Table of Contents for

System Forensics, Investigation, and Response, 3rd Edition

The International Association of Computer Investigative Specialists (IACIS) is one of the oldest professional system forensics organizations. It was created by police officers who wanted to formalize credentials in computing investigations. Currently, IACIS limits membership. Only law enforcement personnel and government employees working as system forensics examiners may join.

IACIS conducts an annual two-week training course for qualified members. Students learn to interpret and trace email, acquire evidence properly, identify operating systems, recover data, and understand encryption theory and other topics. Students must pass a written exam before continuing to the next level.

Candidates who complete all parts of the IACIS test successfully receive Certified Forensic Computer Examiner (CFCE) certification. The CFCE process changes as technology changes. Topics include data hiding, determining the file types of disguised files, and accessing password-protected files. The program might also ask a student to find evidence and draw conclusions from it. Students must demonstrate proficiency in technical tools and deductive reasoning. For the latest information about IACIS, visit https://www.iacis.com/

IACIS requires recertification every three years to demonstrate continuing work in the field of system forensics. Recertification is less intense than the original certification.

Guidance Software, the creator of EnCase, sponsors the EnCase Certified Examiner (EnCE) certification program. EnCE certification is open to the public and private sectors. This certification focuses on the use and mastery of system forensics analysis using EnCase. For more information on EnCE certification requirements, visit http://www.guidancesoftware.com.

AccessData is the creator of Forensic Toolkit (FTK) software. The company sponsors the AccessData Certified Examiner (ACE) certification program. ACE certification is open to the public and private sectors. This certification is specific to use and mastery of FTK.

Requirements for taking the ACE exam include completing the AccessData boot camp and Windows forensic courses. For more information on ACE certification, visit http://www.accessdata.com.

The EC-Council, creators of the Certified Ethical Hacker certification, also offers a forensic certification. For more information about the Certified Hacking Forensic Investigator certification, visit https://www.eccouncil.org/programs/computer-hacking-forensic-investigator-chfi/. This certification is not specific to a given tool, as are the ACE and EnCE certifications. It is a general certification covering the principles of forensics. However, the course and the certification test do cover a wide range of forensic tools.

The CCFP is the forensic certification from ISC2, the oldest computer security certification vendor. This certification places heavy emphasis on legal issues and scientific processes. https://www.isc2.org/ccfp/default.aspx

The SANS Institute offers a variety of network security certifications. Its forensic track offers several subdisciplines of certifications. You can find more information at http://computer-forensics.sans.org/certification. The three certification tracks are:

• Global Information Assurance Certification (GIAC) Certified Forensic Examiner (GCFE)

• GIAC Certified Forensic Analyst (GCFA)

• GIAC Reverse Engineering Malware (GREM)

The American Academy of Forensic Sciences (AAFS) is a prestigious organization composed of forensic scientists in all the various forensic disciplines. It does not offer certifications, but does sponsor a variety of scientific conferences.

A number of websites provide information about computer forensics. Some provide articles and research, whereas others provide basic tutorials and white papers. Some simply provide an overview of relevant laws. But all are relevant to forensic investigations:

• American Academy of Forensic Sciences at http://www.aafs.org

• Computer Forensics, Cybercrime and Steganography Resources at http://forensix.org

• Computer Forensics World at http://www.computerforensicsworld.com

• Department of Defense Cyber Crime Center (DC3) at http://www.dc3.mil

• Department of Justice Computer Crime & Intellectual Property Section at http://www.cybercrime.gov

• Digital Forensic Research Workshop at https://www.dfrws.org/

• Forensic Focus at http://www.forensicfocus.com

• Forensics Wiki at http://www.forensicswiki.org

• High Tech Crime Consortium at http://www.hightechcrimecops.org

• High Technology Crime Investigation Association (HTCIA) at http://www.htcia.org

• Information Systems Security Association (ISSA) at https://www.issa.org

• International Association of Computer Investigative Specialists (IACIS) at http://www.iacis.com

• National Institute of Justice Electronic Crime at http://www.nij.gov/topics/crime/internet-electronic/

• National Institute of Standards and Technology Computer Forensics Tool Testing (CFTT) at http://www.cftt.nist.gov

• Scientific Working Group on Digital Evidence (SWDGE) at http://www.swdge.org

There are journals, both in print and electronic, that cover the field of digital forensics. These can be invaluable tools for keeping abreast of the latest developments.

In addition to journals and websites, there are a variety of conferences you might want to attend. Some of these are specifically aimed at forensics, whereas others provide information on general network security, hacking, and topics related to forensics:

• Black Hat Briefings & Training at http://www.blackhat.com/html/bh-link/briefings.html

• ChicagoCon—White Hats Come Together in Defense of the Digital Frontier

• DFRWS Digital Forensics Research Conference at http://www.dfrws.org

• Regional Computer Forensics Group Conference (RCFG) at http://www.rcfg.org

• SANS Computer Forensics at http://computer-forensics.sans.org/events/

• Other SANS Institute events at http://www.sans.org

• Techno Security & Digital Forensics Conference at http://www.techsec.com