312-49
Coming Soon
Expected availability announced soon
This course is in active development. Preview the scope below and create a free account to be notified the moment it goes live.
ECCouncil CHFI
The CHFI 312-49 exam teaches professionals to collect, preserve, and analyze digital evidence across computers, networks, mobile devices, and IoT, ensuring findings are court‑admissible and actionable.
240
Minutes
150
Questions
70/100
Passing Score
$999
Exam Cost
Who Should Take This
It is intended for forensic investigators, incident responders, and security analysts who already possess foundational knowledge of networking and operating systems and seek to master legal‑compliant evidence handling. Candidates typically hold 2–5 years of hands‑on experience and aim to validate their expertise for professional advancement and courtroom credibility.
What's Covered
1
Digital Forensics Fundamentals
2
Hard Disk and File System Forensics
3
Operating System Forensics
4
Network Forensics
5
Mobile and IoT Forensics
6
Cloud and Virtual Forensics
7
Malware Forensics
8
Anti-Forensics and Data Hiding
9
Forensic Reporting and Expert Testimony
What's Included in AccelaStudy® AI
Adaptive Knowledge Graph
Practice Questions
Lesson Modules
Console Simulator Labs
Exam Tips & Strategy
20 Activity Formats
Course Outline
60 learning goals
1
Digital Forensics Fundamentals
2 topics
Investigation methodology
- Apply digital forensics investigation methodology including case assessment evidence identification collection examination analysis and reporting phases.
- Apply chain of custody procedures including evidence logging tamper-evident packaging transportation documentation and court-admissible handling.
- Apply first responder procedures including scene documentation volatile evidence preservation order of volatility and live system triage acquisition.
- Analyze legal requirements for digital evidence including search warrants privacy regulations jurisdictional considerations and expert witness obligations.
Forensic tools and lab
- Apply forensic workstation setup including write-blocker installation forensic imaging software validation and tool certification procedures.
- Apply forensic imaging using dd dcfldd FTK Imager and EnCase to create verified bit-stream copies with hash validation for evidence integrity.
- Apply forensic tool validation and documentation to ensure tool reliability and maintain defensible analysis procedures for legal proceedings.
2
Hard Disk and File System Forensics
3 topics
File system analysis
- Apply NTFS forensics including MFT analysis alternate data streams file system journal examination and timestamp interpretation for evidence recovery.
- Apply ext4 APFS FAT32 and exFAT forensics to recover deleted files analyze metadata timestamps and identify data remnants across file systems.
- Apply data carving using Foremost Scalpel PhotoRec and bulk_extractor to recover files from unallocated space and damaged volumes.
- Apply disk partition analysis to identify hidden partitions encrypted volumes host-protected areas and device configuration overlays.
- Analyze file system artifacts including MFT entries journal logs USN changes directory entries and INDX records to reconstruct user activity timelines.
RAID and storage forensics
- Apply RAID reconstruction techniques to recover data from RAID 0 1 5 and 6 arrays when individual disks are imaged separately.
- Apply SSD forensics including TRIM awareness wear-leveling effects garbage collection and SSD-specific acquisition challenges for evidence preservation.
Database forensics
- Apply database forensics to examine SQL Server MySQL and PostgreSQL transaction logs query history and data modification records.
- Analyze database audit trails to reconstruct unauthorized data access modification and exfiltration activities with user attribution.
3
Operating System Forensics
2 topics
Windows forensics
- Apply Windows registry forensics to extract user activity recent documents USB device history network connections and installed software evidence.
- Apply Windows event log analysis to identify logon events process execution privilege escalation account changes and security policy modifications.
- Apply Windows artifact analysis including prefetch files shellbags jump lists LNK files and browser history to establish user behavior timelines.
- Apply Windows NTFS artifact analysis including $MFT $LogFile $UsnJrnl and $I30 to reconstruct file creation modification and deletion events.
- Analyze Windows memory dumps using Volatility to extract running processes network connections loaded modules injected code and malware indicators.
Linux and macOS forensics
- Apply Linux forensics including syslog analysis bash_history authentication logs cron examination systemd journal and file permission timeline reconstruction.
- Apply macOS forensics including Spotlight metadata plist analysis Keychain examination unified logging FSEvents and Time Machine backup analysis.
- Apply Linux memory forensics using Volatility and LiME to extract process lists network sockets kernel modules and rootkit indicators from RAM captures.
- Analyze cross-platform forensic artifacts to correlate evidence across Windows Linux and macOS systems in multi-platform investigation scenarios.
4
Network Forensics
2 topics
Network traffic forensics
- Apply network forensics using Wireshark NetworkMiner and tcpdump to capture analyze and reconstruct network sessions from full packet captures.
- Apply log-based forensics using firewall IDS proxy DNS and DHCP logs to trace attacker movement identify lateral traversal and map C2 channels.
- Apply NetFlow and Zeek log analysis to identify data exfiltration anomalous connections beaconing patterns and protocol tunneling activities.
- Analyze network traffic to identify covert channels DNS tunneling ICMP tunneling and encrypted C2 communication in forensic investigations.
- Apply wireless network forensics using packet captures from monitor mode to identify rogue devices unauthorized access and wireless attack indicators.
Web and email forensics
- Apply web browser forensics to extract browsing history cached pages cookies download records bookmarks and autofill data from major browsers.
- Apply email forensics including header analysis routing path reconstruction attachment extraction and phishing email source attribution.
- Apply web server log forensics to reconstruct attack sequences identify exploited vulnerabilities and attribute malicious requests to source addresses.
- Analyze web application attack artifacts to determine injection points data exfiltration scope and backdoor installation evidence from server-side logs.
5
Mobile and IoT Forensics
2 topics
Mobile device forensics
- Apply mobile device acquisition using logical physical chip-off and JTAG extraction methods on Android and iOS while maintaining evidence integrity.
- Apply Android forensics to extract call logs SMS messages app data GPS locations photos SQLite databases and deleted content from acquisitions.
- Apply iOS forensics to extract backup data keychain items app containers location history and communication records from iPhone and iPad devices.
- Analyze mobile application artifacts including messaging apps social media cloud sync data and encrypted communication for investigation support.
IoT and embedded forensics
- Apply IoT forensics including firmware extraction sensor data analysis communication protocol capture and smart device log examination.
- Apply vehicle and drone forensics including infotainment system extraction GPS log recovery CAN bus data and flight controller log analysis.
- Analyze IoT device evidence to establish event timelines identify unauthorized access correlate sensor data and attribute activities across devices.
6
Cloud and Virtual Forensics
1 topic
Cloud forensics
- Apply cloud forensics for AWS including EC2 snapshot acquisition CloudTrail log collection S3 access log analysis and IAM activity reconstruction.
- Apply cloud forensics for Azure and GCP including VM disk capture activity log collection storage account examination and identity event analysis.
- Apply virtual machine forensics including snapshot analysis virtual disk examination hypervisor log review and container image layer inspection.
- Analyze cloud audit trails to identify unauthorized access data modification resource provisioning lateral movement and configuration changes.
- Apply Kubernetes forensics including pod log collection container image history analysis orchestration audit trail and persistent volume examination.
7
Malware Forensics
1 topic
Malware analysis for investigations
- Apply static malware analysis including PE header inspection string extraction import analysis YARA rules and file entropy measurement for classification.
- Apply dynamic malware analysis in sandboxed environments to observe runtime behavior network connections registry changes and file system modifications.
- Apply malware memory forensics to identify injected code hollowed processes API hooks and rootkit artifacts in system memory dumps.
- Analyze malware artifacts to determine infection vectors persistence mechanisms C2 infrastructure lateral spread and data exfiltration capabilities.
- Design malware investigation procedures incorporating containment sample collection analysis workflows and IoC extraction for threat intelligence sharing.
8
Anti-Forensics and Data Hiding
1 topic
Anti-forensic detection
- Apply steganography detection using StegDetect OpenStego statistical analysis and image comparison to identify hidden data in media files.
- Apply encrypted volume detection for TrueCrypt VeraCrypt BitLocker and FileVault including header identification and recovery approaches.
- Apply data hiding detection in alternate data streams slack space HPA DCO and file system metadata areas to recover concealed evidence.
- Analyze anti-forensic artifacts including timestamp manipulation log deletion secure wiping evidence and data obfuscation to counter adversary evasion.
- Apply secure deletion detection to identify evidence of disk wiping tools file shredding utilities and factory reset attempts on storage media.
9
Forensic Reporting and Expert Testimony
1 topic
Report writing and testimony
- Apply forensic report writing including case summary methodology description evidence catalog analysis findings conclusions and recommendation sections.
- Apply timeline analysis to create visual chronologies of digital events correlating evidence from multiple sources into coherent investigative narratives.
- Design forensic investigation documentation standards including evidence handling SOP tool validation records and reproducible analysis workflow templates.
- Analyze investigation findings to formulate expert opinions prepare testimony materials and withstand cross-examination on methodology and conclusions.
Scope
Included Topics
- All domains in EC-Council CHFI covering digital forensic investigation methodology evidence handling file system network mobile cloud and malware forensics.
- Digital evidence acquisition including forensic imaging chain of custody write-blocking and cryptographic verification for court-admissible evidence.
- Operating system forensics for Windows Linux and macOS including registry analysis event logs memory forensics and artifact timeline reconstruction.
- Network and web forensics including packet capture analysis log correlation email header analysis and web application attack reconstruction.
- Mobile and IoT forensics including device acquisition app data extraction GPS analysis and IoT sensor data examination.
- Anti-forensic technique detection including steganography encrypted volume analysis timestamp manipulation and secure deletion recovery.
Not Covered
- Offensive penetration testing and exploitation methodologies covered by CEH and CPENT.
- Enterprise network defense architecture and perimeter security covered by CND.
- SOC operations real-time monitoring and threat hunting covered by CSA.
- Incident response team management and organizational coordination covered by ECIH.
- Secure application development and code review covered by CASE and ECSP.
Official Exam Page
Learn more at EC-Council
312-49 is coming soon
Adaptive learning that maps your knowledge and closes your gaps.
Create Free Account to Be Notified