REVIEW: Magnet Certified Forensic Examiner

on

 


"May the odds be ever in your favor." - Effie Trinket (The Hunger Games)

DISCLAIMER: THIS REVIEW IS MEANT TO SERVE AS MY PERSONAL OBSERVATIONS OF THE MCFE EXAM.  IT'S SOLE PURPOSE IS NOT MEANT TO PREPARE YOU FOR THE MCFE EXAM IN A TRADITIONAL SENSE, BUT I'LL DROP SOME SPOILER FREE ADVICE I THINK YOU'LL FIND USEFUL.  NOW THAT ALL THAT LEGAL MUMBO JUMBO IS OUT OF THE WAY... 

**QUEUE MUSIC**

Now, this is a story all about how
My life got flipped-turned upside down
And I'd like to take a minute
Just listen to me
I'll tell you all you need to know 'bout the M.C.F.E. 

I wish I were joking.  The MCFE literally turned my life upside down... for 8 hours...

Here's the break down: 2 Hours / 75 Questions / 80% or higher to pass. Which translates to 60 correct answers out of 75 questions to achieve 80%.  Easy right?  Wrong.

Oh I forgot to mention the time I spent downloading the evidence, processing the evidence, reviewing the evidence, taking the exam, failing by ONE. FUCKING. QUESTION., and taking the exam again...and passing with 88%... Hello!  McFly!

So yeah, after failing the first time... which I'm still sour AF about... I thought "hey, since I'm a dumbass and they o-b-v-i-o-u-s-l-y use the same questions, I'll just use my free retake immediately and answer all the questions I know I got right first and that will give me more time to look up the answers to the ones I got wrong. WRONG. Oh so W-R-O-N-G... Don't be like me.  There are at least 150 questions in the question pool because every question that was prompted in my second attempt was different from the first (yeah they make you work for those four letters and I don't mean F-U know the rest).

I wish there was a feature from my first attempt that would tell me where I needed help and what I got wrong so that I could solve my deficiencies.  Instead I had to cowboy up and take the test as if I were starting from scratch.  I dug in my spurs and rode that test into submission.  There's a level of satisfaction knowing that this is behind me (at least for the next 2 years).

How to Prepare for the MCFE Exam:
  1. You will receive three (3) pieces of evidence in five (5) 7-Zip files. (PC, External Media, and Phone)
  2. Ensure that you process the data using the correct methods for each piece of evidence.
  3. Make sure that you validate your hashes.
  4. Examine your evidence.
  5. Do it again.
  6. Another one.
  7. Build connections and timelines
  8. If something looks out of place, it probably is.  Check your mistakes.
  9. Go pee, poop, and pray. 
Remember, you have two hours for each attempt.  You don't want to waste it processing data you goofed the first time.  I know because my friend had that happen during their exam... okay fine, that friend was me.

If you think you're up for it, go for it!  You get one immediate retake.  If you fail the second time you can retake in 60 days.  And if you fail that, well... Never give up; Never surrender!

If all else fails, I have the questions and answers for sale... for a small fortune in Bitcoin.  (DISCLAIMER: THIS WAS A JOKE).

Hats off the the folks at Magnet Forensics.  A great way to gauge our understanding of the technical and practical use of the software and it's applications.  I would say the exam is challenging, but not overly-challenging.  So if you're up for the challenge... GO FOR IT!  DO IT NOW!


XOXO,

RB4N6, MCFE

Comments

Post a Comment