EC-Council Expert

312-49v11

CHFI v11 - Computer Hacking Forensic Investigator

The Computer Hacking Forensic Investigator (CHFI) v11 is the most comprehensive digital forensics certification designed to train cybersecurity professionals in the science of detecting, investigating, and responding to cyber incidents. This certification validates expertise in computer forensics investigation methodology, chain of custody procedures, and evidence handling in accordance with legal and regulatory requirements.

The exam covers 14 domains including forensics investigation processes, hard disk and file system analysis, data acquisition and duplication, defeating anti-forensics techniques, operating system forensics (Windows, Linux, Mac), network forensics, web forensics, database forensics, cloud forensics, investigating malware incidents, email forensics, mobile forensics, and IoT forensics. CHFI v11 includes updated coverage of investigating cloud-based crimes, container forensics, cryptocurrency investigations, and AI-assisted forensics.

This certification is ideal for incident response teams, forensic analysts, cybercrime investigators, law enforcement personnel, system administrators, and information security professionals. CHFI meets requirements for digital forensics positions and is recognized by courts and legal entities worldwide. Candidates learn to conduct forensically sound investigations, prepare evidence for court, and provide expert testimony.

Updated Mar 2023 Cybersecurity

150

Questions

Practice Tests

70%

Pass Score

Views

Total Attempts

Avg. Score

Pass Rate

Discussions

Practice Tests Flash Cards Exam Topics Cheat Sheet

€5.00

CHFI v11 Practice Exam 1

Comprehensive 50-question practice exam covering forensic investigation methodology, evidence handling, disk imaging, file system analysis, Windows registry forensics, Linux forensics, network packet analysis, email header analysis, mobile device forensics, and anti-forensics detection techniques.

50 Q 80 minutes 70%

Test Drive

€5.00

CHFI v11 Practice Exam 2

Comprehensive 50-question practice exam covering chain of custody procedures, volatile data collection, NTFS analysis, deleted file recovery, web browser forensics, cloud forensics investigation, malware forensic analysis, steganography detection, database forensics, and IoT device forensics.

50 Q 80 minutes 70%

Test Drive

€5.00

CHFI v11 Practice Exam 3

Advanced 50-question practice exam covering memory forensics with Volatility, timeline analysis and reconstruction, RAID array forensic reconstruction, browser artifact deep analysis, encrypted volume forensics, Docker container investigation, cryptocurrency wallet tracing, drone forensics, smart TV forensics, and dark web investigation techniques.

50 Q 80 minutes 70%

Test Drive

€5.00

CHFI v11 Practice Exam 4

Advanced 50-question practice exam covering SSD forensics and TRIM challenges, firmware analysis techniques, vehicle infotainment system forensics, deepfake detection methodology, 5G network forensics, industrial control system forensics, wearable device forensics, AR/VR forensics, satellite communication forensics, and quantum computing implications for digital forensics.

50 Q 80 minutes 70%

Test Drive

€5.00

CHFI v11 Practice Exam 5

Advanced 50-question practice exam covering expert witness testimony preparation, multi-jurisdiction digital investigations, forensic tool validation and Daubert compliance, AI-assisted forensic analysis, supply chain attack forensics, ransomware negotiation evidence preservation, insider threat behavioral forensics, corporate espionage investigation methodology, and advanced persistent threat attribution techniques.

50 Q 80 minutes 70%

Test Drive

€5.00

CHFI v11 Practice Exam 6

Comprehensive 50-question practice exam featuring cross-disciplinary forensic scenarios, emerging technology forensics, legal and ethical dilemmas in digital investigations, complex multi-phase investigation planning, evidence correlation across diverse platforms, forensic reporting standards for court presentation, international cybercrime cooperation frameworks, advanced anti-forensics countermeasure detection, and forensic automation with scripting methodologies.

50 Q 80 minutes 70%

Test Drive

Unlock All Content for 312-49v11

6 Practice Test(s) + Flash Cards — 3 months access

€39.99 €26.99 Save 30%

or included with Monthly subscription / Content Bundle

312-49v11 Cheat Sheet

Quick reference guide - 6 sections

Free Access

CHFI v11 (312-49v11) Exam Details

Detail	Value
Exam Code	312-49v11
Exam Title	Computer Hacking Forensic Investigator (CHFI v11)
Duration	240 minutes (4 hours)
Number of Questions	150 multiple-choice questions
Passing Score	70%
Exam Fee	$450 USD (ECC Exam Portal)
Provider	EC-Council
Prerequisites	CEH certification recommended (or 2+ years InfoSec experience)

Exam Domain Breakdown

Domain	Topics
1. Computer Forensics in Today's World	Forensics fundamentals, cyber crime types, forensic readiness
2. Computer Forensics Investigation Process	Investigation methodology, first responder procedures, evidence handling
3. Hard Disk & File System Forensics	Disk structures, file systems (NTFS, FAT, ext4, APFS), file carving
4. Data Acquisition & Duplication	Disk imaging, write blockers, acquisition tools, hashing
5. Defeating Anti-Forensics Techniques	Steganography, encryption, data wiping, trail obfuscation
6. OS Forensics (Windows, Linux, macOS)	Registry, event logs, artifacts, /var/log, plist files
7. Network & Cloud Forensics	Traffic analysis, log correlation, IDS/IPS, cloud investigation
8. Web, Email & Malware Forensics	Browser artifacts, email headers, malware analysis, mobile forensics
9. Dark Web & IoT Forensics	Tor investigation, cryptocurrency tracing, IoT device forensics
10. Report Writing & Expert Testimony	Forensic report structure, court presentation, expert witness

CHFI Certification Path

The CHFI (Computer Hacking Forensic Investigator) is EC-Council's premier digital forensics certification. It is designed for professionals who detect, investigate, and prosecute cybercrimes. CHFI v11 covers modern forensic techniques including cloud forensics, IoT forensics, dark web investigations, and advanced malware forensics. The certification complements CEH (Certified Ethical Hacker) by focusing on the post-incident investigation side rather than penetration testing.

CHFI holders typically work as forensic analysts, incident responders, law enforcement cybercrime investigators, SOC analysts, and compliance auditors. The exam validates practical skills in evidence acquisition, preservation, analysis, and courtroom presentation. CHFI v11 aligns with NICE 2.0 framework work roles and meets ANAB ISO/IEC 17024 accreditation standards.

Digital Forensic Investigation Process

Phase	Activities	Key Outputs
1. Identification	Detect the incident, determine scope, identify evidence sources	Incident report, evidence source list
2. Preservation	Secure the scene, isolate systems, prevent evidence alteration	Chain of custody form, scene photographs
3. Collection	Acquire forensic images, collect volatile data (RAM, network connections)	Forensic images, hash values (MD5/SHA)
4. Examination	Process acquired data, extract relevant artifacts, timeline creation	Extracted artifacts, timeline analysis
5. Analysis	Correlate evidence, draw conclusions, attribute actions	Analysis findings, evidence correlation
6. Reporting	Document findings, prepare expert report, present in court	Forensic report, expert testimony

Evidence Handling & Chain of Custody

Chain of Custody: A chronological documentation of evidence collection, transfer, analysis, and storage. Every person who handles evidence must be documented with date, time, and purpose. Breaks in the chain can render evidence inadmissible in court.
Evidence Integrity: Calculate cryptographic hashes (MD5, SHA-1, SHA-256) immediately upon acquisition. Verify hash values before and after every examination to prove evidence has not been modified.
Write Blockers: Hardware or software devices that prevent any write operations to the source media. Must be used during acquisition to maintain evidence integrity. Hardware write blockers are preferred for legal proceedings.
Evidence Bags: Anti-static bags for hard drives and electronic media. Faraday bags for mobile devices to prevent remote wiping. Document serial numbers and seal with tamper-evident tape.
Evidence Storage: Locked evidence room with restricted access, environmental controls (temperature/humidity), and access logs. Digital evidence should be stored on encrypted, write-protected media.

Order of Volatility (RFC 3227)

Priority	Data Source	Volatility	Examples
1 (Highest)	CPU Registers & Cache	Nanoseconds	Register values, L1/L2 cache
2	RAM (System Memory)	Seconds–Minutes	Running processes, network connections, encryption keys
3	Network State	Seconds–Minutes	Routing tables, ARP cache, active connections
4	Temporary Files	Minutes–Hours	Swap space, temp files, pagefile.sys
5	Disk Storage	Persistent	Hard drives, SSDs, USB drives, file systems
6	Remote Logs & Backups	Persistent	SIEM logs, cloud backups, archived data
7 (Lowest)	Physical Media & Archives	Persistent	Optical media (CDs/DVDs), tape backups, printouts

Key Rule: Always collect the most volatile data first. Failure to capture RAM before shutting down a system means losing running processes, network connections, encryption keys, and other critical volatile evidence.

Legal Considerations & Forensic Readiness

Search Warrant: Required for law enforcement to seize digital evidence in most jurisdictions. Must specify scope (which devices, what data). Plain view doctrine may allow seizure of unexpected evidence of crime.
Fourth Amendment (US): Protects against unreasonable search and seizure. Digital evidence collection must comply with constitutional protections. Exceptions include consent, exigent circumstances, and border searches.
Forensic Readiness: An organization's ability to maximize the use of digital evidence while minimizing investigation costs. Includes logging policies, retention schedules, incident response procedures, and pre-approved forensic tools and processes.
First Responder Procedures: Secure the scene, document everything visible (photographs, notes), identify and interview witnesses, isolate affected systems from the network, begin volatile data collection, maintain chain of custody from the first moment.
Expert Witness: A forensic examiner may be called to testify about findings, methods used, and conclusions. Must be able to explain technical concepts in layperson terms. Daubert standard (US) or Frye standard determines admissibility of expert methodology.

Windows Forensic Artifacts

Artifact	Location / Registry Key	Forensic Value
Windows Registry	SAM, SYSTEM, SOFTWARE, SECURITY, NTUSER.DAT	User accounts, system config, installed software, USB history
Event Logs	%SystemRoot%\System32\winevt\Logs\ (.evtx)	Security (4624/4625 logons), System, Application, PowerShell events
Prefetch Files	C:\Windows\Prefetch\ (.pf)	Application execution history, run count, last run timestamp
ShimCache / AppCompatCache	SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache	Evidence of program execution, file path, last modified time
Amcache	C:\Windows\AppCompat\Programs\Amcache.hve	Application install/execution, SHA-1 hashes, file paths
USB Device History	SYSTEM\CurrentControlSet\Enum\USBSTOR	USB devices connected, serial numbers, first/last connect times
Recent Files / LNK Files	%UserProfile%\AppData\Roaming\Microsoft\Windows\Recent\	Recently accessed files, timestamps, target file paths, volume info
Jump Lists	%UserProfile%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\	Application usage, recent documents per application
Recycle Bin	C:\$Recycle.Bin\{SID}\ ($I and $R files)	Deleted file metadata ($I), actual file content ($R)
NTFS $MFT	Root of NTFS volume (hidden system file)	File metadata, timestamps (MACE), resident data for small files

Key Windows Event IDs: 4624 (successful logon), 4625 (failed logon), 4648 (explicit credential logon), 4672 (special privileges assigned), 4688 (process creation), 4697 (service installed), 7045 (new service), 1102 (audit log cleared).

Linux & macOS Forensics

Artifact	Linux Location	macOS Equivalent
System Logs	/var/log/syslog, /var/log/messages, journalctl	/var/log/system.log, Console.app, Unified Logging
Auth / Login Logs	/var/log/auth.log, /var/log/secure, /var/log/wtmp	/var/log/install.log, /private/var/db/dslocal/
Shell History	~/.bash_history, ~/.zsh_history	~/.zsh_history, ~/.bash_history
Cron / Scheduled Tasks	/etc/crontab, /var/spool/cron/, /etc/cron.d/	~/Library/LaunchAgents/, /Library/LaunchDaemons/
User Accounts	/etc/passwd, /etc/shadow, /etc/group	/var/db/dslocal/nodes/Default/users/
Installed Packages	/var/log/dpkg.log, rpm -qa, /var/lib/dpkg/	/Applications/, ~/Library/Application Support/
Network Config	/etc/network/, /etc/hosts, iptables rules	/Library/Preferences/SystemConfiguration/

macOS Specific: Spotlight metadata (.Spotlight-V100), FSEvents (/.fseventsd/ tracks file system changes), Quarantine database (tracks downloaded files), KnowledgeC.db (application usage tracking), plist files store application and system configuration in XML or binary format.

File System Comparison

Feature	NTFS	FAT32	ext4	APFS
OS	Windows	Universal	Linux	macOS/iOS
Max File Size	16 TB	4 GB	16 TB	8 EB
Journaling	Yes ($LogFile)	No	Yes	Yes (copy-on-write)
Encryption	EFS, BitLocker	None	LUKS/dm-crypt	FileVault 2 (native)
ADS (Alternate Data Streams)	Yes (hide data)	No	No (extended attrs)	No (extended attrs)
Key Forensic Structures	$MFT, $LogFile, $UsnJrnl	FAT table, directory entries	Inodes, superblock, journal	Container superblock, snapshots
Timestamps	MACE (Modified, Accessed, Created, Entry)	Modified, Created, Accessed	atime, mtime, ctime, crtime	Created, Modified, Accessed, Changed

File Carving & Metadata Analysis

File Carving: Recovering files from unallocated disk space by identifying file headers and footers (magic bytes). Works even when file system metadata is destroyed. Tools: Scalpel, Foremost, PhotoRec.
File Signatures (Magic Bytes): JPEG: FF D8 FF, PNG: 89 50 4E 47, PDF: 25 50 44 46, ZIP: 50 4B 03 04, EXE/DLL (MZ): 4D 5A. Useful for detecting file extension spoofing.
Metadata Analysis: EXIF data in images (camera model, GPS coordinates, timestamps), Office document properties (author, revision count, creation date), PDF metadata (creator application, modification history).
Slack Space: The space between the end of a file and the end of the allocated cluster. May contain remnants of previously deleted files. RAM slack (from end of file to end of sector) and drive slack (from end of sector to end of cluster).
NTFS Alternate Data Streams: Hidden data streams attached to files. Used to conceal malware or exfiltrated data. Detect with dir /r or forensic tools. Example: notepad.exe:malware.exe:$DATA.

Network Traffic Analysis

Data Source	Tool / Method	Forensic Value
Full Packet Capture (PCAP)	Wireshark, tcpdump, NetworkMiner	Complete traffic reconstruction, payload inspection, session replay
NetFlow / IPFIX	SiLK, nfdump, Cisco routers	Traffic volume, flow patterns, communication pairs (no payload)
DNS Logs	DNS server logs, passive DNS	Domain lookups, C2 communication, DNS tunneling detection
Firewall Logs	pfsense, iptables, Palo Alto	Allowed/blocked connections, source/destination, port scans
IDS/IPS Alerts	Snort, Suricata, Zeek (Bro)	Signature-based threat detection, anomaly alerts, protocol analysis
Proxy / Web Logs	Squid, Apache, nginx access logs	URLs visited, user agents, request/response codes, data transfers

Wireshark Filters: Display filter http.request.method == "POST" for form submissions, tcp.flags.syn == 1 && tcp.flags.ack == 0 for SYN scans, dns.qry.name contains "suspicious" for DNS queries. Use Follow TCP Stream to reconstruct sessions.

Log Correlation & SIEM

Log Correlation: Cross-referencing events from multiple sources (firewall, IDS, OS, application logs) to reconstruct the attack timeline. Time synchronization (NTP) across all systems is critical for accurate correlation.
SIEM Platforms: Splunk, IBM QRadar, ArcSight, ELK Stack (Elasticsearch, Logstash, Kibana). Aggregate logs, normalize data formats, provide alerting, dashboards, and forensic search capabilities.
Syslog Protocol: UDP port 514 (standard), TCP port 514 (reliable), TLS port 6514 (encrypted). Severity levels 0–7 (Emergency to Debug). Facility codes identify the source (kernel, mail, auth, etc.).
Log Integrity: Hash log files periodically to detect tampering. Use centralized logging to prevent attackers from deleting local logs. Write-once storage (WORM) ensures logs cannot be altered.

Email Forensics

Email Headers: Examine Received: headers (bottom-to-top for true path), From:, Reply-To:, Message-ID:, X-Originating-IP:, Return-Path:, and DKIM/SPF/DMARC results to trace origin and detect spoofing.
Email Formats: PST/OST (Outlook), MBOX (Unix/Thunderbird), EML (individual messages), MSG (Outlook single message). Tools: Kernel for PST, MailXaminer, Aid4Mail for conversion and analysis.
Phishing Analysis: Check for domain spoofing (similar-looking domains), embedded URLs vs display text mismatch, malicious attachments (macros, executables), urgency language, and sender reputation.
Web Browser Forensics: Browser history (SQLite databases), cookies, cache (images/pages), downloaded files, bookmarks, saved passwords, autofill data. Each browser stores artifacts differently: Chrome uses SQLite in %LocalAppData%\Google\Chrome\User Data\Default\.

Cloud Forensics (AWS / Azure / GCP)

Aspect	AWS	Azure	GCP
Activity Logging	CloudTrail	Activity Log / Monitor	Cloud Audit Logs
Network Logs	VPC Flow Logs	NSG Flow Logs	VPC Flow Logs
Storage Access Logs	S3 Server Access Logs	Storage Analytics	Cloud Storage Logs
VM Disk Imaging	EBS Snapshot	Managed Disk Snapshot	Persistent Disk Snapshot
Threat Detection	GuardDuty	Microsoft Defender for Cloud	Security Command Center
Incident Response	Detective, Security Hub	Sentinel	Chronicle SOAR

Cloud Challenges: Multi-tenancy limits physical access. Jurisdiction issues across regions. Shared responsibility model means the CSP manages infrastructure evidence while the customer manages application-level evidence. Always enable logging (CloudTrail, VPC Flow Logs) before an incident occurs.

Database Forensics

Transaction Logs: SQL Server (LDF), Oracle (redo logs), MySQL (binary logs/InnoDB redo logs), PostgreSQL (WAL). Transaction logs record every modification and can reconstruct database state at any point in time.
Audit Trails: Database audit features (SQL Server Audit, Oracle Unified Auditing, MySQL Enterprise Audit) track who accessed what data, when, and from where. Critical for investigating data theft or unauthorized access.
Evidence Collection: Capture database files, transaction logs, audit logs, and application connection logs. Take consistent snapshots (during quiet period or using hot backup). Hash all collected files for integrity verification.
SQL Injection Artifacts: Web application logs showing malicious SQL in parameters, unusual query patterns in slow query logs, unexpected data exports in database audit logs, error messages revealing database structure.

Mobile Forensics (iOS & Android)

Aspect	iOS	Android
File System	APFS (encrypted by default)	ext4, F2FS (varies by vendor)
Acquisition Type	Logical (iTunes backup), File System (jailbroken), Physical (chip-off)	Logical (ADB), File System (rooted), Physical (JTAG/chip-off)
Key Databases	sms.db, call_history.db, AddressBook.sqlitedb, consolidated.db	mmssms.db, contacts2.db, calllog.db, telephony.db
App Data	/private/var/mobile/Containers/Data/Application/	/data/data/<package>/ (internal), /sdcard/ (external)
Location Data	consolidated.db (historical), routined locations cache	Google location history, Wi-Fi/cell tower logs
Encryption	Hardware AES-256, Secure Enclave (SEP)	FDE/FBE (varies by version and vendor)
Tools	Cellebrite UFED, GrayKey, Elcomsoft, iMazing	Cellebrite UFED, Oxygen Forensics, AXIOM, ADB

Critical: Always place mobile devices in a Faraday bag immediately to prevent remote wipe commands, new data overwriting evidence, and GPS/cellular tracking. Enable airplane mode if accessible without unlocking.

Malware Forensics

Static Analysis: Examining malware without executing it. Techniques include file hash lookup (VirusTotal), string extraction (strings, FLOSS), PE header analysis (PEiD, PEstudio), disassembly (IDA Pro, Ghidra), and import table inspection to identify API calls.
Dynamic Analysis: Executing malware in a controlled sandbox environment. Monitor file system changes (Process Monitor), registry modifications, network communications (Wireshark, FakeNet-NG), and API calls (API Monitor). Sandboxes: Cuckoo, Any.Run, Joe Sandbox.
Memory Forensics for Malware: Use Volatility to analyze RAM dumps. Key plugins: pslist/psscan (hidden processes), malfind (injected code), netscan (network connections), dlllist (loaded DLLs), handles (open handles), timeliner (timeline of memory artifacts).
Indicators of Compromise (IOCs): File hashes (MD5/SHA-256), IP addresses, domain names, URLs, registry keys, mutex names, file paths, email addresses. Share via STIX/TAXII standards or YARA rules for pattern matching.
Malware Persistence Mechanisms: Registry Run keys, Scheduled Tasks, Services, WMI event subscriptions, DLL hijacking, Boot Record modification, rootkits (user-mode and kernel-mode), browser extensions, startup folders.

Anti-Forensics Techniques & Detection

Technique	Method	Detection / Countermeasure
Data Wiping	Secure erase tools (DBAN, Eraser, sdelete)	Check for wipe tool artifacts, unusual write patterns, timeline gaps
Steganography	Hiding data within images, audio, video files	StegDetect, StegExpose, statistical analysis, file size anomalies
Encryption	Full-disk encryption (BitLocker, VeraCrypt, LUKS)	Key recovery from RAM (cold boot attack), encryption key escrow
Timestamp Manipulation	Timestomp, touch command, file attribute editing	Compare $MFT $SI vs $FN timestamps, journal analysis, log correlation
Trail Obfuscation	Log deletion, VPN/Tor usage, proxy chains	Centralized logging (SIEM), log integrity checks, Tor exit node lists
File Extension Spoofing	Renaming .exe to .jpg, double extensions	File signature (magic byte) analysis, mismatch detection

IoT & Dark Web Forensics

IoT Forensics: Challenges include diverse hardware platforms, proprietary firmware, limited storage and logging, real-time data streams. Evidence sources: device firmware, flash memory, cloud backend APIs, companion mobile apps, network traffic captures.
IoT Evidence Acquisition: JTAG and UART interfaces for direct memory access, firmware extraction and analysis (binwalk, firmware-mod-kit), cloud API data requests, companion app database extraction from paired mobile devices.
Dark Web Forensics: Investigating .onion sites via Tor network. Techniques include Tor traffic analysis (timing correlation), cryptocurrency tracing (Bitcoin blockchain analysis, Chainalysis), deanonymization through operational security failures, and monitoring hidden service directories.
Cryptocurrency Tracing: Bitcoin transactions are pseudonymous, not anonymous. Blockchain explorers can trace transaction chains. Clustering analysis groups addresses to the same wallet. Exchanges with KYC requirements provide real-world identity linkage. Tools: Chainalysis, CipherTrace, Elliptic.

Forensic Report Writing & Expert Testimony

Report Structure: Executive Summary (non-technical overview), Objectives & Scope, Evidence List (items examined with hashes), Methodology (tools and procedures used), Findings (detailed technical analysis with supporting evidence), Timeline of Events, Conclusions, and Appendices.
Report Standards: Use objective, factual language (avoid opinions without evidence). Document every step for reproducibility. Include hash values for all evidence. Reference industry standards (NIST SP 800-86, ISO 27037). Maintain separate case notes as working documentation.
Expert Testimony: Be prepared to explain methodology in layperson terms. Anticipate cross-examination challenges (Daubert/Frye standards). Qualify as an expert through education, training, certifications, and experience. Never overstate findings or claim certainty where uncertainty exists.
Presentation Tips: Use visual aids (timelines, diagrams, screenshots with annotations). Explain technical concepts with analogies. Stay within the scope of your expertise. Distinguish between facts (what the evidence shows) and opinions (your expert interpretation).

Forensic Suites: EnCase vs FTK vs Autopsy

Feature	EnCase	FTK (Forensic Toolkit)	Autopsy
Vendor	OpenText (formerly Guidance)	Exterro (formerly AccessData)	Basis Technology (open source)
Cost	Commercial ($$$)	Commercial ($$)	Free / Open Source
Image Format	E01 (EnCase Evidence), Ex01	E01, AD1, dd/raw	E01, raw/dd, VHD, VMDK
Platform	Windows	Windows	Windows, Linux, macOS
Court Acceptance	Industry gold standard	Widely accepted	Accepted (open source, peer reviewed)
Strengths	EnScript automation, enterprise deployment, deep NTFS parsing	Distributed processing, dtSearch indexing, password recovery	Free, extensible modules, timeline analysis, Sleuth Kit backend
Key Feature	EnCase Portable for field triage	FTK Imager (free standalone imaging)	Ingest modules, hash filtering, keyword search

Exam Tip: Know that EnCase uses E01 format and EnScript language. FTK Imager is free and commonly used for disk imaging even by EnCase users. Autopsy is built on top of The Sleuth Kit (TSK) and is the go-to open-source forensic suite.

Disk Imaging Tools Comparison

Tool	Type	Output Format	Key Features
dd	CLI (Linux/Unix)	Raw (.dd, .img, .raw)	Bit-for-bit copy, no compression, universal format. Use `dc3dd` or `dcfldd` for hashing during acquisition
FTK Imager	GUI (Windows, free)	E01, AFF, dd/raw, AD1	Free standalone tool, hash verification, preview before imaging, memory capture
EnCase Imager	GUI (Windows)	E01, Ex01	Compression, built-in verification, case metadata embedding
Guymager	GUI (Linux)	E01, EWF, AFF, dd	Multi-threaded (fast), hash verification, open source, included in forensic distros

Hash Verification & Integrity

Algorithm	Output Size	Status	Forensic Use
MD5	128-bit (32 hex chars)	Cryptographically broken (collisions found)	Still widely used for quick file identification, NSRL hashsets. Use alongside SHA for court
SHA-1	160-bit (40 hex chars)	Deprecated (collision attacks demonstrated)	Legacy support, being phased out in favor of SHA-256
SHA-256	256-bit (64 hex chars)	Secure (recommended standard)	Preferred for evidence integrity verification, court-acceptable
SHA-512	512-bit (128 hex chars)	Secure	Highest assurance, used for critical evidence and long-term storage

Best Practice: Always compute both MD5 and SHA-256 hashes during evidence acquisition. Verify hashes at every stage (acquisition, transfer, before/after analysis). Document hash values in the chain of custody form and forensic report.

Memory Forensics & Volatility Framework

Volatility Plugin	Purpose	Forensic Value
pslist / psscan	List running processes	psscan finds hidden/unlinked processes that pslist misses (rootkit detection)
netscan / connscan	Network connections	Active/closed TCP connections, listening ports, associated PIDs
malfind	Detect injected code	Finds code injection in process memory (MZ headers in non-image VADs)
dlllist / ldrmodules	Loaded DLLs per process	Identify suspicious DLLs, DLL injection, DLL side-loading
handles	Open handles (files, registry, mutexes)	Identify files and registry keys accessed by malware, mutex for malware identification
cmdline / consoles	Command-line arguments	Reveal commands executed, PowerShell payloads, lateral movement commands
hashdump	Extract password hashes	NTLM hashes from SAM, useful for credential theft investigation
timeliner	Create timeline from memory	Timestamps from all memory artifacts for event reconstruction

Memory Acquisition Tools: DumpIt (free, Windows, single-click), WinPMEM (open source), Magnet RAM Capture (free), FTK Imager (memory capture feature), LiME (Linux Memory Extractor for Linux/Android).

Write Blockers: Hardware vs Software

Feature	Hardware Write Blocker	Software Write Blocker
Mechanism	Physical device between drive and computer	Software driver intercepts write commands
Reliability	Highest (independent of OS)	Depends on OS and driver implementation
Court Acceptance	Preferred (gold standard)	Accepted but may face challenges
Cost	$200–$1,000+	Free to low cost
Interfaces	SATA, IDE, USB, SAS, NVMe	All (driver-level blocking)
Examples	Tableau T35u, WiebeTech, CRU	EnCase FastBloc SE, MacForensicsLab, SAFE Block

Key Rule: Never connect evidence media to a forensic workstation without a write blocker. Even mounting a drive in Windows can alter timestamps and metadata. Hardware write blockers are required by most forensic standards (NIST, SWGDE) for original evidence examination.

Essential CHFI Acronyms & Standards

Acronym / Standard	Full Name	Relevance
NIST SP 800-86	Guide to Integrating Forensic Techniques into IR	Standard forensic methodology framework
ISO 27037	Guidelines for Identification, Collection, Acquisition, and Preservation of Digital Evidence	International evidence handling standard
RFC 3227	Guidelines for Evidence Collection and Archiving	Order of volatility, collection principles
SWGDE	Scientific Working Group on Digital Evidence	Best practices for digital evidence handling
NSRL	National Software Reference Library	Known file hash database (filter known-good files)
CFTT	Computer Forensics Tool Testing (NIST)	Validates forensic tool accuracy and reliability
YARA	Yet Another Recursive Acronym	Pattern matching rules for malware classification
STIX / TAXII	Structured Threat Information eXpression / Trusted Automated eXchange of Indicator Information	Threat intelligence sharing standards

312-49v11

CHFI v11 - Computer Hacking Forensic Investigator

CHFI v11 Practice Exam 1

CHFI v11 Practice Exam 2

CHFI v11 Practice Exam 3

CHFI v11 Practice Exam 4

CHFI v11 Practice Exam 5

CHFI v11 Practice Exam 6

Unlock All Content for 312-49v11

Preview (10 / 120)

Flash Cards

Available Languages

Exam Topics

312-49v11 Cheat Sheet

CHFI v11 (312-49v11) Exam Details

Exam Domain Breakdown

CHFI Certification Path

Digital Forensic Investigation Process

Evidence Handling & Chain of Custody

Order of Volatility (RFC 3227)

Legal Considerations & Forensic Readiness

Windows Forensic Artifacts

Linux & macOS Forensics

File System Comparison

File Carving & Metadata Analysis

Network Traffic Analysis

Log Correlation & SIEM

Email Forensics

Cloud Forensics (AWS / Azure / GCP)

Database Forensics

Mobile Forensics (iOS & Android)

Malware Forensics

Anti-Forensics Techniques & Detection

IoT & Dark Web Forensics

Forensic Report Writing & Expert Testimony

Forensic Suites: EnCase vs FTK vs Autopsy

Disk Imaging Tools Comparison

Hash Verification & Integrity

Memory Forensics & Volatility Framework

Write Blockers: Hardware vs Software

Essential CHFI Acronyms & Standards