This hands-on course is designed for EnCase® users who are preparing for the EnCE (EnCase Certified Examiner) certification process. The EnCE certification is a highly sought-after accreditation, which requires significant knowledge of computer forensics and Guidance Software’s EnCase® product to successfully achieve. The two-phase testing process is based upon a written examination and also the completion of a thorough practical scenario examination and preparation of an investigative report. The certification is based upon the practical computer forensic skills and knowledge presented in Guidance Software’s EnCase Computer Forensic I and Computer Forensic II courses. The EnCE Prep course is NOT intended to be a replacement for these two classes. Instead it is a thorough but accelerated review of the subjects covered in those courses. Students cannot waive or substitute the prerequisite attendance of Guidance Software’s EnCase Computer Forensics II course when applying to attend the EnCE Prep course.

Students will review the body of knowledge required to perform computer forensics. This body of knowledge in the areas of computer science, computer forensic terminology, law, and familiarity with the EnCase® forensic tool is the core of the first phase (written examination) of the certification process.
On the final afternoon of the course, the EnCE written examination will be administered to the students in a monitored, timed environment. The results of the written examination will be provided immediately following the completion of the examination, at which time those who achieved a passing score of 80% or more will also receive their practical examination.
During this course students actively use EnCase® Forensic v7 software to review the skill set required to address the EnCE practical examination, including:
  • Basic EnCase® concepts and navigating within the EnCase® environment
  • Creating and managing cases
  • The proper handling and acquisition of evidence
  • Creating evidence files
  • Basic computer functions as well as that of various computer file systems
  • Searching through evidence evidence and viewing and bookmarking the search results
  • Conducting signature analyses of files and analyzing the resultant information
  • Computing hash values, creating hash sets, and compiling hash libraries
  • Recovering evidence from printed output and the Recycle Bin
Download Course Syllabus