IE1512: Computer Hacking Forensic Investigator (CHFI)

Course Length: 40 hrs

Prerequisites: Attend Certified Ethical Hacker (CEH) training.

Price: $2995

Format: Onsite, online

This course covers computer forensics investigation, which is the process of detecting hacking attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks. Computer forensics is simply the application of computer investigation and analysis techniques in the interests of determining potential legal evidence. Evidence might be sought in a wide range of computer crime or misuse, including but not limited to theft of trade secrets, theft of or destruction of intellectual property, and fraud.

Computer Hacking Forensic investigators (CHFI) can draw on an array of methods for discovering data that resides in a computer system, or recovering deleted, encrypted, or damaged file information. Securing and analyzing electronic evidence is a central theme in an ever-increasing number of conflict situations and criminal cases.

Topics Covered:

• The computer forensic investigation process and the various legal issues involved
• Evidence searching, seizing and acquisition methodologies in a legal and forensically sound manner
• Types of digital evidence, rules of evidence, digital evidence examination process, and electronic crime and digital evidence consideration by crime category
• Roles of the first responder, first responder toolkit, securing and evaluating electronic crime scene, conducting preliminary interviews, documenting electronic crime scene, collecting and preserving electronic evidence, packaging and transporting electronic evidence, and reporting the crime scene
• Setting up a computer forensics lab and the tools involved in it
• Various file systems and how to boot a disk
• Gathering volatile and non-volatile information from Windows
• Data acquisition and duplication rules
• Validation methods and tools required
• Recovering deleted files and deleted partitions in Windows, Mac OS X, and Linux
• Forensic investigation using AccessData FTK and EnCase
• Steganography and its techniques
• Steganalysis and image file forensics
• Password cracking concepts, tools, and types of password attacks
• Investigating password protected files
• Types of log capturing, log management, time synchronization, and log capturing tools
• Investigating logs, network traffic, wireless attacks, and web attacks
• Tracking emails and investigate email crimes
• Mobile forensics and mobile forensics software and hardware tools
• Writing investigative reports

Course Outline:

1. Computer Forensics in Today's World

2. Computer Forensics Investigation Process

3. Searching and Seizing Computers

4. Digital Evidence

5. First Responder Procedures

6. Computer Forensics Lab

7. Understanding Hard Disks and File Systems

8. Windows Forensics

9. Data Acquisition and Duplication

10. Recovering Deleted Files and Deleted Partitions

11. Forensics Investigation Using AccessData FTK

12. Forensics Investigation Using EnCase

13. Steganography and Image File Forensics

14. Application Password Crackers

15. Log Capturing and Event Correlation

16. Network Forensics, Investigating Logs and Investigating Network Traffic

17. Investigating Wireless Attacks

18. Investigating Web Attacks

19. Tracking Emails and Investigating Email Crimes

20. Mobile Forensics

21. Investigative Reports

22. Becoming an Expert Witness

Notes: Price includes exam voucher and online 6-month remote lab access.