The EnCE suits forensic examiners who work with EnCase and want the OpenText credential. This page gives free practice sets by topic, from evidence acquisition and file systems to reporting and legal procedures, plus worked answers, a study plan and the fees, scoring and retake rules published by OpenText.
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Number of questions (Phase II (practical exam)) | 18 questions, all must be answered[1] | OpenText · Oct 26, 2026 |
| Time limit (Phase I (written exam)) | 2 hours[1] | OpenText · Oct 26, 2026 |
| Passing score (Phase II (practical exam)) | 85%[1] | OpenText · Oct 26, 2026 |
| Passing score (Phase I (written exam)) | 80%[1] | OpenText · Oct 26, 2026 |
| Exam fee | $500 USD[1] | OpenText · Oct 26, 2026 |
| Retake policy (Phase II (practical exam)) | Wait 60 days from the due date; a second failure means restarting at Phase I[1] | OpenText · Oct 26, 2026 |
| Retake policy (Phase I (written exam)) | Wait 60 days and pay the fee again[1] | OpenText · Oct 26, 2026 |
| Validity | 3 years[1] | OpenText · Oct 26, 2026 |
| Renewal | $250 USD before expiration ($500 if received after)[1] | OpenText · Oct 26, 2026 |
| Delivery (Phase I (written exam)) | Taken online with Certiverse[1] | OpenText · Oct 26, 2026 |
| Eligibility | 64 CPE hours of computer forensic training or 12 months of experience[1] | OpenText · Oct 26, 2026 |
| Score release | Email notice plus electronic certificate and wallet card[1] | OpenText · Oct 26, 2026 |
According to OpenText, “The exam has 18 questions. You must answer all questions to your best ability in order for your submission to be considered for grading.”[1]
The EnCE is the EnCase Certified Examiner credential from OpenText, aimed at people who examine digital evidence with EnCase. It is split into Phase I, a written exam, and Phase II, a practical exam.
Phase I is taken online with Certiverse. You have 2 hours to complete it, and the minimum passing score is 80%. Phase II has 18 questions, and all of them must be answered for your submission to be graded. Its minimum passing score is 85%.
To apply you need 64 CPE hours of authorized computer forensic training, online or classroom, or 12 months of work experience in computer forensics. The exam fee is $500 USD, and OpenText Learning Subscriptions do not include it.
If you fail Phase I, you wait 60 days before retesting and pay the fee again. If you fail Phase II, you wait 60 days from the date the test was due. A second failure means restarting at Phase I. Passing Phase II brings an email notice, then an electronic certificate and wallet card.
The certification is valid for 3 years. Renewal costs $250 USD if you begin before expiration, and $500 if the application arrives after it. Policies can change, so check the OpenText learning paths page before you book. We have not verified an official list of content areas, so treat the topic sets below as general practice and not a map of the real exam.
Prepare for the EnCE - EnCase Certified Examiner exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: Which professional attribute is most valued in internet artifacts within the EnCE field?
Answer: B. Accountability and commitment to standards
Explanation:
The correct answer is accountability and commitment to standards. Examiners handle evidence that may be challenged later, so people need to trust that each step was done the same documented way and that the examiner owns the result.
Working in isolation is wrong because forensic work depends on review, shared procedures and clear records. Avoiding challenging situations is wrong because difficult findings still have to be reported honestly. Prioritizing personal convenience is wrong because shortcuts weaken the reliability of the work and can damage the evidence.
Rule to remember: when a question asks about professional conduct, choose the option that shows responsibility, documentation and adherence to accepted standards.
Question: Which principle is fundamental to good encase software practice?
Answer: B. Separation of concerns and modularity
Explanation:
The correct answer is separation of concerns and modularity. Splitting work into small parts that each do a single job makes it easier to understand, test, maintain and extend, which matters when you build repeatable processes around a tool.
Writing as much code as possible is wrong because more code usually means more mistakes and more to maintain. Avoiding all abstraction is wrong because abstraction hides detail and keeps the design manageable. Never refactoring code is wrong because refactoring is how structure stays clean as needs change.
Rule to remember: for design principle questions, favor options that reduce complexity and improve clarity, and distrust absolute words such as all and never.
Question: Why is bit-stream imaging used?
Answer: C. Clone exact drive contents
Explanation:
The correct answer is to clone exact drive contents. A bit-stream image copies the storage device sector by sector, including active files, deleted files and unallocated space, so the examiner can work on the copy and leave the original media untouched.
Shrinking files is wrong because imaging does not aim to reduce size; it aims for fidelity. Improving graphics is wrong because the image is unrelated to display quality. Installing patches is wrong because it would change the system, and forensic imaging is meant to avoid altering the source.
Rule to remember: acquisition is about preserving the original state, so pick the answer that describes an exact, unaltered copy.
Start with the official OpenText learning paths page so you know how Phase I and Phase II differ and what the eligibility rules require. Then use the practice sets to find weak spots before you pay the exam fee.
Begin with EnCE Fundamentals & Core Concepts and Evidence Acquisition & Preservation, since later topics build on them. Move on to File Systems & Artifact Examination, Registry Analysis, Internet Artifacts and Email Forensics. Finish with Data Analysis & Reporting, Report Writing and Legal Procedures.
After each set, read the explanation for every miss and write down the rule behind it in your own words. Then repeat the set a few days later without notes. Our questions are written by us and are not real exam questions, so use them to test understanding, not to memorize answers. Because Phase II is practical, spend time in EnCase itself on the same topics.
It depends on the phase. OpenText sets the minimum passing score at 80% for Phase I, the written exam, and 85% for Phase II, the practical exam. Phase II has 18 questions, and you must answer all of them for the submission to be graded.
The fee to take the EnCE exam with Certiverse is $500 USD. OpenText Learning Subscriptions do not include the exam fee. Renewal is a separate cost: $250 USD if you begin before your certification expires, or $500 if the application arrives after expiration.
You need either 64 CPE hours of authorized computer forensic training, online or classroom, or 12 months of work experience in computer forensics. Check the OpenText learning paths page for current wording before you apply, as requirements can be updated.
For Phase I you must wait 60 days before retesting and pay the fee again. For Phase II you wait 60 days from the date the test was due. If you fail Phase II a second time, you restart at Phase I.
An EnCE certification is valid for 3 years from the date obtained. To renew, OpenText charges $250 USD if the process begins before expiration. Applications received after the expiration date are invoiced $500 USD, so start renewal early.
Phase I is taken online with Certiverse, and you have 2 hours to complete it. The minimum passing score is 80%. Phase II is the practical exam, and the OpenText page we checked gives no time limit for it, so confirm details with OpenText.
How we verify: editorial & fact-checking policy. Report an error: contact us.