Computer Hacking Forensic Investigator (CHFI) (312-49) Exam Guide

1. Understand Different Types of Cybercrimes and List Various Forensic Investigation Challenges
2. Understand the Fundamentals of Computer Forensics and Determine the Roles and Responsibilities of Forensic Investigators
3. Understand Data Acquisition Concepts and Rules
4. Understand the Fundamental Concepts and Working of Databases, Cloud Computing, Emails, IOT, Malware (file, fileless, and .NET), and Dark Web

1. Understand Rules and Regulations Pertaining to Search and Seizure of the Evidence and Evidence Examination
2. Understand Different Laws and Legal Issues that Impact Forensic Investigations
3. Understand Various Standards and Best Practices Related to Computer Forensics

Example scenario: An HR manager hands you a laptop and asks you to find proof of misconduct. What must be in place before you start, and how do you record what you do?

1. Understand the Fundamental Characteristics and Types of Digital Evidence
2. Understand the Fundamental Concepts and Working of Desktop and Mobile Operating Systems
3. Understand Different Types of Logs and their Importance in Forensic Investigations
4. Understand Various Encoding Standards and Analyze Various File Types
5. Understand the Fundamental Workings of WAF and MySQL Database

1. Understand the Forensic Investigation Process
2. Understand the Methodology to Acquire Data from Different Types of Evidence
3. Understand the eDiscovery Process
4. Illustrate Image/Evidence Examination and Event Correlation
5. Explain Dark Web and Malware Forensics

Example scenario: You arrive at a server that is still running and may hold encryption keys in memory. In what order would you collect evidence, and why?

1. Review Various Anti-Forensic Techniques and Ways to Defeat Them
2. Analyze Various Files Associated with Windows, Linux, and Android Devices
3. Analyze Various Logs and Perform Network Forensics to Investigate Network Attacks
4. Analyze Various Logs and Perform Web Application Forensics to Examine Various Web-Based Attacks
5. Perform Forensics on Databases, Dark Web, Emails, Cloud and IoT devices
6. Perform Static and Dynamic Malware Analysis in a Sandboxed Environment
7. Analyze Malware Behavior on System and Network Level, Analyze Malware Persistence, and Analyze Fileless Malware
8. Perform Digital Forensics using Python

Example scenario: A web server log shows unusual requests just before customer data appeared online. Which artifacts would you examine to rebuild the attack timeline?

1. Identify Various Tools to Investigate Operating Systems, Including Windows, Linux, Mac, Android, and iOS
2. Determine the Various Tools to Investigate MSSQL, MySQL, Azure, AWS, Emails, and IoT Devices
3. Identify Various Tools to Perform Network, Web Application, Cloud, Social Media, and Insider Threat Forensics