BUILD TOMORROW.
FOR A MORE
SECURE TOMORROW.
Computer Hacking Forensic Investigator (CHFI)
EC-Council / CHFIBuild the skills for your next mission.
This advanced certification course, the EC-Council Certified Computer Hacking Forensic Investigator (CHFI), provides a comprehensive and in-depth exploration of digital forensics and incident response.
Course objectives
Build practical skills across the key domains covered in Computer Hacking Forensic Investigator (CHFI) (CHFI).
Computer Forensics in Today's WorldUnderstand the importance and scope of computer forensics.
- Understand the importance and scope of computer forensics.
- Identify the types of digital evidence and their characteristics.
- Explain the legal considerations and ethical principles in digital forensics.
- Describe the roles and responsibilities of a computer forensic investigator.
- Outline the computer forensics investigation process.
Digital Evidence Acquisition and HandlingApply proper procedures for evidence collection and chain of custody.
- Apply proper procedures for evidence collection and chain of custody.
- Utilize forensic imaging and cloning tools for data acquisition.
- Perform live data acquisition from volatile memory.
- Acquire data from various storage media, including hard drives, SSDs, and mobile devices.
- Ensure data integrity and authenticity using hashing and verification techniques.
- Understand anti-forensics techniques and methods to counter them.
Forensic Analysis of Operating Systems and FilesystemsAnalyze Windows operating system artifacts, including registry, event logs, and user activity.
- Analyze Windows operating system artifacts, including registry, event logs, and user activity.
- Conduct forensic analysis on Linux/Unix operating systems.
- Examine macOS operating system artifacts.
- Perform file system analysis for FAT, NTFS, HFS+, and Ext family file systems.
- Recover deleted files and partitions.
- Identify and analyze hidden data within file systems.
- Utilize forensic tools for data carving and signature analysis.
Network and Cloud ForensicsPerform network traffic analysis to identify malicious activities.
- Perform network traffic analysis to identify malicious activities.
- Analyze network device logs and security event logs.
- Conduct wireless network forensics.
- Understand cloud computing models and their implications for forensics.
- Perform forensic investigations in various cloud environments (IaaS, PaaS, SaaS).
- Identify challenges and solutions in cloud forensics.
Mobile Device and Application ForensicsUnderstand mobile device operating systems and architectures.
- Understand mobile device operating systems and architectures.
- Perform data acquisition from Android and iOS devices.
- Analyze mobile application data and artifacts.
- Extract and analyze call logs, SMS, and GPS data.
- Identify and bypass mobile device security features for forensic purposes.
- Utilize specialized mobile forensic tools.
Report Writing and Expert WitnessPrepare comprehensive and legally sound forensic reports.
- Prepare comprehensive and legally sound forensic reports.
- Document findings, methodologies, and conclusions clearly and concisely.
- Understand the requirements for presenting digital evidence in court.
- Provide effective expert witness testimony.
- Handle cross-examination and maintain credibility in court.
Find your DoD 8140 pathway
Explore how this training may align to DoD 8140 work roles and proficiency levels.
About this course
This advanced certification course, the EC-Council Certified Computer Hacking Forensic Investigator (CHFI), provides a comprehensive and in-depth exploration of digital forensics and incident response. Participants will gain the critical skills necessary to identify, preserve, analyze, and present digital evidence in a legally sound and forensically sound manner. The curriculum delves into various forensic methodologies, tools, and techniques to investigate complex cyberattacks, data breaches, and insider threats, ensuring the integrity and admissibility of evidence in both criminal and civil proceedings.
Training alone does not establish DoD 8140 qualification. Confirm position-specific requirements with your organization.