Passed GCFE Today

YFZblu

Greets, TE--

Back in October I participated in the SANS Work Study program for the Network Security conference in Las Vegas. It was a pretty crazy event from a WS perspective. I attended the Windows Forensics Analysis course [FOR408]

Anyway, today I passed the associated GCFE exam. There is a lot of information in this course. After a couple weeks of heavily reviewing the material, my brain finally fried mid-exam, and for the first time ever I had to take an exam break to go shut down for a few minutes. I don't do forensic investigations in the 'GCFE' sense for work, and I did not hit the 90% goal I usually set for myself regarding GIAC certification; however I am still happy with the result.

In any event, I highly encourage anyone interested in learning more about Windows artifacts to take the course. It really is enlightening to now have countless areas within the file system that I can use to aid me in the investigations I am involved in on a daily basis to validate my findings.

Upon returning from the SANS conference, I spoke with two guys who attended the FOR508 course that regretted not taking FOR408 first. That seems to be a running theme, as even the course author mentioned that in the MP3's for the course. So don't take this one lightly! It is 400 level, yes, but it is extremely dense.

Up next is probably to resurrect my OSCP studies which took a back seat to other things. I'll have to dig that thread up after a few days rest and get moving again.

YFZblu

Also, I have an extra GCFE practice exam if anyone would like it. PM me.