Took SANS 408 with Heather Mahalik in March 2016 as my first SANS class.
Here are some photos on how I organized my textbooks and index:
https://imgur.com/a/wOWCG
As you can see, I labeled the major portions of the textbooks using color coded sticky notes. For me this was hands down the most effective way to easily search the textbooks. Using my index was far too time consuming and often didn't have the extremely specific information I was looking for. I think my index ended up being about 68 pages.
For example, in the fifth textbook (web browser forensics), Chrome forensics would be labeled using a blue sticky note on the top end of the textbook and all of the detailed information such as Chrome artifacts, cookies, Incognito Mode, etc would also be labeled using a blue sticky note except on the right hand side of the textbook. So my search would go:
1. need web browser forensics -> see book five
2. need Chrome forensics -> see all blue tabs
3. search blue tabs on right hand side for specific topics on Chrome forensics
Another thing that helped me was creating a small index for important file, folder, and registry paths.
I only just took the exam last Monday (Tuesday was the last possible day I could take it) and passed with an 85%.
I took both of my practice exams and scored a 78% on the first and an 87% on the second. The practice exams were very good indicators of how well you could expect to do on the actual exams.
Hope this helps.
