The IACIS Certified Mobile Device Examiner (ICMDE) program is administered by the IACIS Advanced Certification Subcommittee. The ICMDE Certification is drawn from a set of competencies approved by several committees and the IACIS board of directors.
The ICMDE program is an assessment process and not a simple, single test. The process is composed of two separate assessments. The first component is the written examination, administered via the IACIS Moodle site. The second component is a practical assessment whereby candidates must answer questions that relate directly to a series of image files and Mobile artifacts.
The IACIS CMDE is a tool agnostic assessment in the practical application of fundamental mobile device and digital forensic concepts in the examination and analysis of various smartphone mobile device operating systems and file systems. Candidates must obtain a minimum score of 80% on the exam to pass. Candidates who achieve a passing score will be allowed to proceed onto the practical exam.
The ICMDE Certification Program is a two-step process in which you must first successfully complete the written examination. This written examination is a TIMED exam which will test your knowledge of the ICMDE competencies. The written examination has a time limit of 8 hours. Although the written exam is not proctored and is open book, once you commence one part of the examination, you must complete it in one sitting. “Pausing” of the exam time clock is not permitted.
Candidates do not have to take both parts of the written examination at once. For example, a candidate may elect to take part 1 of the written exam on Monday and part 2 on Saturday. The candidate would have 8 hours to complete each part. The exam can be taken at any location the candidate chooses that has a reliable high-speed Internet connection.
The written exam consists of questions composed of true/false, multiple-choice, matching, and short answer (fill in the blank) questions. There are no questions that require full sentences or an essay answer. Candidates must obtain a minimum score of 80% on the exam to pass. Candidates who achieve a passing score will be allowed to proceed onto the practical exam.
Candidates who receive a failing score on the exam will have their exams reviewed by the Chairman of Advanced Certification and will be notified by e-mail of their official results after the review is conducted. The exam is designed to be pass/fail and candidates will not see the actual percentage score. There will be only one attempt on each part of the ICMDE examination. Failure on the written examination will result in the candidate being removed from the ICMDE certification program and not continuing to the next phase of the certification process.
What do you need to take the exam:
- Enough time set aside to complete each segment in the time required.
- Good internet connection
- Computer with Moodle compatible browser.
What do you need to take the practical exam:
- Any forensic tool of your choice
- Access to Internet with good speed to download image files
- Moodle compatible browser
What happens if I fail either part:
- Failure to pass the written exam will result in not being eligible to take the practical exam
- You may re-attempt the exam for which you did not receive a passing score within an hour of notification of your results for that exam.
- If you fail to achieve a passing score or complete the exams in the required time frame, you must reapply to take the exam and pay the requisite fees.
- To re-enter, you must apply to the ICMDE chairman.
Note: Each candidate will be allowed to be re-examined one time without an additional charge. For subsequent attempts the candidate will be assessed the requisite fees as set by the Board of Directors and posted on the IACIS web site. A candidate must complete at least 80% of the initial exam attempt to be eligible to be re-examined.
ICMDE Recertification
The same requirements of our CFCE Recertification apply to the ICMDE certification.
The Recertification Requirements are:
- One proficiency exercise must be successfully completed in the third year following initial certification or recertification. The exercise only counts when taken in the final year of certification period.
- Previous three years dues paid (if IACIS member), Recertification Fee* paid (if non-Member or delinquent in any previous dues year).
- Forty (40) hours of continuing education in the field of computer/digital forensics.
- Only classes where attendance is documented and certificates issued will be accepted. No webinars or other undocumented training can be submitted. Certificants must provide copies of completed courses, training certificates, or other documentation to the Recertification Subcommittee when the application for recertification is submitted.
- Certificants who teach related topics in computer/digital forensics,information technology, or investigations may apply formal classroom hours to this requirement. The Recertification Committee reserves the right to verify training documented by a certificant.
- Certificants must demonstrate that they are working in the field of computer/digital forensics accomplishing one of the following:
- Completing at least three (3) computer/digital forensic examinations.
- Supervising or managing a related function
- Completing three (3) IACIS proficiency tests within three years.
- Certificants must read and agree to uphold the current IACIS Ethical Code of Conduct.
The CFCE Recertification provides more details on the Recertification Process. Questions about the ICMDE recertification should be directed to the ICMDE Chair. ICMDE Certification Chairman: Jung Son
