Certified Computer Examiner

CCE Logo

The principal certification offered by the ISFCE is the Certified Computer Examiner (CCE). First awarded in 2003, this certification is the result of the ISFCE’s desire to increase the level of professionalism and further the field and science of computer forensics.

The foundation of this certification maintains a fair, uncompromised process for certifying the competency of forensic computer examiners and sets high forensic and ethical standards for forensic computer examiners.

The CCE certification is rapidly growing in size and recognition. There are now a number of companies and government agencies that require their forensic computer examiners to hold the CCE certification in order to obtain or maintain their position.

The purpose of the Certified Computer Examiner certification is to:

  • Professionalize and further the science of digital forensics
  • Provide a fair, vendor-neutral, uncompromised process for training and certifying forensic computer examiners
  • Set high forensic and ethical standards for the industry
  • Conduct research and development into new and emerging technologies and methods in the science of digital forensics
  • Build a strong community of like-minded professionals and industry leaders

Preparing for the CCE

The Certified Computer Examiner (CCE) has evolved into one of the most desired certifications in the digital forensics industry. The certification is granted only after an applicant has completed a rigorous, standardized testing process. Additionally, an applicant is required to agree to and sign the ISFCE Code of Ethics and Professional Responsibility, submit a notarized statement that all work on the certification is done without assistance, undergo a criminal background check and achieve approval from the ISFCE Certification Board.

The CCE certification process is a pure testing process. CCE candidates are not permitted to solicit or accept assistance from anyone at any level after registering for the CCE certification process. Third party review of and/or commentary on examination reports is not allowed. CCE candidates are required to abide by a signed ISFCE Code of Ethics and Professional Responsibility and are made aware of all testing requirements and guidelines at the beginning of the certification process. All work to complete the CCE certification process must be done solely by the individual CCE candidate. CCE candidates may not corroborate, work jointly, cheat or plagiarize other’s work to complete the CCE testing process.

Competencies

The goal of the CCE competencies is to outline the necessary level of proficiency required for a CCE test candidate. The CCE applicant may or may not be tested on all subject areas listed. The CCE testing process is designed to test an applicant’s proficiency in several areas pertinent to digital forensics. The applicant is required to complete an online test and forensically examine three pieces of media, submitting a report after each examination.

CCE Competencies

Requirements to sit for the CCE

In order to be accepted into the CCE testing process, the applicant must:

  • Complete training at a CCE Bootcamp, Authorized Training Partner (ATP) or Authorized Training Center (ATC). This training must be verifiable by a third party.

- OR -

  • Possess a minimum of 18 months of verifiable professional experience conducting digital forensic examinations. This experience must be verifiable by a third party.

- OR -

  • Have documented self study in the field of digital forensics deemed appropriate by the Certification Board. This must include detailed information on all pratical experience, professional experience, related education, credentials, and any other information that will help determine the likelihood of the candidate's potential success in sitting for the testing.

Training for the CCE

The ISFCE has Authorized Training Centers (ATCs) around the world to train specifically for this testing. It is highly suggested that you choose to enroll within one of these courses prior to attempting the CCE certification testing, especially if you are new to the field of computer forensics.

ATP Logo

All ATC course offerings are thoroughly reviewed and scrutinized by the ISFCE prior to granting ATC status to that organization. The ISFCE reviews all ATC course material and assesses whether or not the curriculum adequately meets the testing standards for the Certified Computer Examiner (CCE) exam. These testing standards are released under a non disclosure agreement to the ATC in order to assist the ATC in evaluating existing course materials. The ISFCE does not release the Certified Computer Examiner (CCE) Testing Standards to the general public in order to protect the integrity of the certification process. The Certified Computer Examiner (CCE) Testing Standards are posted in more general terms under the Skill Level section of this website.

Only training organizations that display the CCE BootCamp Authorized Training Partner / Authorized Training Center logo are approved by the ISCFE to prepare candidates to sit for the CCE certification.

The ISFCE has encountered training organizations that state they prepare individuals for the CCE certification process, yet they are not approved to do so. If these organizations are not designated as an Authorized Training Center (ATC), the ISFCE does not recognize that training as a program that sufficiently prepares for the CCE. If you are aware of an organization that is representing itself as an ISFCE Authorized Training Center but is not included in this list, please email details of this to info@isfce.com.

General skillset

The Certified Computer Examiner (CCE) certification testing process will require a candidate to have:

  • Basic understanding of PC hardware
  • Basic understanding of PC networking
  • Good understanding of Microsoft Office applications and how to access the metadata that is stored within MS Office documents
  • Basic understanding of common data formats by header, appearance, etc.
  • Basic understanding of how to defeat passwords
  • Basic understanding of CDR recording processes
  • Basic understanding of Internet issues, such as doing a "who is" search , determining ownership of a domain name, etc.
  • The ability to write clear, understandable, and comprehensive examination reports in the English language
  • The ability to organize and present exhibits in or as an attachment to report

A good understanding of basic rules of evidence:

  • The seizure or acquisition of magnetic media
  • The handling, marking and storage of electronic evidence
  • Appropriate chain of custody
  • Right to privacy

A good understanding of acquisition techniques:

  • How to wipe, verify and validate media
  • How to protect the original media for accidental writes
  • How to make and verify exact copies of media

The examination will cover essential forensic computer examination procedures, basic PC hardware construction and theory, very basic networking theory and basic data recovery techniques.

Difficulty

The CCE testing process should not be too difficult for experienced examiners who have a good knowledge of forensic examination procedures, basic legal considerations, basic networking principles, basic data recovery techniques, authenticating documents, basic password recovery and basic Internet issues.

The concepts tested for certification are designed to be similar to what an examiner may encounter in civil or law enforcement examinations. No extreme measures have been taken to hide data, such as bit shifting and splitting files. The certification problems are designed to be straight forward and reflect situations found during professional practice.

Suggested tools

If you are currently conducting digital forensic examinations, the software and utilities you use to complete these examinations should be sufficient to complete the Certified Computer Examiner (CCE) examination process. The purpose of the list below is to provide examples of the types of software and utilities that will be necessary to successfully complete the testing process:

  • Forensic suite
  • Password recovery tool
  • Data carving utility
  • File viewer
  • Media wiping utility
  • Checksum / Hashing application
  • Utility that makes forensic copies of media
  • Utility to "capture" unallocated space
  • CDR examination tool
  • Email extraction utility
  • Internet history viewer
  • Metadata viewing utility

CCE Certification Process

In order to become a Certified Computer Examiner (CCE), a candidate must undergo a four part testing process. Once gained, the CCE Certification will remain valid for two calendar years at which time the candidate will be eligible for Recertification.

In order to begin this process, a candidate will first need to submit an Application Form:

CCE Testing Application

Once this has been approved, he or she will need to visit our payment area and purchase the CCE Process ($495.00). Once this payment has been processed, the candidate will then begin receiving instructions on moving forward in the testing typically within 1 business day.

 

CCE Testing Process


    1. Submit CCE Testing Application. Candidate will generally receive feedback on their eligibility within 1-2 weeks

    2. If approved, purchase testing for $495.00 USD

    3. Candidate receives email welcoming them to the process, providing instructions for submitting the Notarized CCE Statement and directions for beginning the Online Written Exam

    4. If a score of 70% or above is received for the Online Written Exam, the candidate will then proceed on to the Practical Examination portion of the testing. If lower than 70% is received, the candidate is allowed one retake. If neither attempt achieves 70% or above, the candidate will be removed from the certification process and will not be allowed to continue

    5. Candidate receives email introducing their assigned assessor, providing instructions for creating an ISFCE Toolbelt account, and gaining access to the first practical examination problem (90 day time limit for completion begins at this time)

    6. Candidate will download each practical examination problem, restore the disk image, perform their examination, create a detailed report on the process, and submit a report to their assessor

    7. Assessor will score the report submission. If 70% or above is obtained for media examination, candidate will be moved on to the subsequent practical examination. If lower than 70% is received, the candidate will be removed from the certification process and will not be allowed to continue

    8. Once all practical examination reports have been received and scored the candidate's scores are then sent to the ISFCE Certification Board for final review.

    9. Candidate is notified of certification status by email within 2 business days

    10. Newly certified CCE submits form containing address and certificate information

    11. Package containing new certificate, membership card, and other materials is sent out. Name and contact information is also added to the ISFCE's Certified Individuals list at this time

Although the CCE is an international certification, note that all testing materials are provided in the English language. Likewise, all candidate submissions are expected to be written in English unless otherwise previously agreed upon by the ISFCE. Note that the ISFCE's assessors are aware that many candidates may not speak English as a primary language. In cases such as this, grammatical consideration and allowance is provided.

CCE Certification Fees

 

In an effort to keep the organization's costs down, it is preferred the that payment be made online using a credit card. However, we will accept other forms of payment such as Purchase Orders or checks. Please contact our office at (800) 262-3552 or info@isfce.com for assistance with this.

Online payment by credit card can be made by sending an email to info@isfce.com.

CCE Certification Payment

The CCE Certification test fee is approved for reimbursement from the GI Bill and Veterans Educational benefits.

No refunds are available for the CCE Ceritification testing, Recertification testing, or Retake of the CCE Process. Please read all directions carefully as you proceed with payment and throughout the testing process.

CCE Recertification - To apply Go here

Per ISFCE policy, a Certified Computer Examiner (CCE) certification remains valid for two calendar years from the date of issuance. The CCE becomes eligible for Recertification after this time. In order to help facilitate this, the ISFCE has provided an additional six month grace period for completing this process.

Once a candidate has entered the grace period, and filled the Recertification Application he/she will receive an invoice to pay the CCE Recertification online. 

Only currently certified individuals may register for and attempt recertification. To recertify, certified individuals must resubmit all forms including a Recertification Application, Code of Ethics and Professional Responsibility and Notarized Statement.

The CCE Recertification process consists of submitting an application form outlining fulfillment of continuing education requirments as well as professional experience. However, if practical experience conducting digital forensic investigations has not been gained during the last two years, the option to sit for a Practical Examination is also available.

ISFCE policy requires that all CCE Recertification Candidates complete:

  • Forty (40) hours of Continuing Professional Education credits (CPE) relevant to the CCE Certification, practice of digital forensics or a specialty related to that field with the intent of expanding the recertification candidate’s practical skills and abilities during the 2 year certification period (CPE Guidelines).

- AND -

  • Documented completion of no less than three (3) digital forensic examinations during the 2 year certification period

    • If the recertification candidate does not possess the relevant work experience listed above, that candidate may complete a practical examination exercise in lieu of the work experience.

Both of the items above will need to be fully documented within the Recertification Application form after initiating Recertification testing. All recertification candidates must posess the required continuing education hour to recertify.

 

CCE Recertification Process

    1. Submit Recertification Application outlining continuing education fulfillment and professional experience that meets the requirements for the CCE Recertification process OR indicating election to take recertification practical exam exercise in lieu of professional experience:
       

      - OR -

      • If the candidate chooses to submit this application containing details that display adequate professional experience, the form will then be forwarded to the ISFCE Certification Board for review. The review process normally only takes a few days at which time the individual will be notified of the results via email
      • If the candidate does not meet the required professional experience by listing three (3) real-world practical examinations, they will then be sent instructions on moving forward with the practical exam exercise. This is typically handled within one business day
        1. Receive email containing instructions to begin practical examination testing process. (60 days for completion begins at this time)

        2. Submit Notarized CCE Statement

        3. Complete and submit practical examination report to assessor

        4. Candidate receives score for submitted practical examination from assessor usually within 2-3 business days after submitting

        5. Score and application information are submitted to ISFCE Certification Board

        6. Candidate is notified of certification status by email within 2 business days

    2. Upon ISFCE Certification Board approval, a congratulatory email will be sent containing a link to a form to be filled out. The form will allow the candidate to request a new certificate, membership card, and other materials. This form also contains the ability to add or change their listing on the ISFCE Certified Individuals page

It is very important that all CCEs provide working email addresses to the ISFCE as periodic Recertification reminders will be sent via email.

Members

The CCE certification is rapidly growing in size and recognition. There are now a number of companies and government agencies that require their forensic computer examiners to hold the CCE certification in order to obtain or maintain their position.

CCE Certified Individuals List

Contact Us

Please contact us below if you have any questions surrounding the CCE Certification.