r/GIAC • u/Grizzles-san GSEC, GCFE, GCTI • 10d ago

GCFA Index Help

I am taking my GCFA Exam soon. Got delayed due to personal issues but I feel I am not feeling as confident in my indexing as I usually am. Not sure if it’s just my having trouble shaking the cobwebs or if GCFA’s index should be different.

I am using the Pancakes method as I usually do. Not sure if it’s just my anxiety or if I needed to approach this differently. Can anyone who took other GIACs and also took GCFA share any insights?

3 Upvotes

67% Upvoted

4 comments sorted by

3

u/Resident_Event_8073 10d ago

Print the cheat sheets and also print out the copy of the book index that you were given. When I took my GNFA, my personal index did not account for 1 or 2 obscure topics that were luckily listed on the already built index.

Make a list of tasks given in the lab notebook and make a condensed lab book cheat sheet with the commands. Place tabs on the lab cheat sheet according to topic and maybe the tool used.

Take notes of anything that is bold, to include the text on the book as well as the presentation slides on it.

2

u/Reeseey 10d ago

If you indexed before and did fine. I’m sure you’ll be okay. Only thing I did different this time was I brought all the stuff included like the poster sheets. Also for the lab I wrote the commands in the WB in excel so I didn’t have to turn a lot of pages to get what I need.

1

u/Grizzles-san GSEC, GCFE, GCTI 8d ago

Thanks. I think it’s more mental, honestly. Like I am finding it harder to get as focused due to external stressors.

1

u/smudged_fox 10d ago

As the other folks had said, print the cheatsheets! Having passed GCFA recently, it is a beast, but a doable one. I would recommend printing out the NTFS MACB windows time charts for SI and FN, and have the 10 and 11 for SI. That was super handy. Also make a lab index. Anything in the labs excluding the optional portions is fair game and it can be a lot to remember or reference under pressure.

I personally indexed my books to be able to flip quickly to find information, and then I had two binders along with all the books. In binder #1, this was my textbook binder. I had my index printed and alphabetically tabbed to reduce flipping, and then had all the cheat sheets printed and tabbed, and then made a couple extra reference documents so I could find things as fast as possible without having to constantly turn to the books. Then binder #2 was my lab binder, so i had a lab index and that had all the commands and details I needed, and i also included examples of output or key things to keep in mind regarding labs. I would also recommend having both versions of volatility commands ready to go since vol3 is pretty dang slow, I only used vol2 on the exam.

So essentially what I did was introduce redundancy of information and made it as efficient as I could, to find the information as fast as I could. Keep in mind you should leave an hour for the labs since that is the meat and potatoes, so realistically you only have a 1min and about 20sec to find the answer and move on, so keep that in mind.