CHFI Course – Computer Hacking Forensics Investigator (ECC 312-49)

The CHFI Course prepares you for EC-Council’s Computer Hacking Forensic Investigator certification, exam code 312-49. It is for security analysts, incident responders, IT managers and law enforcement staff who need to find, collect and present digital evidence after a cyber attack. The course runs for 18 hours 43 minutes over 133 videos, with 62 test questions.

What you will learn

• Follow a sound forensic investigation process from start to finish
• Search for and seize digital evidence while keeping the chain of custody
• Act as a first responder at a digital crime scene
• Set up a forensics lab and the tools it needs
• Examine hard disks, file systems and Windows systems
• Acquire and duplicate data, and recover deleted files and partitions
• Use forensic tools such as AccessData FTK and EnCase
• Investigate steganography, password attacks, logs, network traffic, wireless attacks, web attacks and email crimes
• Carry out mobile investigations
• Write investigation reports and act as an expert witness

Course outline

1. Foundations: computer forensics introduction, the investigation process, searching and seizing, digital evidence and first responder procedures
2. Forensics lab: setting up a working lab
3. Storage and systems: hard disks and file systems, Windows forensics, data acquisition and duplication, and recovering deleted files and partitions
4. Forensic tools: AccessData FTK and EnCase
5. Hidden data and passwords: steganography and password crackers
6. Logs and networks: log correlation, network forensics and wireless attacks
7. Web, email and mobile: web attacks, email crimes and mobile investigation
8. Presenting findings: investigative reports and expert witness work

Who this course is for

• Security and SOC analysts who handle incidents
• Incident response team members
• IT managers and system administrators
• Law enforcement, defence and military staff
• Legal and banking staff who deal with digital evidence

Before you start

EC-Council says CHFI is open to people with a basic understanding of IT and cybersecurity, computer forensics and incident response. You should be comfortable with operating systems, file systems and basic networking before you start.

Forensics work must follow strict rules so that evidence holds up. Take your time with the early modules on process, evidence handling and first response, as later lessons build on them. Where you can, practise with forensic tools in a safe test lab, never on systems you do not own or have permission to examine.

About the 312-49 exam

The 312-49 exam leads to the Computer Hacking Forensic Investigator (CHFI) certification from EC-Council. It validates your skills in digital forensics investigations and forensic readiness, including how to acquire and manage evidence across different operating systems. EC-Council aims it at IT and security professionals who want to grow their incident response and forensics skills.

CHFI pairs well with ethical hacking skills. Knowing how attacks work helps you know where to look for evidence once an attack has happened.

Jobs this course supports

• Digital Forensics Investigator
• Computer Forensics Examiner
• Incident Response Analyst
• Cybersecurity Consultant
• Security Officer