Computer Hacking Forensic Investigator (CHFI)

Overview#

Curriculum#

1. Before class

   • Pre-course materials access
   • Foundation concepts review
   • Baseline self-assessment

2. Computer Forensics & Investigation Process

   • Digital Forensics Fundamentals – Introduction, forensic methodology
   • Evidence Handling – Chain of custody, legal considerations
   • First Responder Procedures – Scene preservation, documentation
   • Lab – Forensic workstation setup and imaging

3. Hard Disks, File Systems & Data Acquisition

   • Hard Disk Forensics – File systems, partition analysis, data recovery
   • File System Analysis – NTFS, FAT, EXT, HFS+ examination
   • Data Acquisition – Imaging tools, write blockers, verification
   • Lab – Disk imaging and file carving

4. Anti-Forensics, Windows & Linux Forensics

   • Windows Forensics – Registry, event logs, artifacts
   • Linux/Mac Forensics – Log analysis, user artifacts
   • Memory Forensics – RAM acquisition, process analysis
   • Lab – Windows registry and memory analysis

5. Network, Web, Dark Web & Cloud Forensics

   • Network Forensics – Packet capture, traffic analysis, intrusion detection
   • Web & Email Forensics – Browser artifacts, email headers
   • Mobile Forensics – iOS/Android acquisition, app analysis
   • Lab – Network traffic and mobile device analysis

6. Malware, Mobile, IoT & Final Assessments

   • Malware Forensics – Static/dynamic analysis, indicators of compromise
   • Cloud Forensics – AWS/Azure artifacts, SaaS investigation
   • Forensic Reporting – Documentation, expert testimony preparation
   • Exam Review – Practice exam, CHFI certification guidance

Who Should Attend & Prerequisites#