|
Q: There are other computer
forensics certifications available. What makes the
CSFA unique?
- The forensic analysis and subsequent report have
to be completed within a reasonable time frame (3
days). Forensic analysts/examiners typically have
a specific time frame to complete an analysis. Any
competent forensic examiner that meets the prerequisites
will be able to complete their CSFA test scenario
well within the allotted time.
- The test is proctored - candidates have to show
that they possess the required skills and can complete
the technical analysis and analysis report on their
own.
- The tests are related to actual forensic cases,
with the candidate having to process the case from
start to finish. The hands-on portion includes initial
documentation from a law enforcement agency or law
firm outlining what is being requested. The test
scenarios are constantly being updated and reviewed.
- Additional information can be requested during
the test that is related to the test scenario, such
as proxy logs, firewall logs, IDS logs, time sheets,
etc. This reflects real-word scenarios where additional
information is requested and motions are submitted
for production of evidence. Depending on the particular
scenario, candidates may have to assist with verbiage
for an affidavit, motion, and/or subpoena.
- Candidates bring and use whatever software and
hardware tools they normally use to conduct forensic
analysis, and are expected to manage their forensic
examination environment.
Q: What types of ID do I need
to bring the day of the test?
You will need to provide two pieces of ID,
one being a picture ID. This information is also in
the CSFA
Certification Test Application and Agreement.
Acceptable forms of ID: U.S. Passport; Driver's license
or ID card issued by a state, provided It contains
a photograph; ID card issued by federal, state, or
local Government agencies or entities provided it
contains a photograph; School ID card with photograph;
Voters registration card; U.S. Military card or draft
record; Military dependent's ID card; U.S. Coast Guard
Merchant Mariner Card; Native American tribal document;
U.S. social security card; Original or certified copy
of a birth certificate issued by a state, county,
municipal authority or outlying possession of the
United States bearing an official seal; School record
or report card; Certification of Birth Abroad issued
by the Department of State.
Q: Will I be able to talk
to other test candidates during the test?
While in the testing room no, unless with a test proctor.
Test candidates are encouraged to talk to one another
during breaks, lunch, and before/after the daily testing
sessions. In the real world, a forensic analyst draws
upon the expertise and knowledge of other professionals.
Another test candidate is not allowed to sit at or
access your forensic workstation. Each candidate will
have a different test scenario.
Q: Will I have Internet access
during the test?
Yes. Internet access will be provided via a group
of computers setup expressly for this purpose - use
will be monitored. A forensic examiner typically uses
the Internet as a resource when conducting forensic
analysis.
Q: Doesn't allowing Internet
access encourage cheating?
We do not believe so. Test scenarios are updated on
a regular basis, and each candidate will have a different
scenario. Uploading or otherwise sending the forensic
image files will be grounds for termination of the
candidate's test and expulsion from the testing center.
Candidates are allowed to communicate information
and questions regarding their specific scenario to
their associates, as they normally would when conducting
forensic analysis. Your activities and use of your
forensic workstation will be monitored.
Q: Why just three days to
complete the analysis?
In the real world, a forensic examiner does not have
an unlimited amount of time to complete an analysis.
Any competent forensic examiner will be able to complete
the test well within the allotted time.
Q: Do I have to stay for the
entire three days?
No. Turning in your analysis report will be the end
of your test.
Q: Will all testing candidates
be working on the same scenario?
No. There are multiple scenarios.
Q: Can I bring my own laptop
to use for the analysis?
No. You will need to use one of the forensic
workstations provided.
Q: My forensic software has
certain hardware and resource requirements. How do
I know it will work on the forensic workstation provided?
Contact us with your requirements. We will
make sure that you have the proper configuration for
you to use.
Q: What if my background check
comes back with derogatory information that is not
mine?
Since the background check is based on your fingerprints,
this is not likely. If there is a dispute however,
it is up to you to have the matter cleared up. CSI
will not get involved in such a dispute.
Q: How does the CSFA certification
compare to the other digital forensic certifications
available?
The CSFA is an advanced certification, and does not
take the place of the other certifications currently
available. We feel (as do those having taken the test)
that the CSFA is the most thorough, comprehensive
and accurate test of a digital forensic analyst's
capabilities and knowledge. Before sitting for the
CSFA, it is highly recommended that you possess one
of the other certifications listed here.
Q: What is the pass rate for
the test?
To date, between 40-50% of the test candidates pass
the test.
Q: Why are there not as many
people that possess the CSFA when compared to the
other certifications currently available?
Several reasons - the CSFA is taken over a three day
period and the test candidate must physically be present
for the test - these requirements themselves limit
the number of people taking the test. The cost for
the test, travel and lodging can be prohibitive. As
well, the test is administered (currently) only a
few times a year due to the logistics.
Q: What locations is the test
administered at?
Primarily in Washington State at this point,
but we will consider giving the test at other locations
abroad. If you are interested in hosting the CSFA,
contact Steve Hailey at Steve.Hailey at CyberSecurityInstitute.biz
Q: What if my FBI background
request comes back indicating that my prints are unreadable
or indiscernible?
If a criminal background report comes back from the
FBI indicating that the prints are not readable, you
should have a second set of prints done at the nearest
State Police Post and resubmitted to the FBI for processing.
Q: I have a copy of an FBI
background check that was done at the request of my
employer. Can I use this?
We cannot accept a copy of a report that has been
done for any other entity or organization. CSFA test
candidates must make the request and then voluntarily
submit the information to us.
Q: Can I submit a photocopy
of my FBI report?
The original report(s) and fingerprint cards must
be attached to your CSFA test candidate form. Photocopies
of the fingerprint card and/or the written report
from the FBI are not acceptable.
Q: When I went to get my fingerprints
done, I was told that the requesting organization
needs to provide the fingerprint cards. How do I obtain
these from CyberSecurity Institute?
CyberSecurity Institute is not the requesting
organization. You are requesting the background check
be completed for personal review, and will then voluntarily
turn it over to us. CyberSecurity Institute has no
authorization to request that the check be performed
on you. Please review the FBI
Background Check page for specific instructions
and additional information.
Q:
How do I fill out the fingerprint card?
Please see the following URL: FD-258
FBI Fingerprint Card and FBI Identification Record
Information
Q: Do I have to stay each
day until 7:00 PM? This is too long of a day for me.
You do not have to stay each day until 7:00
PM. Understand however that once you leave for the
day you cannot return to the testing center again
that same day.
Q: Are cell phones and pagers
allowed during the test?
Yes. They should be put on the vibrate setting..
Q: Can I bring a removable/portable
hard drive into the testing center?
Yes, but only for the purpose of loading forensic
tools onto your workstation, which will be monitored.
The USB ports will be locked and will need to be unlocked
by a proctor. Taking the forensic image files away
from the testing center will be grounds for termination
of the candidate's test and expulsion from the testing
center. Exhibits, reports in work, and extracted evidence
may be taken from the testing center. For this purpose,
you can use CD's. Be sure to bring a supply.
Q: What if I have an emergency
and I need to leave the testing center?
As long as you can provide documentation of
the emergency, you will be allowed to reschedule your
test. Understand that these situations will be taken
into consideration on a case-by-case basis, and that
the final decision is up to CyberSecurity Institute.
Q: What if a situation arises
that is not covered in the testing rules?
Personnel will be present to deal with these
situations. CyberSecurity Institute will make the
final decision as to how the situations will be dealt
with.
|
