Certified forensic computer examiner

This article includes a list of references, related reading, or external links, but its sources remain unclear because it lacks inline citations. Please help improve this article by introducing more precise citations. (February 2016) (Learn how and when to remove this message)

The Certified Forensic Computer Examiner (CFCE) credential was the first certification demonstrating competency in computer forensics in relation to Windows based computers. The CFCE training and certification is conducted by the International Association of Computer Investigative Specialists (IACIS), a non-profit, all-volunteer organization of digital forensic professionals.

IACIS was formed and commenced training in 1990. The predecessor to the CFCE was the DOS Processing Certificate (DPC). The CFCE was introduced in 1998 when the training was expanded to include examination of Windows-based computers. The course materials also covers the MAC OS operating system and its associated file systems, however, the certificate only states proficiency in Windows.

In order to undertake the CFCE certification process, a candidate has to be a member of IACIS. IACIS membership is normally included in the fee to enter the CFCE training or certification process. There are two levels of membership in the organization, Regular and Associate. To be eligible for Regular membership, applicants must be a current full-time or former full-time law enforcement or government employee, or a current full-time contractor for a government agency. Regular members have access to training, certification, an active listserv and forensic research. Associate membership is available to current or aspiring members of the computer/digital forensics community that are able to pass a background check. Associate members have the same access to the benefits as Regular members with the exception that Regular members can vote and hold organizational offices. Proof of status will be verified upon application for membership. https://www.iacis.com/membership/membership-overview/

The certification process may be taken internally or externally and is conducted in two phases: Peer Review and Certification.

An internal certification candidate attends a 2-week training course given by IACIS. Two courses are conducted annually. The US-based course is conducted in the first half of the calendar year whilst the European-based course is conducted in the second half of the year. Upon successful completion of the course, the member is assigned a (volunteer) coach. The coach guides the student through the Peer Review phase, often by suggesting reading materials or experiments for the student, which is intended to assist the student in fully understanding issues with which the student may be having difficulty. Upon successful completion of the Peer Review phase the candidate is eligible to enter the Certification phase which consists of a practical exam based on a hard drive examination and a final exam.

An external certification candidate does not attend the training, however, they have to have the equivalent 72 hours of training that is comparable to the IACIS training.

In order for certification to remain current, a member must undertake a proficiency test once per 3-year period after certification as well as complete 40 hours of continuing training in computer forensics or a related field. Additionally, the member must conduct as a minimum an average of 1 forensic examination per year, for a minimum of 3 examinations over the 3-year period. The member must also pay dues ($75 per year) and remain a member in good standing of IACIS.

CFCE is one of the most widely recognized non-tool certifications in computer forensics for current and former law enforcement personnel.^[1] Some organizations such as the Computer Forensics Laboratory at Miami-Dade Police require their members to complete and maintain this certification.^[2]

• Official website
  • CFCE
  • CFCE FAQ