Hi, I was wondering if anyone could give advice on how Guidance software likes their reports to be formatted. I recently failed the phase 2 of the exam which was a surprise to me because I felt like locating the evidence was really not that difficult.... so really I can not account for anything I did wrong there. The report itself was also proofread several times for any grammar mistakes, which leads me to believe it has to be the format and the amount of technical information I chose to include to give verification to my answers. So it is either i got deducted points for giving simplification to answers, or, and I do not in want to put down the "certification coordinators / Guidance Software" in anyway, but is it possible the people grading the test ONLY want a simplified version of findings. I only say this because the questions on the report really seemed a bit ... simplified....Of course with their 0 feedback rule I have no way to know this for sure.

OK rant over... So I guess my question is do they want simple or just the data dump that the encase software spits out.

Thank You for any responses.  

As an EnCE, my thoughts are that they require you to create bookmarks and the like to produce your findings and notes bookmarks to wrap your discussions around your findings. Then use the reporting functionality within the software.  

Thank You for your thoughts, I do feel for the most part that is how I approached documenting my findings, but thank you, I will try to concentrate on learning more about encase reporting. Is it plausible to lose points for including other information that was not specifically asked for. For instance (without getting into any specifics about the test) if I am told to document a file and I see it relevant to also document dates or maybe a corresponding link file that ties into an explanation of findings. The reason I ask is the phase 2 test outline seemed a bit on the authoritarian side a bit over the top with the "my way or highway" routine as oppose to something like the CCE certification offers.  

Commenting purely on the formatting, you can export all of your bookmarks and notes into (a very large) RTF file which you can then format in a word processor of your choice. If you create a bookmark folder per question (it may even tell you to do that ?) I don't think you can go far wrong. I think it makes sense to tackle it as a series of questions and not as producing a final report as you would for work.

I seem to remember some questions being very direct as to what was specifically required and others were more general. If the question is direct bookmarking or discussing lots of extra things may not demonstrate that you understand what is being in asked, and could foreseeabley lose you marks.

Good luck second time round  

Thanks guys for the feedback it makes sense when put in context of what your saying. Not trying to bash the EnCE test process its a good cert in its own way, just a bit annoying when you look back at a test and think "what would I change" and the answer is not a *darn thing.. ha  

Some of questions in phase 2 wanted them answered in very specific ways as stated on the exam. If you deviated from that, you may have been dinged.
_________________
Some things you just can't "unsee". 

- 96hz

Commenting purely on the formatting, you can export all of your bookmarks and notes into (a very large) RTF file which you can then format in a word processor of your choice. If you create a bookmark folder per question (it may even tell you to do that ?) I don't think you can go far wrong. I think it makes sense to tackle it as a series of questions and not as producing a final report as you would for work.

I seem to remember some questions being very direct as to what was specifically required and others were more general. If the question is direct bookmarking or discussing lots of extra things may not demonstrate that you understand what is being in asked, and could foreseeabley lose you marks.

Spot on.