to avoid capture or detection.

The CCE Certification

While computer forensics certifications are not as mainstream as an MCSE or CCNA, there are several forensic certifications that are growing in prominence and that are worthy of investigation if you are considering this type of certification. One of these is the Certified Computer Examiner (CCE). The Southeast Cybercrime Institute at Kennesaw State University offers the CCE certification. What intrigued me most about this certification is its hands-on structure. Far too many certification programs lack this needed component. The certification process is divided into four parts. Three of the four parts of the exam are hands-on and require examination of computer media.

Forensic Duplication

During a forensic investigation, it's more than likely that you'll reach a point where you will need a copy of the evidence. The objective of disk imaging is to preserve the original copy in a pristine state and to provide the investigator with a copy to use for investigation. There are several ways the data can be copied:

Attach a clean, wiped drive used for forensics to the suspected computer.
Remove the drive from the suspected computer and attach it to a forensics computer.
Connect the forensics computer to the suspected computer by means of the NIC and crossover cable.

No matter what duplication method you choose, just make sure that the drive used for the collection of evidence is thoroughly cleaned and wiped.

The Requirements

In order to complete the CCE certification process, you will have to meet certain requirements:

Have no criminal record
Meet minimum experience or training requirements
Abide by the certification's code of ethical standards
Pass an online examination
Successfully perform actual forensic examinations on three test media

Each section must be completed and graded before you may proceed to the next portion. A cumulative, overall grade of 80% is required for successful completion of the certification process. There is a 90-day time limit for completion of the entire process. The clock starts when you pass the written exam.

Once the written examination has been completed, the applicant can begin the forensic examination of the test media. When you successfully complete the examination of the first test media, you will be provided with the next. These "real-life" forensic examinations are where you may find your skills being challenged. They are designed to test the forensic knowledge and skills of the examiner. 55% of your grade from the hands-on portion of the exam is comprised from your ability to successfully document and report your findings. This includes what you have done and how you have done it. I'm talking about the three A's here: Acquire, Authenticate, and Analyze. The three A's encompass items such as: chain of custody, evidence receipt, and how you have performed the examination and handled the media.

Page 1 of 2 1 2