Source: Juni_2026_Exams/Advance_Forensics/stories/002-exam-preparation-plan.md

📖 Story 002 - Exam Preparation Plan

🎯 Goal

Create a clear, actionable preparation strategy for the Juni 2026 Forensics practical exam.

📅 Exam Preparation Timeline

Week Before Exam

🚀 Study Strategy by Phase

Phase 1: Foundations (2 hours)

Goal: Understand what tools exist and what they do

• Read: notes/00-focus-points.md (10 min)
• Read: notes/01-tooling-overview.md (20 min)
• Skim: notes/02-registry-forensics.md (30 min)
• Review: checklists/tools-cheatsheet.md (20 min)

Success: You understand the 5 main tools and registry basics

Phase 2: Tool Mastery (6 hours)

Goal: Become comfortable using each tool hands-on

FTK Imager (1.5 hours)

• Read: notes/03-ftk-imager-workflow.md
• Practice: Open a forensic image, browse files, export registry
• Memorize: Where user folders are, how to export $MFT

Registry Explorer (1.5 hours)

• Read: Tool guide section in notes/02-registry-forensics.md
• Practice: Load hives, navigate to key paths, understand values
• Memorize: SOFTWARE vs SYSTEM vs SAM vs NTUSER.DAT usage

DCode (1 hour)

• Read: notes/06-timeline-and-timestamps.md
• Practice: Convert Unix timestamps, Windows FILETIME
• Memorize: UTC vs local time differences

MFT Explorer (0.75 hours)

• Read: notes/04-mft-explorer-workflow.md
• Practice: Load $MFT, search for deleted files
• Memorize: Created/Modified/Accessed timestamp differences

LNK Files (0.75 hours)

• Read: notes/05-lnk-recentdocs-userassist.md
• Practice: Analyze .lnk files, understand RecentDocs
• Memorize: Where LNK files are stored

Success: You can use each tool without hesitation

Phase 3: Artifact Recognition (2 hours)

Goal: Know which artifact answers which question

• Study: checklists/registry-artifacts-cheatsheet.md
• Study: checklists/evidence-answer-format.md
• Create flashcards for Tier 1 registry paths

Registry paths to memorize (Tier 1):

Success: You can answer "where do I find X?" for any artifact

Phase 4: Practice & Refinement (3 hours)

Goal: Understand real exam format and perfect your answer style

• Read: solutions/previous-exam-solution-walkthrough.md
• Use: solutions/exam-answer-template.md for practice questions
• Practice: Write 3-5 mock answers
• Get feedback: Compare against previous exam walkthrough

Success: Your answers follow the correct format

Phase 5: Final Prep (2 hours)

Goal: Build speed and confidence

• Quick review: checklists/practical-exam-checklist.md
• Memory test: Can you recall all Tier 1 registry paths?
• Speed test: Time yourself on a mock question
• Confidence check: Do you know which tool for each question?

Success: You're ready for the exam

💡 Learning Order Matters

❌ Wrong: Read registry paths, then learn tools, then practice ✅ Right: Learn tools first, then recognize artifacts, then practice answers

Why: You need to understand how before memorizing what

🔄 Daily Study Routine

30-Minute Review (Every day)

1. Skim 1 tool guide (5 min)
2. Review registry paths (10 min)
3. Quick checklist scan (10 min)
4. Confidence rating (5 min)

2-Hour Deep Dive (3x per week)

1. Pick 1 tool
2. Read guide thoroughly
3. Practice with hands-on exercise
4. Document any questions

4-Hour Mock Exam (Once)

1. Set timer for exam duration
2. Solve practice questions
3. Write answers using template
4. Compare against walkthrough
5. Identify weak areas
6. Review weak areas next day

📝 Study Materials Needed

Must Have

• [x] FTK Imager installed
• [x] Registry Explorer installed
• [x] DCode installed
• [x] MFT Explorer installed
• [x] Sample forensic image for practice

Should Have

• [ ] Previous exam files
• [ ] Lecture PDFs (for exercise extraction)
• [ ] Screenshots from lectures

🎯 Exam Day Strategy

Before Exam

• Review checklists one final time
• Set up tools
• Test forensic image loading
• Have registry paths memorized

During Exam

• Read question carefully
• Identify which tool to use
• Follow step-by-step workflow
• Document every step
• Use template format

Time Management

• 15 min: Read all questions
• 5 min per question: Planning which tool
• 3-5 min per question: Executing
• Buffer time: Last 10 min for review

✅ Acceptance Criteria for "Ready"

• [ ] All Tier 1 registry paths memorized
• [ ] Can use all 5 main tools without help
• [ ] Mock exam score ≥ 80%
• [ ] Understand answer format
• [ ] Know exactly which tool for each question type
• [ ] Can convert timestamps correctly
• [ ] Can find deleted files with MFT Explorer
• [ ] Can navigate Registry Explorer without hesitation

📊 Progress Checklist

Last Updated: June 15, 2026