Certification FAQ

Am I required to complete training in the field of computer/digital forensics before attempting the CFCE certification?

Yes!  CFCE applicants must have successfully completed 72 hours of training in the field of computer/digital forensics that is comparable to the IACIS CFCE core competencies (Please review the CFCE Course Competencies).  The two-week IACIS Basic Computer Forensics Examiner training satisfies these requirements.  For applicants that have not completed the IACIS BCFE, successful completion of comparable training is required and IACIS reserves the right to approve or deny training submissions.  Applicants that have not attended the IACIS BCFE training must submit proof of course completion by scanning applicable certificates of completion, diplomas, or other similar records for IACIS review.  Applicants not meeting the training requirement will not be allowed to participate in the CFCE Certification Program.  In this event any registration fees will be reimbursed to the applicant, minus any applicable background check fees.

Do I have to be or become an IACIS member to enroll in the CFCE Program?

No.  In July of 2010, the membership of IACIS voted to open the CFCE Certification Program to the general public.  Applicants are required to complete the registration process, and some applicants may be required to undergo a background check.

If you have questions about membership, please check our website for more information or send an email to the IACIS Secretary at secretary@iacis.com.

How do I apply?

If you attend the IACIS BCFE training event, enrollment for the CFCE Certification Program is made during the BCFE event.  In this instance the fee for enrolling in the CFCE is waived for the CFCE Program cycle that immediately follows the training event (does not apply to subsequent cycles).  Applicants that do not attend the BCFE training event may sign up through the IACIS website during the specified enrollment periods.

How do I enroll in the CFCE Program?

IACIS provides candidates with two methods to enroll in the CFCE Program.

1)  Successful completion of the two-week IACIS Basic Computer Forensic Examiner (BCFE) training course entitles CFCE candidates to enter the first available CFCE cycle following the BCFE training event.  This is a one-time offer that is included in the tuition price of the IACIS BCFE training course.  (If you plan to attend the IACIS Basic Computer Forensic Examiner training course, do not register for the CFCE Certification Program.  Registration details will be provided during the BCFE event.)

2)  For those that do not wish to or cannot attend the BCFE training event, the CFCE Certification Program is available upon registration and payment of the $750 registration fee.  Applicants for the CFCE Certification Program may be required to undergo a background check as a part of the registration process.

How long do I have to complete the program?

The Peer Review phase is open for a period of four (4) months.  Candidates must complete all of the practical exercises during that time period.  Once the peer review phase has been completed, candidates have up to seven days to enter the CFCE Certification phase.  Candidates entering the CFCE Certification phase have 54 days to complete the certification phase.

I attended an IACIS Basic Computer Forensic Examiner training event within the last few years, but I did not complete the certification following the BCFE training event. Can I enroll in the CFCE Program?

Yes.  Complete the registration process and pay the requisite fee.

I heard I must undergo a background check, is that true?

Yes.  A background check is performed on all certification applicants unless one of the following exemptions exist:

  • The applicant is a full-time employee of a law enforcement or government organization who has undergone a background investigation by the employing organization, and the employing organization provides a letter confirming the applicant has undergone a background investigation with no disqualifying information discovered that would prevent their employment with the law enforcement or government organization; or
  • The applicant has a government clearance or security rating that is verifiable by IACIS.  The applicant must provide proof of the clearance or security rating or provide a point of contact within their employing organization for verification purposes.  If the applicant cannot provide proof of the clearance or security rating, a background check will be performed.

IACIS does not conduct background checks.  PrescribeHire has been contracted by IACIS to perform background screening.  Once the applicant completes the IACIS CFCE Program registration, IACIS will set up a background request.  The applicant will receive an email and the background check will be performed once the applicant completes the online forms. IACIS will review the background results and determine if the candidate meets the requisite criteria.

NOTE:  IACIS will NOT authorize a background check to be performed on the applicant until the requisite fee is paid in full.  If any applicant fails the background check, IACIS will reimburse the CFCE Program fee in full minus the background fee.  To inquire about the fees, please send an email to treasurer@iacis.com.

I will be attending the IACIS Basic Computer Forensic Examinations (BCFE) training event. Do I need to pay for the CFCE Certification Program?

No.  As long as you enter the next available CFCE program cycle immediately following the training event, the certification fee is waived.  If you fail to enter or otherwise fail the certification program and wish to enter the CFCE at a later time, candidates must pay the requisite registration fee.

I’ve never attended the IACIS BCFE training event. Can I enroll in the CFCE Program?

Yes.  Complete the application, meet the training requirements, successfully complete the background check (if applicable) and pay the requisite fee.

Is training involved in the CFCE Certification Program?

Although the traditional form of training is not provided in the CFCE Certification Program, candidates are mentored by IACIS coaches while participating in the Peer Review phase of the CFCE Certification Program.  Applicants must have completed the IACIS BCFE course or submit proof of comparable training equating to a minimum of 72 hours (see above).  To reiterate, while the Peer Review phase provides candidates with feedback and guidance relevant to the core competencies, coaches do NOT teach, instruct, or deliver formal training.

Once I achieve the CFCE, are there recertification requirements in order to maintain a current CFCE credential?

Yes. Please visit our recertification page for more details.

What are the CFCE Core Competencies?

There are seven (7) competency areas addressed in the CFCE Certification program.  Please visit the CFCE Certification Competencies webpage for more details as the list below represents the primary categories.

•    Pre-Examination Procedures and Legal Issues

•    Computer Fundamentals

•    Partitioning Schemes

•    Windows File Systems

•    Data Recovery

•    Windows Artifacts

•    Presentation of Findings

What is involved in the CFCE Certification phase of the CFCE Program?

The CFCE certification phase is an independent process by which candidates must examine some form of electronic media and answer a series of questions based on the electronic media examined.  Candidates must also complete a comprehensive written examination that encompasses all of the CFCE core competencies.  Candidates must achieve a score of 80% on the practical and written exercises.  Candidates must also submit a notarized document attesting that the work completed was independent and unassisted.

What is involved in the Peer Review phase of the CFCE Program?

The peer review phase of the CFCE program involves a series of practical exercises that incorporate the CFCE core competencies.  Candidates are assigned to a coach that will mentor the candidate while reviewing the candidate’s submissions for each practical exercise (aka: problems).  Candidates must pass each aspect of a practical exercise to advance to the next practical exercise.  In addition, candidates must pass all of the practical exercises in the order assigned to successfully complete the peer review phase and advance to the certification phase.

What is the Certificate Forensic Computer Examiner (CFCE) Certification?

The CFCE is a certification program derived from a series of technical computer/digital forensics competencies.  IACIS offers the “CFCE Program” to prospective candidates who wish to attain the CFCE certification.  The CFCE program is comprised of a peer review phase and certification phase.  The peer review phase is a mentored process whereby candidates are presented with a series of practical forensic problems.  Candidates are required to successfully address each of the practical problems, apply the appropriate forensic techniques where appropriate, and submit reports or assessment documents after completing each practical exercise.  Once the peer review phase has been successfully completed within the specified time constraints, candidates may enter the CFCE certification phase.  The CFCE certification phase consists of a practical exercise and comprehensive written final examination designed to test the candidate’s ability to demonstrate and apply sound forensic techniques.  Upon successful completion of this phase, the candidate is awarded the coveted Certified Forensic Computer Examiner (CFCE) Certification.

When does the CFCE Certification Program start?

The CFCE Certification Program begins on June 1st and December 1st of each year.  Registration begins a few months in advance of the program’s start date and closes 4 to 6 weeks in advance of the start date.  Early registration is highly encouraged as IACIS limits the number of candidate enrollment to ensure adequate IACIS staffing is available.

When is my payment to IACIS due?

Two certification cycles are held each year, beginning in June and December.  Payment is due before the respective certification program begins.  Failure to pay the requisite registration fees prior to the start of the certification cycle you wish to attend may result in your enrollment being denied.

Will I be assigned to a coach?

All CFCE candidates are assigned a coach during the peer review phase.  All candidates are treated equally and receive the same services.  However, during the certification phase candidates are no longer assigned a coach and must work independently.

Additional questions:

Recertification FAQs

Am I recertified once I complete a proficiency test?

No, a proficiency test is only one part of the recertification process.  You must meet the other requirements.

Do I have to be an IACIS member in order to recertify?

No.  This was changed in March of 2010 and is no longer a requirement of recertification.

Do I have to go back through IACIS® training to meet the continuing education requirement?

No. You can take any computer related classes or any investigative class that will benefit you in doing casework.  For example, taking any computer class such as HTML programming, Microsoft Office usage, or other technology classes will count towards your training requirement. Also, actual classroom hours are to be used. You may take a 3 credit hour course at your local college and spend 45 hours in the classroom, count the 45 hours.

Does attending the IACIS® annual conference as staff count towards the continuing education hours?

If you attended the IACIS® conference as a coach and/or instructor, the hours count towards satisfying training hours.

How can I check the status of my CFCE Certification?

If you are an IACIS member, login to the website and view the status of your certification in your profile at the bottom of the page.  The IACIS website now supports certifications earned and will display your certifications including the status of your certification (current, expired, or revoked).  If you are not a present IACIS member and hold a CFCE certification, you may send an inquiry to certification@IACIS.com.  Please include your name and date of initial certification along with any subsequent re-certifications.

I failed the proficiency test in the third year as required. What can I do?

Two Recertification Cycles are offered each year, it is strongly encouraged to attempt the first cycle of the year.  Certificants who fail to take or otherwise do not attain a passing score on the first proficiency test in the third year following the initial certification or recertification date will be required to complete and successfully pass the second proficiency test cycle in the same year.  Certificants who fail to take or attain a passing score on the second proficiency test in the third year following the initial certification or recertification date will be considered Expired.  Certificants may not take proficiency tests in immediate succession within the ninety-day (90) proficiency testing period.  Only one proficiency test may be taken when proficiency tests are offered within a ninety-day period.

I last recertified in . When do I need to recertify again?

From the date of your last recertification, you are required to satisfy recertification requirements by December 31st in the third year, 23:59 (GMT).  You are required to take a proficiency test in the third year (not the first or second) from your last recertification certification.

I no longer conduct examinations, but I supervise a computer/digital forensics function. Or – I transferred out of a computer forensics unit or no longer work in a computer forensics assignment. How can I satisfy the “3 exams in 3 years” requirement?

Currently, there is a requirement to perform at least one forensic examination per year within the three-year period. We have broadened this definition to include credit for those who supervise or manage a related function. We also recognize that some certificants may transfer to another area in their organization and no longer have access to perform an examination. This requirement can be satisfied by completing three (3) proficiency tests within three years.

I obtained my CFCE in . When do I need to take a proficiency test?

From the date of your initial certification, you are required to satisfy recertification requirements by December 31st in the third year, 23:59 (GMT).  You are required to take a proficiency test in the third year (not the first or second) from initial certification.

What happens if I fail to meet the recertification requirements within the three-year period?

Revoked Status: If a certificant fails to satisfy ALL of the requirements of recertification in the third year from the date of initial certification or last recertification, the certification will be revoked. This means the CFCE is revoked and may not be reissued. In order to regain the CFCE Certification, the person must go through the entire CFCE Program again (and successfully pass all phases).  All requirements must be met by 31 December in the third year following initial certification or date of last recertification.