Certified Computer Examiner

Preparing for the CCE

The Certified Computer Examiner (CCE) has evolved into one of the most desired certifications in the digital forensics industry. The certification is granted only after an applicant has completed a rigorous, standardized testing process. Additionally, an applicant is required to agree to and sign the ISFCE Code of Ethics and Professional Responsibility, submit a notarized statement that all work on the certification is done without assistance, undergo a criminal background check and achieve approval from the ISFCE Certification Board.

The CCE certification process is a pure testing process. CCE candidates are not permitted to solicit or accept assistance from anyone at any level after registering for the CCE certification process. Third party review of and/or commentary on examination reports is not allowed. CCE candidates are required to abide by a signed ISFCE Code of Ethics and Professional Responsibility and are made aware of all testing requirements and guidelines at the beginning of the certification process. All work to complete the CCE certification process must be done solely by the individual CCE candidate. CCE candidates may not corroborate, work jointly, cheat or plagiarize other’s work to complete the CCE testing process.

Competencies

The goal of the CCE competencies is to outline the necessary level of proficiency required for a CCE test candidate. The CCE applicant may or may not be tested on all subject areas listed. The CCE testing process is designed to test an applicant’s proficiency in several areas pertinent to digital forensics. The applicant is required to complete an online test and forensically examine three pieces of media, submitting a report after each examination.

CCE Competencies

Requirements to sit for the CCE

In order to be accepted into the CCE testing process, the applicant must:

Complete training at a CCE Bootcamp, Authorized Training Partner (ATP) or Authorized Training Center (ATC). This training must be verifiable by a third party.




- OR -

Possess a minimum of 18 months of verifiable professional experience conducting digital forensic examinations. This experience must be verifiable by a third party.




- OR -

Have documented self study in the field of digital forensics deemed appropriate by the Certification Board. This must include detailed information on all pratical experience, professional experience, related education, credentials, and any other information that will help determine the likelihood of the candidate's potential success in sitting for the testing.

Training for the CCE

The ISFCE has Authorized Training Centers (ATCs) around the world to train specifically for this testing. It is highly suggested that you choose to enroll within one of these courses prior to attempting the CCE certification testing, especially if you are new to the field of computer forensics.

All ATC course offerings are thoroughly reviewed and scrutinized by the ISFCE prior to granting ATC status to that organization. The ISFCE reviews all ATC course material and assesses whether or not the curriculum adequately meets the testing standards for the Certified Computer Examiner (CCE) exam. These testing standards are released under a non disclosure agreement to the ATC in order to assist the ATC in evaluating existing course materials. The ISFCE does not release the Certified Computer Examiner (CCE) Testing Standards to the general public in order to protect the integrity of the certification process. The Certified Computer Examiner (CCE) Testing Standards are posted in more general terms under the Skill Level section of this website.

Only training organizations that display the CCE BootCamp Authorized Training Partner / Authorized Training Center logo are approved by the ISCFE to prepare candidates to sit for the CCE certification.

The ISFCE has encountered training organizations that state they prepare individuals for the CCE certification process, yet they are not approved to do so. If these organizations are not designated as an Authorized Training Center (ATC), the ISFCE does not recognize that training as a program that sufficiently prepares for the CCE. If you are aware of an organization that is representing itself as an ISFCE Authorized Training Center but is not included in this list, please email details of this to info@isfce.com.

General skillset

The Certified Computer Examiner (CCE) certification testing process will require a candidate to have:

• Basic understanding of PC hardware
• Basic understanding of PC networking
• Good understanding of Microsoft Office applications and how to access the metadata that is stored within MS Office documents
• Basic understanding of common data formats by header, appearance, etc.
• Basic understanding of how to defeat passwords
• Basic understanding of CDR recording processes
• Basic understanding of Internet issues, such as doing a "who is" search , determining ownership of a domain name, etc.
• The ability to write clear, understandable, and comprehensive examination reports in the English language
• The ability to organize and present exhibits in or as an attachment to reports

The examination will cover essential forensic computer examination procedures, basic PC hardware construction and theory, very basic networking theory and basic data recovery techniques.

Difficulty

The CCE testing process should not be too difficult for experienced examiners who have a good knowledge of forensic examination procedures, basic legal considerations, basic networking principles, basic data recovery techniques, authenticating documents, basic password recovery and basic Internet issues.

The concepts tested for certification are designed to be similar to what an examiner may encounter in civil or law enforcement examinations. No extreme measures have been taken to hide data, such as bit shifting and splitting files. The certification problems are designed to be straight forward and reflect situations found during professional practice.

Suggested tools

If you are currently conducting digital forensic examinations, the software and utilities you use to complete these examinations should be sufficient to complete the Certified Computer Examiner (CCE) examination process. The purpose of the list below is to provide examples of the types of software and utilities that will be necessary to successfully complete the testing process:

CCE Certification Process

In order to become a Certified Computer Examiner (CCE), a candidate must undergo a four part testing process. Once gained, the CCE Certification will remain valid for two calendar years at which time the candidate will be eligible for Recertification.

In order to begin this process, a candidate will first need to submit an Application Form:

CCE Testing Application

Once this has been approved, he or she will need to visit our payment area and purchase the CCE Process ($485.00). Once this payment has been processed, the candidate will then begin receiving instructions on moving forward in the testing typically within 1 business day.

Although the CCE is an international certification, note that all testing materials are provided in the English language. Likewise, all candidate submissions are expected to be written in English unless otherwise previously agreed upon by the ISFCE. Note that the ISFCE's assessors are aware that many candidates may not speak English as a primary language. In cases such as this, grammatical consideration and allowance is provided.

CCE Certification Fees

• CCE Testing Process - $485.00 USD
• CCE Recertification (every 2 years) - $150.00 USD
• Retake the CCE Testing Process (after waiting period) - $250.00 USD
• CCE Reinstatement - $250.00 USD

In an effort to keep the organization's costs down, it is preferred the that payment be made online using a credit card. However, we will accept other forms of payment such as Purchase Orders or checks. Please contact our office at (629) 215-5528 or info@isfce.com for assistance with this.

Online payment by credit card can be made by visiting the CCE Certification Payment page:

CCE Certification Payment

The CCE Certification test fee is approved for reimbursement from the GI Bill and Veterans Educational benefits.

No refunds are available for the CCE Ceritification testing, Recertification testing, or Retake of the CCE Process. Please read all directions carefully as you proceed with payment and throughout the testing process.

CCE Recertification

Per ISFCE policy, a Certified Computer Examiner (CCE) certification remains valid for two calendar years from the date of issuance. The CCE becomes eligible for Recertification after this time. In order to help facilitate this, the ISFCE has provided an additional six month grace period for completing this process.

Once a candidate has entered the grace period, he or she will need to begin by visiting our payment page and purchase the CCE Recertification ($150.00). Once this payment has been processed, the candidate will then begin receiving instructions on moving forward in the testing typically within 1 business day.

Only currently certified individuals may register for and attempt recertification. To recertify, certified individuals must resubmit all forms including a Recertification Application, Code of Ethics and Professional Responsibility and Notarized Statement.

The CCE Recertification process consists of submitting an application form outlining fulfillment of continuing education requirments as well as professional experience. However, if practical experience conducting digital forensic investigations has not been gained during the last two years, the option to sit for a Practical Examination is also available.

ISFCE policy requires that all CCE Recertification Candidates complete:

Forty (40) hours of Continuing Professional Education credits (CPE) relevant to the CCE Certification, practice of digital forensics or a specialty related to that field with the intent of expanding the recertification candidate’s practical skills and abilities during the 2 year certification period (CPE Guidelines).




- AND -

Documented completion of no less than three (3) digital forensic examinations during the 2 year certification period



• If the recertification candidate does not possess the relevant work experience listed above, that candidate may complete a practical examination exercise in lieu of the work experience.

Both of the items above will need to be fully documented within the Recertification Application form after initiating Recertification testing. All recertification candidates must posess the required continuing education hour to recertify.

It is very important that all CCEs provide working email addresses to the ISFCE as periodic Recertification reminders will be sent via email.

Members

The CCE certification is rapidly growing in size and recognition. There are now a number of companies and government agencies that require their forensic computer examiners to hold the CCE certification in order to obtain or maintain their position.

CCE Certified Individuals List

ISFCE Toolbelt

Contact Us

Please contact us below if you have any questions surrounding the CCE Certification.

Not a robot