2/12/2020 Best Digital Forensics Certifications

Product and service reviews are conducted independently by our editorial team, but we sometimes make money
when you click on links. Learn more.

Build Your Career  Get Ahead

Best Digital Forensics Certi cations

By Ed Tittel, Kim Lindros and Mary Kyle, Business News Daily Contributing Writers January 3, 2019
0 0 0 0 0 MORE 

Shutterstock/TrifonenkoIvan

There is an appreciable number of available, high-quality certi cation programs

that focus on digital investigations and forensics. However, there are also many
certi cations and programs in this area that are far less transparent and widely
known.

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 1/15
2/12/2020 Best Digital Forensics Certifications

There's been a steady demand for digital forensics certi cations for the past
several years, mainly owing to the following:

Computer crime continues to escalate. As more cybercrimes are reported, more investigations and
quali ed investigators are needed. This is good news for law enforcement and private investigators
who specialize in digital forensics.
There's high demand for quali ed digital forensics professionals because nearly every police
department needs trained candidates with suitable credentials.
IT professionals interested in working for the federal government (either as full-time employees or
private contractors) must meet certain minimum training standards in information security. Digital
forensics quali es as part of the mix needed to meet them, which further adds to the demand for
certi ed digital forensics professionals.

As a result, there is a continuing rise of companies that offer digital forensics

training and certi cations. Alas, many of these are "private label" credentials that
are not well recognized. Making sense of all options and nding the right
certi cation for you may be trickier than it seems.

To help choose our top ve certi cations for 2019, we looked at several popular
online job boards to determine the number of advertised positions that require
these certi cations. While the actual results vary from day to day and by job board,
this should give you an idea of the number of digital forensic jobs with speci c
certi cation requirements.

Job board search results (in alphabetical order, by certi cation)*

  SimplyHired   Indeed   LinkedIn Jobs   LinkUp  Total

Vendor neutral
CFCE (IACIS) 63 82 117 46 308
CHFI (EC-Council) 106 140 253 68 567
GCFA (SANS GIAC)  422 489 857 294 2,062
GCFE (SANS GIAC)  203 226 433 143 1,005
Vendor speci c
ACE (AccessData) 25 29 31 12 97

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 2/15
2/12/2020 Best Digital Forensics Certifications

EnCE (EnCase) 110 154 237 114 615

*We covered two GIAC credentials, presented together in a single GIAC section
below.

Digital forensics is a relatively lucrative space for practitioners. The average salary
for intermediate digital forensic jobs in the U.S. – $63,959, according to
SimpyHired – trails that of network engineers, system administrators and project
managers. However, a senior specialist or forensic analyst, whether working in the
private industry or government channels, will often earn six gures in major metro
areas. We found salaries on the high end running almost $107,000 for forensic
analysts and more than $127,000 for digital forensic roles.

ACE: AccessData Certi ed Examiner

AccessData is the maker of the popular Forensic Toolkit (FTK) solution for digital
investigations. The company also offers a variety of related products and services,
such as AD Lab, AD eDiscovery, AD Enterprise and AD Triage.

The AccessData Certi ed Examiner (ACE) is worth pursuing for those who already
use or plan to use FTK, which enjoys widespread use in law enforcement and
private research and consulting rms. The certi cation requires one exam, which
covers the FTK Imager, Registry Viewer, PRTK (Password Recovery Toolkit) and FTK
Examiner Application/Case Management Window tools in detail. AccessData
recommends basic to moderate forensic knowledge before attempting the exam.
This includes an understanding of digital artifacts, Registry les, encrypting and
decrypting les, hashing, attack types, using live and index searching, and other
topics. See the latest ACE Study Guide for details.

Recerti cation is required every two years. Credential holders must pass the
current ACE exam, which focuses on the most current versions of FTK and other
tools, to maintain their credentials.

ACE facts and gures

Certi cation AccessData Certi ed Examiner (ACE)

name
https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 3/15
2/12/2020 Best Digital Forensics Certifications

Prerequisites None; training recommended:

and required AccessData FTK BootCamp (three-day classroom or live online)
courses FTK Intermediate courses
One exam (ACE 6); includes knowledge-based and practical portions
Number of
exams
Registration required to receive a join code to access the testing portal
Cost per exam $100 (exam fee includes retakes and recerti cation exams)
URL http://accessdata.com/training/computer-forensics-certi cation
There is a link to the free ACE Study Guide is on the certi cation webpage.
Self-study
The testing portal includes study videos, lessons in PDF and a practice
materials
test (with an image le).

AccessData A30-327: AccessData Certi ed Examiner exam On Udemy ►

CFCE: Certi ed Forensic Computer Examiner

The International Association of Computer Investigative Specialists (IACIS) is the

organization behind the Certi ed Forensic Computer Examiner (CFCE) credential.
This organization caters primarily to law enforcement personnel, and you must be
employed in law enforcement to qualify for regular IACIS membership.

A formal application form, along with an application fee, is necessary to join IACIS.

Regular membership includes current computer/digital forensic practitioners who
are current or former government or law enforcement employees or forensic
contractors to a government agency. All other practitioners can apply for Associate
membership to IACIS, provided they can pass a background check. Membership
fees and annual renewal fees are required. IACIS membership is not required to
obtain the CFCE credential.

To obtain the CFCE credential, candidates must demonstrate pro ciency with CFCE
core competencies. One option is IACIS' Basic Computer Forensic Examiner (BCFE)

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 4/15
2/12/2020 Best Digital Forensics Certifications

two-week training course; it meets the 72-hour training requirement, costs $2,995,
includes a free laptop and waives the IACIS membership fee for nonmembers.
IACIS membership is required to attend the course. Candidates completing the
training course can enroll directly in the CFCE program upon completion of the
course. Those not attending the BCFE course may meet the 72-hour training
requirement with a comparable course (subject to IACIS approval), pay a $750
registration fee, and successfully pass a background check to enroll in the CFCE
program and sit for the exam.

The CFCE exam is a two-step testing process that includes a peer review and CFCE
certi cation testing:

1. The peer review consists of accepting and completing four assigned practical problems based on
core knowledge and skills areas for the credential. These must be solved and then presented to a
mentor for initial evaluation (and assistance, where needed) before being presented for peer review.
Candidates have 30 days to complete each of the practical problems.
2. Upon successful conclusion of the peer review, candidates automatically progress to the
certi cation phase.
Candidates must begin work on a hard-drive practical problem within seven days of the
completion of the peer review phase. Forty days are allotted to candidates to independently
analyze and report upon a forensic image of a hard drive provided to them. Following speci c
instructions, a written report is prepared to document the candidate's activities and ndings.

Once that report is accepted and passed, the process concludes with a 100-question written
exam (which includes true/false, multiple-choice, matching and short-answer questions).
Candidates have 14 days to complete the written examination. A passing score of 80 percent or
better is required for both the forensic report and the written exam to earn the CFCE.

Upon completion of both the peer review and the certi cation phase, candidates
must submit a notarized form certifying that the practical and written exams were
completed independently without assistance from anyone else.

Certi cants must recertify every three years to maintain the CFCE credential.
Recerti cation requires proof of at least 40 hours of professional education, a
passing score on a pro ciency test in the third year, proof of computer/digital
forensics work experience, or passing scores on three pro ciency tests within three

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 5/15
2/12/2020 Best Digital Forensics Certifications

years, and either three years of IACIS membership or payment of a $150

recerti cation fee.

Despite the time and expense involved in earning a CFCE, this credential has high
value and excellent name recognition in the computer forensics eld. Many
forensics professionals consider the CFCE a necessary merit badge to earn,
especially for those who work in or for law enforcement.

CFCE facts and gures

Certi cation
Certi ed Forensic Computer Examiner (CFCE)
name
Basic Computer Forensics Examiner (BCFE) training course
recommended ($2,995)

Prerequisites
72 hours of training in computer/digital forensics comparable to CFCE
and required
core competencies; BCFE training course meets training requirement
courses

Without BCFE training: take a comparable course, pay $750 registration

fee and pass a background check
Two-part process: Peer review (must pass to proceed to subsequent
Number of
phase) and certi cation phase (includes hard-drive practical and written
exams
examination)
Included in BCFE training; $750 for the entire testing process for those
Cost per exam
not attending BCFE training
URL https://www.iacis.com/certi cation-2/cfce/
Self-study IACIS is the primary conduit for training and study materials for this
materials certi cation.

CHFI: Computer Hacking Forensic Investigator

The EC-Council is a well-known training and certi cation organization that

specializes in the areas of anti-hacking, digital forensics and penetration testing.
The organization's Computer Hacking Forensic Investigator (CHFI) certi cation

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 6/15
2/12/2020 Best Digital Forensics Certifications

emphasizes forensics tools, analytical techniques, and procedures involved in

obtaining, maintaining, and presenting digital forensic evidence and data in a
court of law.

The EC-Council offers training for this credential but permits candidates to
challenge the exam without taking the course, provided they have a minimum of
two years of information security experience and pay a non-refundable $100
eligibility application fee.

The CHFI course covers a wide range of topics and tools (click the exam Blueprint
button on the certi cation webpage). Topics include an overview of digital
forensics, in-depth coverage of the computer forensics investigation process,
working with digital evidence, anti-forensics, database and cloud forensics,
investigating network traf c, mobile and email forensics, and ethics, policies and
regulations. Courseware is available, as well as instructor-led classroom training.

The EC-Council offers numerous other certi cations of potential value to readers

interested in the CHFI. These include the Certi ed Ethical Hacker (CEH), CEH
(Practical), EC-Council Certi ed Security Analyst (ECSA), ECSA Practical, Certi ed
Network Defender (CND) and Licensed Penetration Tester (LPT), Certi ed
Application Security Engineer (CASE), and Certi ed Chief Information Security
Of cer (CCISO). It also offers credentials in related areas such as disaster recovery,
encryption and security analysis. Visit the EC-Council site for more info on its
popular and respected credentials.

CHFI facts and gures

Certi cation
Computer Hacking Forensic Investigator (CHFI) v9
name
Prerequisites  
and required Application with resume and current or previous employer info required.
courses Candidates must agree to the EC-Council Non-Disclosure, Candidate
Application and Candidate Certi cation agreement terms.
Training recommended but not required:
Live, online instructor-led training (includes courseware, six months of iLabs
access, exam voucher and test prep program; contact EC-Council directly for pricing)

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 7/15
2/12/2020 Best Digital Forensics Certifications

iLearn self-paced class (includes one year of access to instructor-led training

videos, courseware, six months of lab access and exam voucher; $1,899)

Self-study courseware ($677)

Mobile training (contact EC-Council for pricing information)

To challenge the exam without training, you must have two years of

information security work experience and/or education to re ect
specialization, pay a non-refundable application fee of $100, and complete
the Exam Eligibility Application Form.
More information on the application process is located on the Application
Eligibility Process webpage. 
Number of One exam: EC0 312-49 (150 questions, four hours, passing score 70
exams percent, multiple choice). Available through the ECC exam portal.
Cost per $500 (plus $100 application fee; candidates who do not participate in
exam training must pay a $650 exam fee plus $100 application fee)
https://www.eccouncil.org/programs/computer-hacking-forensic-
URL
investigator-ch /
Visit the EC-Council Store and search for "CHFI" for preparation materials,
Self-study
including labs. Study guide and exam guides are available on Amazon, as
materials
well as some practice exams.

Computer Hacking Forensic Investigator(CHFIv9) Practice Exam On Udemy ►

EnCe: EnCase Certi ed Examiner

Guidance Software, acquired by OpenText in 2017, is a leader in the forensics tools

and services arena. Its well-known and widely used EnCase Forensic software
helps professionals acquire data from many different types of devices, complete
disk-level examinations and produce reports of their ndings. The company also
sells software for remote investigations (EnCase Endpoint Investigator),
eDiscovery, risk management, mobile investigations and endpoint security.

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 8/15
2/12/2020 Best Digital Forensics Certifications

The company's certi cation program includes the Certi ed Forensic Security
Responder (CFSR), EnCase Certi ed eDiscovery Practitioner (EnCEP) and EnCase
Certi ed Examiner (EnCe). Available to professionals in the public and private
sector, the EnCE recognizes an individual's pro ciency using EnCase Forensic
software and mastery of computer investigation methodology, including evidence
collection, preservation, le veri cation, le signatures and hashing, rst
responder activities, and much more.

To achieve EnCe certi cation, candidates must show proof of a minimum of 64

hours of authorized computer forensic training or 12 months of quali ed work
experience, complete an application, and then successfully complete a two-phase
exam that includes a written and practical portion.

EnCE certi cations are valid for three years from the date obtained. Recerti cation
requires one of the following:

32 credit hours of continuing education in computer forensics or incident response

A computer forensics or incident response-related certi cation

Attendance at an Enfuse conference (at least 10 sessions)

EnCE facts and gures

Certi cation
EnCase Certi ed Examiner (EnCe)
name
Required: 64 hours of authorized computer forensic training or 12 months
of work experience in computer forensics
Training options through Guidance Software:
Prerequisites EnCE Prep Course (DF310), classroom, virtual classroom or on demand ($2,195)
and required EnCE Certi cation Bootcamp (aimed at new digital investigators) – includes
courses DF120 (Foundations in Digital Forensics), DF210 (Building an Investigation) and
DF310 ($5,085 for the bundle)

Completion of the EnCE application

Number of One two-phase exam:
exams
https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 9/15
2/12/2020 Best Digital Forensics Certifications

Phase I written exam (180 questions, two hours, minimum passing score 80
percent), delivered via ExamBuilder
Phase II practical exam (18 questions, 60 days, minimum passing score 85
percent)

Passing the Phase I exam earns an electronic license to complete the

Phase II exam.
$200 total, or $300 international
Cost per exam
$75 renewal fee
https://www2.guidancesoftware.com/training/Pages/ence-certi cation-
URL
program.aspx
Study materials provided in Guidance Software courses. Check Amazon for
Self-study availability of current and practice exams.
materials Learning On Demand subscription provides access to 400 courses across
the OpenText Learning Services platform.  

GCFA And GCFE Certi cations

SANS is the organization behind the Global Information Assurance Certi cation
(GIAC) program. It is a well-respected and highly regarded player in the
information security eld in general. SANS not only teaches and researches in this
area, it also provides breaking news, operates a security alert service, and serves
on all kinds of government, research and academic information security task
forces, working groups, and industry organizations.

The organization's incident response and forensics credentials include the

following:

GIAC Certi ed Forensic Examiner (GCFE)

GIAC Certi ed Forensic Analyst (GCFA)

GIAC Reverse Engineering Malware (GREM)
GIAC Network Forensic Analyst (GNFA)

GIAC Advanced Smartphone Forensics (GASF)

GIAC Cyber Threat Intelligence (GCTI)

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 10/15
2/12/2020 Best Digital Forensics Certifications

The intermediate GCFE and the more senior GCFA are the focus of this section.
Neither credential requires taking SANS courses (which have a strong reputation
for being among the best in the cybersecurity community, with high-powered
instructors to match), but they are recommended to candidates and often offered
before, during or after SANS conferences held around the U.S. at regular intervals.

Both the GCFE and GCFA focus on computer forensics in the context of
investigation and incident response, and thus also focus on the skills and
knowledge needed to collect and analyze data from Windows and/or Linux
computer systems during such activities. Candidates must possess the necessary
skills, knowledge, and ability to conduct formal incident investigations and
advanced incident handling, including dealing with internal and external data
breaches, intrusions, and cyberthreats; collecting and preserving
evidence; understanding anti-forensic techniques; and building and documenting
advanced digital forensic cases.

Most SANS GIAC credentials are valid for four years. Candidates may recertify for
the GCFE and GCFA by earning 36 continuing professional experience (CPE)
credits. In addition, credential holders must pay a certi cation maintenance fee of
$429 every four years.

The SANS GIAC program encompasses more than 36 information security

certi cations across a broad range of topics and disciplines. IT professionals
interested in information security in general, as well as digital forensics, would be
well advised to investigate further on the GIAC homepage.

GCFE and GCFA facts and gures

Certi cation GIAC Certi ed Forensic Examiner (GCFE)

name GIAC Certi ed Forensic Analyst (GCFA)
Prerequisites None
and required
courses GCFE recommended course: FOR500: Windows Forensic Analysis ($6,210)

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 11/15
2/12/2020 Best Digital Forensics Certifications

GCFA recommended course: FOR508: Advanced Digital Forensics, Incident

Response, and Threat Hunting ($6,210)
One exam for each credential (115 questions, three hours, passing score of
71 percent)
Number of
exams
Exams proctored by Pearson VUE. Registration with GIAC required to
schedule an exam.
$769 if part of training/bootcamp

Cost per
$1,899 (no training – referred to as a certi cation challenge)
exam

Additional details available here.

URL www.giac.org
Practice tests available on the GIAC exam preparation page (two tests
Self-study
included in exam fee; additional practice tests are $159 each). Study guides
materials
and practice exams can be found on Amazon and other typical channels.

GIAC Certi ed Forensics Analyst (GCFA) On Udemy ►

Beyond the top 5: More digital forensics certi cations

There are lots of other certi cation programs that can help to further the careers
of IT professionals who work in digital forensics.

One certi cation we've featured in the past is the CyberSecurity Institute's
CyberSecurity Forensic Analyst (CSFA). The CyberSecurity Institute provides digital
forensic services aimed at law rms, businesses and individuals, and administers a
small but well-respected certi cation program. The CSFA is designed for security
professionals with at least two years of experience performing digital forensic
analysis on computers and devices running the Windows operating system and
creating investigative reports. Although the certi cation didn't generate as many
job board hits as our other featured certi cations, the CSFA is still worth your
attention.
https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 12/15
2/12/2020 Best Digital Forensics Certifications

The same goes for the Certi ed Computer Examiner (CCE) from the International
Society of Forensic Computer Examiners, also known as ISFCE. The CCE is well
recognized in the industry and in the law enforcement community as a leading
credential for digital forensics professionals, but it fell a little short on job board
hits during our review this year.

Other good certi cations include the Professional Certi ed Investigator (PCI), a
senior-level, vendor-neutral computer investigations and forensics credential
available through ASIS International. The organization also offers the Certi ed
Protection Professional (CPP), which includes an investigation component, and the
Physical Security Professional (PSP) in its certi cation program. Forensics
candidates can also pursue one of the High Tech Crime Network vendor-neutral
certi cations – the Certi ed Computer Crime Investigator or Certi ed Computer
Forensic Technician, both of which have a Basic and an Advanced credential.

If you look around online, you'll nd numerous other forensics hardware and
software vendors that offer certi cations and plenty of other organizations that
didn't make the cut for the 2019 list of the best digital forensics certi cations. But
before you wander outside the items mentioned in this article, you might want to
research the sponsoring organization's history and the number of people who've
earned its credentials, and then determine whether the sponsor not only requires
training but stands to pro t from its purchase.

You might also want to ask a practicing digital forensics professional if they've
heard of the certi cations you found on your own and, if so, what that professional
thinks of those offerings.

YOU MAY ALSO LIKE

Best InfoSec and Cybersecurity

Certi cations of 2020

EC-Council Certi cation Guide:

Overview and Career Paths

SANS GIAC Certi cation Guide:

Overview and Career Paths
https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 13/15
2/12/2020 Best Digital Forensics Certifications

PRODUCT AND SERVICE REVIEWS

MCSE and Other Evergreen IT

Certi cations 2019

NextGen Review: Best EMR for Small

Practices

Best EHR System Overall:

AdvancedMD Review

BUILD-YOUR-CAREER SEE ALL 

Best InfoSec and Cybersecurity EC-Council Certi cation Guide:

Certi cations of 2020 Overview and Career Paths

SANS GIAC Certi cation Guide: Best Business Continuity and

Overview and Career Paths Disaster Recovery Certi cations in
2019

Best Linux Certi cations

    

About Us Contact Us Partner with Us Copyright Policy Terms of Use Privacy Policy Do Not Sell My Personal Information
Advertising Disclosure Sitemap

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 14/15
2/12/2020 Best Digital Forensics Certifications

200 Fifth Avenue, Second Floor

Waltham, MA 02451
info@businessnewsdaily.com
Copyright © 2020 All Rights Reserved.

https://www.businessnewsdaily.com/10755-best-digital-forensics-certifications.html 15/15