Course Description
CHFIv8 presents a detailed methodological approach to computer forensics and evidence analysis. It is a comprehensive course covering major forensic investigation scenarios that enable students to acquire hands-on experience on various forensic investigation techniques and standard tools necessary to successfully carry-out a computer forensic investigation.
Battles between corporations, governments, and countries are no longer fought using physical force. Cyber war has begun and the consequences can be seen in everyday life. With the onset of sophisticated cyber-attacks, the need for advanced cyber security and investigation training is a mandate in the present day. If you or your organization requires the knowledge or skills to identify, track, and prosecute the cybercriminals, then this is the course for you.
This course helps students to excel in digital evidence acquisition, handling and analysis in a forensically sound manner.
Acceptable in a court of law, these skills will lead to successful prosecutions in various types of security incidents such as data breaches, corporate espionage, insider threats and other intricate cases involving computer systems.
Audience
The CHFI program is designed for all IT professionals involved with information system security, computer forensics, and incident response.
Prerequisites
It is strongly recommended that you attend the CEH class before enrolling into CHFI program
Course Objectives
The computer forensic investigation process and the various legal issues involved
Evidence searching, seizing and acquisition methodologies in a legal and forensically sound manner
Different types of digital evidence, rules of evidence, digital evidence examination process, and electronic crime and digital evidence consideration by crime category
Course Outline :: CHFIv8 ::
Roles of first responder, first responder toolkit, securing and evaluating electronic crime scene, conducting preliminary interviews, documenting electronic crime scene, collecting and preserving electronic evidence, packaging and transporting electronic evidence, and reporting the crime scene
How to set up a computer forensics lab and the tools involved in it
Various file systems and how to boot a disk
Gathering volatile and non-volatile information from Windows
Data acquisition and duplication rules, validation methods and tools required
How to recover deleted files and deleted partitions in Windows, Mac OS X, and Linux
The process involved in forensic investigation using AccessData FTK and EnCase
Steganography and its techniques, Steganalysis, and image file forensics
Password Cracking Concepts, tools, types of password attacks and how to investigate password protected files
Different types of log capturing, log management, time synchronization, and log capturing tools
How to investigate logs, network traffic, wireless attacks, and web attacks
How to track e-mails and investigate e-mail crimes
Mobile forensics and mobile forensics software and hardware tools
How to write investigative reports
Day 1
- 1. Computer Forensics in Today’s World
- 2. Computer Forensics Investigation Process
- 3. Searching and Seizing Computers
- 4. Digital Evidence
Day 2
- 5. First Responder Procedures
- 6. Computer Forensics Lab
- 7. Understanding Hard Disks and File Systems
- 8. Windows Forensics
- 9. Data Acquisition and Duplication
Course Outline :: CHFIv8 ::
Day 3
- 10. Recovering Deleted Files and Deleted Partitions
- 11. Forensics Investigation Using AccessData FTK
- 12. Forensics Investigation Using EnCase
- 13. Steganography and Image File Forensics
Day 4
- 14. Application Password Crackers
- 15. Log Capturing and Event Correlation
- 16. Network Forensics, Investigating Logs and Investigating Network Traffic
- 17. Investigating Wireless Attacks
- 18. Investigating Web Attacks
Day 5
- 19. Tracking Emails and Investigating Email Crimes
- 20. Mobile Forensics
- 21. Investigative Reports
- 22. Becoming an Expert Witness
Certification
The CHFI 312-49 exam will be conducted on the last day of training (optional). Students need to pass the online
Prometric exam to receive the CHFI certification.
Exam Details
- 1. Number of Questions: 150
- 2. Passing Score: 70%
- 3. Test Duration: 4 Hours
- 4. Test Format: Multiple Choice
- 5. Test Delivery: Prometric Prime / Prometric APTC / VUE
Exam Code
The exam code varies when taken at different testing centers.
- 1. Prometric Prime: 312-49
- 2. Prometric APTC: EC0-349
- 3. VUE: 312-49
Programme scope, delivery arrangements and suitability are confirmed during enquiry.