Computer Hacking Forensic Investigator (CHFI)

Course Overview

EC-Council’s C|HFI program prepares cybersecurity professionals with the knowledge and skills to perform effective digital forensics investigations and bring their organization into a state of forensic readiness. Establishing the forensics process, lab, evidence handling procedures, and investigation techniques are required to validate/triage incidents and point the incident response teams in the right direction.

Forensic readiness is crucial as it can differentiate between a minor incident and a major cyber-attack that brings a company to its knees.This intense hands-on digital forensics program immerses students in over 68 forensic labs, working on crafted evidence files utilizing the tools of the world’s top digital forensics professionals. Students will go beyond traditional hardware and memory forensics, covering current topics in cloud forensics, mobile and IoT, and investigating web application attacks and malware forensics. The C|HFI presents a methodological approach to computer forensics, including searching and seizing, chain-of-custody, acquisition, preservation, analysis, and reporting of digital evidence.

Learning Outcomes

Computer forensics fundamentals, different types of cybercrimes and their investigation procedures, and regulations and standards that influence computer forensics investigation

Different types of disk drives and their characteristics, booting process and file systems in Windows, Linux, and Mac operating systems, file system examination tools, RAID and NAS/SAN storage systems, various encoding standards, and file format analysis

Data acquisition fundamentals and methodology, eDiscovery, and how to prepare image files for forensics examination

Various anti-forensics techniques used by attackers, different ways to detect them and related tools, and countermeasures

Volatile and non-volatile data acquisition in Windows-based operating systems, Windows memory and registry analysis, electron application analysis, Web browser forensics, and examination of Windows files, ShellBags, LNK files, and Jump Lists, and Windows event logs

Volatile and non-volatile data acquisition and memory forensics in Linux and Mac operating systems

Network forensics fundamentals, event correlation concepts, Indicators of Compromise (IOCs) and ways to identify them from network logs, techniques and tools related to network traffic investigation, incident detection and examination, and wireless attack detection and investigation

Malware forensics concepts, static and dynamic malware analysis, system and network behavior analysis, and ransomware analysis

Web application forensics and challenges, web application threats and attacks, web application logs (IIS logs, Apache web server logs, etc.), and how to detect and investigate various web application attacks

Tor browser working methodology and steps involved in the Tor browser forensics process

Cloud computing concepts, cloud forensics, and challenges, fundamentals of AWS, Microsoft Azure, and Google Cloud and their investigation processes

Components in email communication, steps involved in email crime investigation, and social media forensics

Architectural layers and boot processes of Android and iOS devices, mobile forensics process, various cellular networks, SIM file system, and logical and physical acquisition of Android and iOS devices

Different types of IoT threats, security problems, vulnerabilities and attack surfaces areas, and IoT forensics process and challenges

Exam Information

Exam Title : Computer Hacking Forensic Investigator (CHFI)

Exam Code : 312-49

Availability : ECC Exam Portal

Duration : 4 Hours

Number of Questions : 150

Course Content & Modules

Computer Forensics in Today's World

Module 01

This module provides a comprehensive introduction to computer forensics, covering the fundamental concepts, legal aspects, and current challenges in digital investigations. Students will learn about the role of computer forensics in cybersecurity, law enforcement, and corporate investigations.

Computer Forensics Investigation Process

Module 02

Learn the systematic approach to computer forensics investigations, including the complete investigation lifecycle from initial response and evidence collection to analysis, documentation, and reporting. This module covers chain of custody, legal requirements, and best practices.

Understanding Hard Disks and File Systems

Module 03

Master the technical aspects of hard disk drives, solid-state drives, and various file systems including NTFS, FAT, ext4, and HFS+. Learn about disk geometry, partition tables, boot sectors, and how to recover deleted files and hidden data.

Data Acquisition and Duplication

Module 04

Learn proper techniques for acquiring and duplicating digital evidence while maintaining forensic integrity. This module covers write-blocking, imaging tools, hash verification, and various acquisition methods including live and dead acquisitions.

Defeating Anti-forensics Techniques

Module 05

Learn to identify and overcome various anti-forensics techniques used to hide or destroy digital evidence. This module covers steganography, encryption, data wiping, file system manipulation, and advanced techniques for recovering hidden or obfuscated data.

Windows Forensics

Module 06

Master Windows-specific forensic techniques including registry analysis, event logs, prefetch files, and Windows artifacts. Learn to investigate user activity, system changes, and security events on Windows operating systems.

Linux and Mac Forensics

Module 07

Learn forensic techniques specific to Linux and macOS systems including file system analysis, log examination, and system artifacts. Master command-line forensics tools and understand the unique characteristics of Unix-based operating systems.

Network Forensics

Module 08

Master network forensic analysis including packet capture analysis, network traffic reconstruction, and intrusion detection. Learn to investigate network-based attacks, trace communication patterns, and analyze network protocols for evidence.

Malware Forensics

Module 09

Learn to analyze and investigate malware incidents including static and dynamic analysis techniques. Master reverse engineering, behavioral analysis, and understanding malware capabilities, persistence mechanisms, and communication patterns.

Investigating Web Attacks

Module 10

Master forensic investigation of web-based attacks including SQL injection, cross-site scripting, and web application vulnerabilities. Learn to analyze web server logs, investigate web application breaches, and trace attack vectors through web infrastructure.

Dark Web Forensics

Module 11

Learn to investigate activities on the dark web including Tor network analysis, cryptocurrency transactions, and underground marketplaces. Master techniques for tracking anonymous communications and gathering intelligence from dark web sources.

Cloud Forensics

Module 12

Master cloud forensics challenges and techniques including data collection from cloud environments, virtual machine forensics, and cloud service provider cooperation. Learn about shared responsibility models and legal considerations in cloud investigations.

Email and Social Media Forensics

Module 13

Learn to investigate email communications and social media activities including header analysis, metadata extraction, and timeline reconstruction. Master techniques for analyzing email servers, social media platforms, and messaging applications for evidence.

Mobile Forensics

Module 14

Master mobile device forensics including smartphone and tablet analysis, app data extraction, and mobile security investigations. Learn about iOS and Android forensics, mobile malware analysis, and location data recovery.

IoT Forensics

Module 15

Learn to investigate Internet of Things (IoT) devices including smart home devices, industrial systems, and connected vehicles. Master IoT forensics challenges, embedded system analysis, and network-based IoT investigations.

Duration

3 Days

Level

Advanced

Certification

EC-Council

Language

English & Malay

Format

Online & Physical

Starting from

Computer Hacking Forensic Investigator (CHFI)

Course Overview

Learning Outcomes

Exam Information