The International Society of Forensic Computer Examiners ^®
Certified Computer Examiner ^®

The CCE certification is available world wide to both law enforcement and non law enforcement forensic computer examiners who have no criminal record** and who have the appropriate training, experience or are self taught.   A police clearance may be required.

All applicants will be treated equally. There is no "grandfathering" nor granting of the CCE certification without being properly tested and evaluated by the Certifying Board.  All certificants must meet the same certification requirements and all must successfully complete the examination process.  
       
In order to be complete the CCE certification process, the applicant must:

In order to maintain the CCE certification, certified individuals must adhere to the ISFCE code of Ethical Standards and Professional Responsibility and pass proficiency examinations every two years.  There are also experience or continuing education requirements.

A no fee private CCE list server, a forum and chat rooms have been established for all CCEs to discuss forensic issues and to share forensic information with other CCEs.

The initial CCE certification process will encompass:

• Acquisition, marking, handing and storage of evidence procedures
• Chain of custody 
• Essential "core" forensic computer examination procedures
• The "Rules of Evidence" as they relate to computer examinations
  
• Basic PC hardware construction and theory 
• Very basic networking theory 
• Basic data recovery techniques 
• Authenticating MS Word documents and accessing and interpreting metadata 
• Basic CDR recording processes and accessing data on CDR media
• Basic password recovery techniques
• Basic Internet issues  

The initial CCE process consists of a proctored online multiple choice question and answer examination, the forensic examination of a floppy diskette, the forensic examination of a CDR disk and the forensic examination of an image of a hard disk drive .  An 80% or better average score is required to complete the process.  Once the online examination has been completed, the applicant can then begin the forensic examination of the test media.  The forensic examinations are designed to test the forensic knowledge and skills of the examiner.  The examiner must have the appropriate tools.  See Software Necessary for more information. The primary purpose of this certification is to measure if the applicant understands and uses sound evidence handling and storage procedures and follows sound forensic examinations procedures when conducting examinations. There are reasonable technical issues that must be resolved in order to recover the evidentiary data.  However, most of the grade is based upon following sound evidence handling and storage procedures and following sound examination procedures, not simply recovering the data.  An 80% total average score will be required to obtain the Certified Computer Examiner(CCE) ® certification.   Do not assume that we know your standard operating procedures. Your grade will be based solely upon what you have written in your reports and the exhibits that you provide.  We recognize that there may be differences of "expert" opinion about technical issues.  A number of recognized computer forensic experts have thoroughly tested and vetted the CCE problems.  We feel that the technical issues are clearly laid out, they are practical and are issues that a competent examiner should be able to discover and report.  However, there is an appeal process for the CCE problems and the granting of extensions.  The appeals board is impartial and will thoroughly examine all appeals by applicants.   ** No Criminal record- Criminal record defined: - A conviction within or outside the United States of any sexually related offense or crime of moral turpitude - A conviction within or outside the United States of any crime that is classified as a felony or of which the resulting penalty could be more than 1 year of imprisonment - If no sentence is received, the possible maximum sentence in the jurisdiction where the conviction occurred is the deciding factor - The candidate is a subject of a restraining order or similar court order for domestic battery, sexual offenses or assault - Any conviction for sexual battery or similar sexual offense of which the resulting sentence could be less than 1 year of imprisonment