We are now at the end of Section 5.
You have completed so much in this course.
What I want to challenge you to do is to take the cert, GASF,
and I want to do some review and some GIAC hints
with you that may help you prepare for this certification.
Let's go to your class Dropbox.
I am going to go into your class Dropbox.
And what we are going to see is we have Bonus.
So in Bonus, we have GASF.
Let's go there.
You have an INDEX file.
Now, I want to take a look at this index,
and I want to show you the importance
of creating your own.
When we look at this, how this is laid out--
and it can be extremely overwhelming.
Extraction, for example, when you see 1:124,
that means book 1, page 124, book 1, page 126.
The issue with this is you don't have any context with it.
So you will not have time, if you have an extraction
question, to go through all five books on all these pages
and figure out the answer.
You will run out of time.
This index is your last hope.
So what I want you to do is print it,
and I want you to take it to the cert with you.
But what I recommend is that you look at this Sample_Cert_Index
that I provide to you.
And when we look at this Sample_Cert_Index, what
you're going to see is at the bottom--
and some people are like, holy cow, you're insane.
This works really well.
Start with Book 1.
In Book 1, go through your books and your notes.
Write down a term in the Term column.
Write down a definition of what it means
to you, the book, and the page.
So for example, Book 1, let's go all the way back to Section 1.
Maybe you want to write CDMA.
Definition, Code Division Multiple Access,
found on certain devices in these regions.
It is the type of cellular technology used, Book 1, page
18, or whatever it may be.
You could do the same thing.
Let's say, you did IMEI.
Under definition, what that stands for.
That's a serial number for GSM devices
that's typically 15 digits in length, Book 1, page 32.
So now, you're kind of getting the concept.
Do that for all of your books, every single one.
So all the way through 6-- do you notice?
There is a Book 6.
That would be your workbook.
If you think you're good on the labs
and nothing in those workbooks will help you,
then you're fine.
But if you think you could see additional screenshots
or something that would add value, index that.
When you're done, copy everything from Book 1,
paste it into Overall.
Copy everything from Book 2, paste it in Overall, and so on.
Then you're going to sort alphabetically,
and you put it into A, B, C, D, E, F, and so on.
What I recommend, before you take the time to put it in A,
B, C, D, all the way through Z, keep it
in this Overall form on a separate computer.
Attempt to take Practice Test 1.
So when you sign up for the cert,
you get two practice tests.
They will be the same length of time you get to take your cert.
So I think the cert is three hours, 75 questions.
And we can look that up in a moment.
You get the same amount of practice time.
So make sure you allocate the appropriate time to prepare.
On a separate computer, you're going
to log in and take your test.
Use your index electronically because, then, you can just
do Control-F. You can search for the words of interest
and find it.
After you take Practice Test 1, it
will tell you where you did really well
and where you didn't do so well.
What I recommend is if you have three stars or less,
that you review those sections in the book,
and you listen to the course again for that.
Update your index.
Try Practice Test 2 when you're ready.
You may find that you want to redo some labs,
you want to review the books again.
But if you did fairly well on Practice Test 1,
just revamp your index, and take Practice Test 2
when you're ready.
After Practice Test 2, do the same thing-- three
stars or less, re-listen to Sections, review your notes.
Update your index.
Then, put it in all the categories for letters
and print it.
I put it into a binder with tabs,
so I know A, B, C, D, and so on--
whatever makes the most sense to you.
If you think you don't need that,
you definitely don't have to do it.
But what you will also find is, in here, we have GASF.txt.
It tells you where to go to sign up for the cert.
It also tells you where to go to sign up
for your proctored exam.
The exam is open-book.
Anything you can print, you can take with you.
If we go-- I'm going to click on the plus sign and go
check out the details of the cert.
You could see it gives you information about it.
It's going to tell us what is covered, the exam format.
So it's 75 questions, two hours, passing score of 69.
It must be proctored.
You cannot take anything electronic into that
certification.
Now, I realize, I gave you a lot of bonus items in your Dropbox.
The only thing you truly need to print, I would say,
are your cheat sheets and the h01 index.
Make sure you grab that.
When you go in, it's going to tell you the format.
The format is all multiple choice.
It essentially tells you the objectives
that you're going to be tested on.
It is going to provide, as we look in here, other resources.
It's going to tell you how to take this training, which
you've just done.
Something else I want to mention at this point--
if you look up hack4pancakes, she has really good--
Lesley Carhart is hacks4pancakes.
She has good methods for studying for GIAC exams.
I also recommend that you just type into our Google group
and say, does anyone have any hints or things
that I could do?
You can see here, too, Preparing for your GIAC Exam.
And it will walk you through ways to learn, what to do,
how to be successful in the GASF.
I will tell you, I hear a lot of good things about this cert,
that it is fair to the course.
But again, obviously, if you have any questions
or you want additional hints, if you're really nervous about it,
reach out to Lee and I. We are here to support you.
But do not wait.
You have four months after course completion to take it.
Do not wait four months.
If you wait, you're going to forget.
But also, don't rush into it two days
after you finish the course and take it.
Prepare your index.
Go through the notes.
Make sure you're reviewing everything
possible to prepare for this.
You have now successfully completed
all of the course content with me lecturing you in Smartphone
Forensic Analysis In-Depth.
The next thing is going to be Section 6, which is strictly
the Forensic Capstone.
I encourage you to play this.
You have a chance to win a class coin.
If you're going to do this, do not
peek at the Day 6 information inside of your Dropbox
until you are told to do so by me.
For anyone else who does not want
to participate at this point, the data is always there.
You will always have the questions and answers.
You can always go back and listen to the walkthrough.
I challenge you, at some point, to try this investigation.
It involves two iPhones and an Android.
It's a lot of data that is collected and provided to you.
It involves cloud data, iTunes backups.
Make sure you take the time to dig through these data.
Also, what I want you to do is continue testing,
continue researching.
Join the Google group, and stay active in this community.
I encourage you, if you do research,
present at the DFIR Summit.
Come to conferences.
Introduce yourself.
We are a small community.
We are tight-knit.
In the mobile forensics community,
there are so many people willing to help you and do new things.
Don't hesitate to reach out.
And thank you for taking the course.
If you ever see me in person, come up and find me.
I have lots of stickers.
I'm always known for that.
And I'd love to have a face with your name.