Greetings,
Yea, I said that and was accused of misunderstanding him and implying that he was trying to cheat.
-David
I must admit I find this an odd thread.
Personally I think the questions asked were fairly sensible, I certainly didn't get the sense that anyone was trying to cut corners.
Hopefully we can put this down to a simple misunderstanding or two. A forum is sometimes a poor medium for expressing yourself clearly (I often find!)
Jamie
From a technical perspective, to say that the CCE is "challenging" or "difficult" is truly misleading, I feel. Someone with an intermediate amount of computer experience and a broad (though not necessarily deep) base of forensics-related knowledge (file carving, where to look for artifacts, familarity with very common file formats, etc.) should be able to complete virtually all of the "challeneges" posed by the various scenarios.
IMHO, the bigger emphasis the CCE places is on your report-writing and how well you're able to substantiate any claims you make in your report with the evidence at-hand. In truth, this is the harder skill to learn without experience. I'm of the opinion that the very best way to become familar with report writing and making sure that all the basic steps of a digitial forensics investigation are completed and documented is by performing either real-life forensics work (if possible) or by completeing mock scenarios and challeneges.
You can search online for various organizations which have posed forensics challeneges in the past, which include images and scenarios - or you can make up one yourself by doing an investigation on your own PC, a honeypot you've setup or a friend or family members computer ( with permission of course ). The ISCFE have an image of floppy disk posted on their own website, I believe. And if my memory serves correctly, they even have a document which states the evidence you should have found and what should've been documented in your report.
Once you've completed your mock report, find an experienced analyst and ask if they'll look over your report for you and give you tips about what should and should not have been included as well as the substance of what was reported and how. I'd be more than happy to help anyone in this regard.
There's my $0.02.
Jeff