Journey to the Center of GCFA (FOR508)

Thu, 18 Jun 2026 00:00:00 +0000

Phew, what a long journey!

I did not want to certify GREM (FOR610), because I wanted something to challenge my mind with, a new knowledge. Sometimes I regretted that decision, but I’m proud of that.

I spent about 15 months on that one, and that’s take #1: don’t overestimate it and get it off your chest as soon as you can.

But honestly, I didn’t take it seriously at first. Like, the first 7 months was just reading the books as if I’m reading a novel, not limiting myself with a deadline, and few events happened in between that made that journey even longer. So I think that could’ve been compressed down to 3 months.

What makes DFIR different from Reverse Engineering mindset?

It’s the freakin’ certainty!

In RE, everything is just straightforward. The assembly instructions won’t have two meanings, you want to know the functionality of a piece of binary, and you just can know it and be certain about it.

On the other hand, that DFIR sh!t is just an assumption after an assumption. I remember very well how the Prefetch/ShimCache/Amcache made me lose it, like WTF? Just tell me, was that binary executed or not!

Eureka moment

A book after the other, it was all clear.

My Eureka moment was timelines, it’s the one thing that makes every puzzle piece fit together and tell a story chronologically!

Some comments on the course

SANS did a pretty good job in making that material, but order of topics is “Meh”, like it could be better.

And you will see a small digital hell in making an index or summary notes, because topics are revisited across books, and sometimes in the same book but different pages, so enjoy *devilish laugh*.

What kind of index is better?

I don’t know, differs from person to person. Some are more comfortable with topics index like in pancakes method, others are with sorted-keywords, and I did that. It’s really something relative.

And by the way, neither I nor my friend used the index that much. Posters, notes, and book tabs did the heavy lifting here.

What would I’ve done if I went back in time?

I would’ve done a better time management, put some certain tight deadlines.

Reading fast in the first pass without highlighting or indexing, solving labs after finishing all books in that first pass.

Then doing a second pass which should be in deep, highlighting books, putting tabs, solving labs again while taking notes, then creating an index.

Then it is time to test that index with just these 2 passes in the practice test, and from the practice test’s insights I should refine that index more, and revise topics I suck at.

Then the third and final pass, which should last only 7-14 days to the final exam.

TL;DR

I hate Microsoft, like, really. The team sucks, and you will see that the more you go deep into internals, you may find a rotten apple inside, and it’s just there for backward compatibility.

That Windows sh!t is confusing as hell, so just be ready for some logic out of the Windows. But apart from that, it’s a rewarding experience and builds a good mindset.