I passed my GCFA exam a few months back and I ended up with an extra practice test. If anyone would like it please just PM me. I will need your SANS portal ID to transfer the practice test. It expires in August I think. Sorry for the short time period but someone in my company had expressed interest in studying/taking the exam so I was holding on to it for them. Their loss your gain!
I read four different books for this exam they all helped on different parts. I didn’t feel any of the books covered everything I ran into on the exam. Probably the one that helped the most was File System Forensic Analysis by Brian Carrier. The other three were:
Forensics Discovery (Dan Farmer)
Read Digital Forensics (Keith J. Jones, Richard Bejtlich, & Curtis W. Rose)
Incident Response and Computer Forensics, Second Edition (Chris Prosise, Kevin Mandia, & Matt Pepe)