EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

Computer Hacking Forensics Investigator v8

Course outline

5 days
Discuss this programme →

Duration

5 days

Overview

EC-Council releases the most advanced Computer Forensic Investigation program in the world. CHFIv8 presents a detailed methodological approach to computer forensics and evidence analysis. It is a comprehensive course covering major forensic investigation scenarios that enable students to acquire hands-on experience on various forensic investigation techniques and standard tools necessary to successfully carry-out a computer forensic investigation.

Battles between corporations, governments, and countries are no longer fought using physical force. Cyber war has begun and the consequences can be seen in every day life. With the onset of sophisticated cyber-attacks, the need for advanced cyber security and investigation training is a mandate in the present day. If you or your organization requires the knowledge or skills to identify, track, and prosecute the cybercriminals, then this is the course for you. This course helps students to excel in digital evidence acquisition, handling and analysis in a forensically sound manner. Acceptable in a court of law, these skills will lead to successful prosecutions in various types of security incidents such as data breaches, corporate espionage, insider threats and other intricate cases involving computer systems.

Who Should Attend

The CHFI program is designed for all IT professionals involved with information system security, computer forensics, and incident response.

Certification

The CHFI 312-49 exam will be conducted on the last day of training. Students need to pass the online Prometric exam to receive the CHFI certification.

Course Outline

Computer Forensics in Today’s World

  • Forensics Science
  • Computer Forensics
  • Security Incident Report
  • Aspects of Organizational Security
  • Evolution of Computer Forensics
  • Objective of Computer Forensics
  • Need for Compute Forensics
  • Forensics Readiness
  • Benefits of Forensics Readiness
  • Goals of Forensics Readiness
  • Forensics Readiness Planning
  • Cyber Crime
  • Computer Facilitated Crimes
  • Modes of Attacks
  • Examples of Cyber Crime
  • Types of Computer Crimes
  • Cyber Criminals
  • Organized Cyber Crime: Organizational Chart
  • How Serious are Different Types of Incidents?
  • Disruptive Incidents to the Business
  • Cost Expenditure Responding to the Security Incident
  • Cyber Crime Investigation
  • Key Steps in Forensics Investigation
  • Rules of Forensics Investigation
  • Need for Forensics Investigator
  • Role of Forensics Investigator
  • Accessing Computer Forensics Resources
  • Role of Digital Evidence
  • Corporate Investigations
  • Understanding Corporate Investigations
  • Approach to Forensics Investigation: A Case Study
  • Instructions for the Forensic Investigator to Approach the Crime Scene
  • Why and When Do You Use Computer Forensics?
  • Enterprise Theory of Investigation (ETI)
  • Legal Issues
  • Reporting the Results
  • Reporting a Cyber Crime
  • Why you Should Report Cybercrime?
  • Reporting Computer-Related Crimes
  • Person Assigned to Report the Crime
  • When and How to Report an Incident?
  • Who to Contact at the Law Enforcement?
  • Federal Local Agents Contact
  • More Contacts
  • CIO Cyberthreat Report Form

Computer Forensics Investigation Process

  • Investigating Computer Crime
  • Before the Investigation
  • Build a Forensics Workstation
  • Building the Investigation Team
  • People Involved in Computer Forensics
  • Review Policies and Laws
  • Forensics Laws
  • Notify Decision Makers and Acquire Authorization
  • Risk Assessment
  • Build a Computer Investigation Toolkit
  • Steps to Prepare for a Computer Forensics Investigation
  • Computer Forensics Investigation Methodology
  • Obtain Search Warrant
  • Example of Search Warrant
  • Searches Without a Warrant
  • Evaluate and Secure the Scene
  • Forensics Photography
  • Gather the Preliminary Information at the Scene
  • First Responder
  • Collect the Evidence
  • Collect Physical Evidence
  • Evidence Collection Form
  • Collect Electronic Evidence
  • Guidelines for Acquiring Evidence
  • Secure the Evidence
  • Evidence Management
  • Chain of Custody
  • Chain of Custody Form
  • Acquire the Data
  • Duplicate the Data (Imaging)
  • Verify Image Integrity
  • MD5 Hash Calculators: HashCalc, MD5 Calculator and HashMyFiles
  • Recover Lost or Deleted Data
  • Data Recovery Software
  • Analyze the Data
  • Data Analysis
  • Data Analysis Tools
  • Assess Evidence and Case
  • Evidence Assessment
  • Case Assessment
  • Processing Location Assessment
  • Best Practices to Assess the Evidence
  • Prepare the Final Report
  • Documentation in Each Phase
  • Gather and Organize Information
  • Writing the Investigation Report
  • Sample Report
  • Testifying as an Expert Witness
  • Expert Witness
  • Testifying in the Court Room
  • Closing the Case
  • Maintaining Professional Conduct
  • Investigating a Company Policy Violation
  • Computer Forensics Service Providers

Searching and Seizing Computers

  • Searching and Seizing Computers without a Warrant
  • § A: Fourth Amendment’s “Reasonable Expectation of Privacy” in Cases Involving Computers: General Principles
  • § A.1: Reasonable Expectation of Privacy in Computers as Storage Devices
  • § A.3: Reasonable Expectation of Privacy and Third-Party Possession
  • § A.4: Private Searches
  • § A.5 Use of Technology to Obtain Information
  • § B: Exceptions to the Warrant Requirement in Cases Involving Computers
  • § B.1: Consent
  • § B.1.a: Scope of Consent
  • § B.1.b: Third-Party Consent
  • § B.1.c: Implied Consent
  • § B.2: Exigent Circumstances
  • § B.3: Plain View
  • § B.4: Search Incident to a Lawful Arrest
  • § B.5: Inventory Searches
  • § B.6: Border Searches
  • § B.7: International Issues
  • § C: Special Case: Workplace Searches
  • § C.1: Private Sector Workplace Searches
  • § C.2: Public-Sector Workplace Searches
  • Searching and Seizing Computers with a Warrant
  • A: Successful Search with a Warrant
  • A.1: Basic Strategies for Executing Computer Searches
  • § A.1.a: When Hardware is itself Contraband, Evidence, or an Instrumentality or Fruit of Crime
  • § A.1.b: When Hardware is Merely a Storage Device for Evidence of Crime
  • § A.2: The Privacy Protection Act
  • § A.2.a: The Terms of the Privacy Protection Act
  • § A.2.b: Application of the PPA to Computer Searches and Seizures
  • § A.3: Civil Liability Under the Electronic Communications Privacy Act (ECPA)
  • § A.4: Considering the Need for Multiple Warrants in Network Searches
  • § A.5: No-Knock Warrants
  • § A.6: Sneak-and-Peek Warrants
  • § A.7: Privileged Documents
  • § B: Drafting the Warrant and Affidavit
  • § B.1: Accurately and Particularly Describe the Property to be Seized in the Warrant and/or Attachments to the Warrant
  • § B.1.a: Defending Computer Search Warrants Against Challenges Based on the Description of the “Things to Be Seized”
  • § B.2: Establish Probable Cause in the Affidavit
  • § B.3: In the Affidavit Supporting the Warrant, include an Explanation of the Search Strategy as Well as the Practical & Legal Considerations that Will Govern the Execution of the Search
  • § C: Post-Seizure Issues
  • § C.1: Searching Computers Already in Law Enforcement Custody
  • § C.2: The Permissible Time Period for Examining Seized Computers
  • § C.3: Rule 41(e) Motions for Return of Property
  • The Electronic Communications Privacy Act
  • § A. Providers of Electronic Communication Service vs. Remote Computing Service
  • § B. Classifying Types of Information Held by Service Providers
  • § C. Compelled Disclosure Under ECPA
  • § D. Voluntary Disclosure
  • § E. Working with Network Providers
  • Electronic Surveillance in Communications Networks
  • A. Content vs. Addressing Information
  • B. The Pen/Trap Statute, 18 U.S.C. §§ 3121-3127
  • C. The Wiretap Statute (“Title III”), 18 U.S.C. §§ 2510-2522
  • § C.1: Exceptions to Title III
  • § D. Remedies For Violations of Title III and the Pen/Trap Statute
  • Evidence
  • § A. Authentication
  • § B. Hearsay
  • § C. Other Issues

Digital Evidence

  • Digital Data
  • Definition of Digital Evidence
  • Increasing Awareness of Digital Evidence
  • Challenging Aspects of Digital Evidence
  • The Role of Digital Evidence
  • Characteristics of Digital Evidence
  • Fragility of Digital Evidence
  • Anti-Digital Forensics (ADF)
  • Types of Digital Data
  • Rules of Evidence
  • Best Evidence Rule
  • Federal Rules of Evidence
  • International Organization on Computer Evidence (IOCE)
  • IOCE International Principles for Digital Evidence
  • Scientific Working Group on Digital Evidence (SWGDE)
  • SWGDE Standards for the Exchange of Digital Evidence
  • Electronic Devices: Types and Collecting Potential Evidence
  • Digital Evidence Examination Process
  • Evidence Assessment
  • Prepare for Evidence Acquisition
  • Evidence Acquisition
  • Preparation for Searches
  • Seizing the Evidence
  • Imaging
  • Bit-Stream Copies
  • Write Protection
  • Evidence Acquisition
  • Evidence Acquisition from Crime Location
  • Acquiring Evidence from Storage Devices
  • Collecting Evidence
  • Collecting Evidence from RAM
  • Collecting Evidence from a Standalone Network Computer
  • Chain of Custody
  • Chain of Evidence Form
  • Evidence Preservation
  • Preserving Digital Evidence: Checklist
  • Preserving??Removable Media
  • Handling Digital Evidence
  • Store and Archive
  • Digital Evidence Findings
  • Evidence Examination and Analysis
  • Evidence Examination
  • Physical Extraction
  • Logical Extraction
  • Analyze Host Data
  • Analyze Storage Media
  • Analyze Network Data
  • Analysis of Extracted Data
  • Timeframe Analysis
  • Data Hiding Analysis
  • Application and File Analysis
  • Ownership and Possession
  • Evidence Documentation and Reporting
  • Documenting the Evidence
  • Evidence Examiner Report
  • Final Report of Findings
  • Computer Evidence Worksheet
  • Hard Drive Evidence Worksheet
  • Removable Media Worksheet
  • Electronic Crime and Digital Evidence Consideration by Crime Category

First Responder Procedures

  • Electronic Evidence
  • First Responder
  • Roles of First Responder
  • Electronic Devices: Types and Collecting Potential Evidence
  • First Responder Toolkit
  • Creating a First Responder Toolkit
  • Evidence Collecting Tools and Equipment
  • First Response Basics
  • First Response Rule
  • Incident Response: Different Situations
  • First Response for System Administrators
  • First Response by Non-Laboratory Staff
  • First Response by Laboratory Forensics Staff
  • Securing and Evaluating Electronic Crime Scene
  • Securing and Evaluating Electronic Crime Scene: A Checklist
  • Securing the Crime Scene
  • Warrant for Search and Seizure
  • Planning the Search and Seizure
  • Initial Search of the Scene
  • Health and Safety Issues
  • Conducting Preliminary Interviews
  • Questions to Ask When Client Calls the Forensic Investigator
  • Consent
  • Sample of Consent Search Form
  • Witness Signatures
  • Conducting Preliminary Interviews
  • Conducting Initial Interviews
  • Witness Statement Checklist
  • Documenting Electronic Crime Scene
  • Photographing the Scene
  • Sketching the Scene
  • Video Shooting the Crime Scene
  • Collecting and Preserving Electronic Evidence
  • Order of Volatility
  • Dealing with Powered On Computers
  • Dealing with Powered Off Computers
  • Dealing with Networked Computer
  • Dealing with Open Files and Startup Files
  • Operating System Shutdown Procedure
  • Computers and Servers
  • Preserving Electronic Evidence
  • Seizing Portable Computers
  • Switched On Portables
  • Collecting and Preserving Electronic Evidence
  • Packaging and Transporting Electronic Evidence
  • Evidence Bag Contents List
  • Packaging Electronic Evidence
  • Exhibit Numbering
  • Transporting Electronic Evidence
  • Handling and Transportation to the Forensics Laboratory
  • Storing Electronic Evidence
  • Chain of Custody
  • Simple Format of the Chain of Custody Document
  • Chain of Custody Forms
  • Chain of Custody on Property Evidence Envelope/Bag and Sign-out Sheet
  • Reporting the Crime Scene
  • Note Taking Checklist
  • First Responder Common Mistakes

Computer Forensics Lab

  • Setting a Computer Forensics Lab
  • Computer Forensics Lab
  • Planning for a Forensics Lab

Programme scope, delivery arrangements and suitability are confirmed during enquiry.